ci(goreleaser): mirror release artifacts to Cloudflare R2 (#1063)

Ports the Cloudflare R2 release mirror from [gitea.com/gitea/runner](https://gitea.com/gitea/runner) to `tea`, so release artifacts land in R2 alongside S3 for the duration of the migration away from S3.

Two commits, meant to be reviewed in order.

## 1. `ci(goreleaser): migrate release config to goreleaser v2`

A purely mechanical migration, no behaviour change intended:

- add `version: 2`
- `blobs.folder` -> `blobs.directory`
- `snapshot.name_template` -> `snapshot.version_template`
- `nightly.name_template` -> `nightly.version_template`
- `version: "~> v1"` -> `"~> v2"` in both release workflows

This is a prefactor rather than scope creep. Under goreleaser v1 the custom-publisher pipe runs *4th*, before the `release` pipe; under v2 it runs *last*. That ordering difference matters for the change below: on v1 a failed R2 upload would abort the publish after every artifact had already gone to S3 but **before** the Gitea release was created, leaving a half-finished release. On v2 the R2 mirror runs after the release exists, which matches the behaviour the runner repo already has in production.

The pre-existing `archives.format` deprecation warning is deliberately left alone; it is orthogonal to this change and the runner repo has not addressed it either.

## 2. `ci(goreleaser): mirror release artifacts to Cloudflare R2`

- **`scripts/upload-r2.sh`** — uploads one local file to one R2 object key using curl's built-in AWS SigV4 signer (R2 is S3-API compatible). Credentials are fed through `curl --config -` so they never appear in `ps` output. Also provides a `--check-config` preflight mode. This file is byte-identical to the runner repo's copy.
- **`.goreleaser.yaml`** — a `publishers:` entry mirroring the existing S3 `blobs:` upload into R2. A second `blobs:` entry is not usable here: the blob pipe authenticates from the global `AWS_*` environment and has no per-entry credentials, whereas `publishers:` supports per-entry `env:`.
- **Both release workflows** — forward the R2 secrets, plus an early `check R2 configuration` step. Custom publishers run as the very last step of goreleaser's publish pipeline, so without a preflight a missing secret would only surface after the release had been created and every artifact already uploaded to S3.

### Deviation from the runner implementation

The publisher here also sets `signature: true` in addition to `checksum: true`. `tea` has a `signs:` block that GPG-signs the checksum file, and the S3 blob pipe uploads the resulting `checksums.txt.sig`; without `signature: true` the R2 mirror would carry the artifacts and their checksums but no signature to verify them against.

The object key prefix is `tea/{{ .Version }}/...`, matching the existing S3 `directory: "tea/{{.Version}}"`.

## Required repository secrets

This PR is inert until these are configured. The preflight step will fail the release loudly if they are missing:

- `R2_ENDPOINT` — e.g. `https://<account>.r2.cloudflarestorage.com`
- `R2_BUCKET`
- `R2_ACCESS_KEY_ID`
- `R2_SECRET_ACCESS_KEY`

## Verification

- `goreleaser check` against the migrated config (with the pro-only `nightly:` block temporarily stripped, since the check ran with the OSS v2 binary): *configuration is valid*, the only deprecation being the pre-existing `archives.format`.
- A real `goreleaser build --snapshot --clean --single-target` against the v2 config: succeeded, including the `xz` and `.goreleaser.checksum.sh` post-hooks.
- `scripts/upload-r2.sh`: clean under `sh -n` and `shellcheck`; all four `--check-config` cases exercised (all vars unset, one missing, all set, wrong argument count).
- The actual upload path was not exercised end to end, since that needs live R2 credentials.

Reviewed-on: https://gitea.com/gitea/tea/pulls/1063
Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com>

.gitea/workflows/release-nightly.yml

@@ -12,7 +12,19 @@ jobs:
         with:
           fetch-depth: 0
       - run: git fetch --force --tags
-      - uses: actions/setup-go@v7
+      # Custom publishers (the R2 mirror below) run as the very last
+      # step of goreleaser's publish pipeline, after the Gitea release
+      # has already been created and every artifact already uploaded
+      # to S3. Fail here instead, before anything is built or
+      # published, if the R2 secrets are missing.
+      - name: check R2 configuration
+        run: sh scripts/upload-r2.sh --check-config
+        env:
+          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
+          R2_BUCKET: ${{ secrets.R2_BUCKET }}
+          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+      - uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
       - name: import gpg
@@ -28,7 +40,7 @@ jobs:
         uses: goreleaser/goreleaser-action@v7
         with:
             distribution: goreleaser-pro
-            version: "~> v1"
+            version: "~> v2"
             args: release --nightly
         env:
           SDK_VERSION: ${{ steps.sdk_version.outputs.version }}
@@ -38,6 +50,10 @@ jobs:
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           S3_REGION: ${{ secrets.AWS_REGION }}
           S3_BUCKET: ${{ secrets.AWS_BUCKET }}
+          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
+          R2_BUCKET: ${{ secrets.R2_BUCKET }}
+          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           GORELEASER_FORCE_TOKEN: 'gitea'
           GPGSIGN_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}

.gitea/workflows/release-tag.yml

@@ -13,7 +13,19 @@ jobs:
         with:
           fetch-depth: 0
       - run: git fetch --force --tags
-      - uses: actions/setup-go@v7
+      # Custom publishers (the R2 mirror below) run as the very last
+      # step of goreleaser's publish pipeline, after the Gitea release
+      # has already been created and every artifact already uploaded
+      # to S3. Fail here instead, before anything is built or
+      # published, if the R2 secrets are missing.
+      - name: check R2 configuration
+        run: sh scripts/upload-r2.sh --check-config
+        env:
+          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
+          R2_BUCKET: ${{ secrets.R2_BUCKET }}
+          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+      - uses: actions/setup-go@v6
         with:
           go-version-file: 'go.mod'
       - name: import gpg
@@ -29,7 +41,7 @@ jobs:
         uses: goreleaser/goreleaser-action@v7
         with:
             distribution: goreleaser-pro
-            version: "~> v1"
+            version: "~> v2"
             args: release
         env:
           SDK_VERSION: ${{ steps.sdk_version.outputs.version }}
@@ -39,6 +51,10 @@ jobs:
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           S3_REGION: ${{ secrets.AWS_REGION }}
           S3_BUCKET: ${{ secrets.AWS_BUCKET }}
+          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
+          R2_BUCKET: ${{ secrets.R2_BUCKET }}
+          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           GORELEASER_FORCE_TOKEN: 'gitea'
           GPGSIGN_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}

.gitea/workflows/test-pr.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@v6
         with:
           go-version-file: 'go.mod'
       - name: lint and build
@@ -42,7 +42,7 @@ jobs:
       GITEA_TEA_TEST_PASSWORD: "test01"
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@v6
         with:
           go-version-file: 'go.mod'
       - name: wait for the gitea instance to be ready

.goreleaser.yaml

@@ -1,3 +1,5 @@
+version: 2
+
 before:
   hooks:
     - go mod tidy
@@ -79,11 +81,50 @@ blobs:
     provider: s3
     bucket: "{{ .Env.S3_BUCKET }}"
     region: "{{ .Env.S3_REGION }}"
-    folder: "tea/{{.Version}}"
+    directory: "tea/{{.Version}}"
     extra_files:
       - glob: ./**.xz
       - glob: ./**.sha256
 
+# Mirrors the S3 `blobs:` upload above into Cloudflare R2 during the
+# parallel S3+R2 period (S3 will be removed once migration completes).
+# A second `blobs:` entry is impossible here since the blob pipe
+# authenticates from the global AWS_* env with no per-entry
+# credentials; `publishers:` supports per-entry `env:` instead, so
+# it's used to invoke scripts/upload-r2.sh once per artifact. Custom
+# publishers inherit almost nothing from the environment, hence the
+# explicit R2_* forwarding below.
+#
+# This publisher fires more than once per distinct key because
+# goreleaser's release pipe already registers `release.extra_files`
+# (./**.xz and ./**.xz.sha256, see the `release:` block below) as
+# UploadableFile artifacts, and `internal/exec`'s filterArtifacts
+# appends this block's own extra_files with no de-duplication. It
+# can't be globbed away, since gobwas/glob (via goreleaser/fileglob)
+# has no substring-exclusion matcher. It's harmless: PUT is
+# idempotent, and the `./**.xz` glob below is kept deliberately so
+# this publisher declares its own complete file set rather than
+# implicitly depending on the `release:` block's globs.
+#
+# checksum: true mirrors goreleaser's generated checksums.txt;
+# signature: true additionally mirrors checksums.txt.sig, which the
+# `signs:` block below produces by GPG-signing that checksum file.
+# Without signature: true, artifacts downloaded from the R2 mirror
+# would have no signature file to verify against.
+publishers:
+  - name: cloudflare-r2
+    checksum: true
+    signature: true
+    extra_files:
+      - glob: ./**.xz
+      - glob: ./**.sha256
+    cmd: sh scripts/upload-r2.sh {{ abs .ArtifactPath }} tea/{{ .Version }}/{{ .ArtifactName }}
+    env:
+      - R2_ENDPOINT={{ index .Env "R2_ENDPOINT" }}
+      - R2_BUCKET={{ index .Env "R2_BUCKET" }}
+      - R2_ACCESS_KEY_ID={{ index .Env "R2_ACCESS_KEY_ID" }}
+      - R2_SECRET_ACCESS_KEY={{ index .Env "R2_SECRET_ACCESS_KEY" }}
+
 archives:
   - format: binary
     name_template: "{{ .Binary }}"
@@ -104,10 +145,10 @@ signs:
     args: ["--batch", "-u", "{{ .Env.GPG_FINGERPRINT }}", "--output", "${signature}", "--detach-sign", "${artifact}"]
 
 snapshot:
-  name_template: "{{ .Branch }}-devel"
+  version_template: "{{ .Branch }}-devel"
 
 nightly:
-  name_template: "{{ .Branch }}"
+  version_template: "{{ .Branch }}"
 
 gitea_urls:
   api: https://gitea.com/api/v1

cmd/notifications/list.go

@@ -63,12 +63,12 @@ func listNotifications(requestCtx stdctx.Context, cmd *cli.Command, status []git
 	var news []*gitea.NotificationThread
 	var err error
 
-	ctx, err := context.InitCommand(cmd)
+	all := cmd.Bool("mine")
+	ctx, err := context.InitCommandWithOptions(cmd, context.InitOptions{SkipLocalRepo: all})
 	if err != nil {
 		return err
 	}
 	client := ctx.Login.Client()
-	all := ctx.Bool("mine")
 
 	// This enforces pagination (see https://github.com/go-gitea/gitea/issues/16733)
 	listOpts := flags.GetListOptions(cmd)

cmd/notifications/list_test.go

@@ -0,0 +1,55 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package notifications
+
+import (
+	stdctx "context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"gitea.dev/tea/modules/config"
+	"github.com/stretchr/testify/require"
+	"github.com/urfave/cli/v3"
+)
+
+func TestRunNotificationsListMineDoesNotProbeGitRepository(t *testing.T) {
+	gitPath := filepath.Join(t.TempDir(), "git")
+	gitScript := "#!/bin/sh\necho 'git should not be called' >&2\nexit 1\n"
+	if runtime.GOOS == "windows" {
+		gitPath += ".bat"
+		gitScript = "@echo git should not be called 1>&2\r\nexit /b 1\r\n"
+	}
+	require.NoError(t, os.WriteFile(gitPath, []byte(gitScript), 0o755))
+	t.Setenv("PATH", filepath.Dir(gitPath))
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		require.Equal(t, "/api/v1/notifications", r.URL.Path)
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`[]`))
+	}))
+	defer server.Close()
+
+	config.SetConfigForTesting(config.LocalConfig{
+		Logins: []config.Login{{
+			Name:    "default",
+			URL:     server.URL,
+			Token:   "token",
+			User:    "user",
+			Default: true,
+		}},
+	})
+
+	cmd := cli.Command{
+		Name:  CmdNotificationsList.Name,
+		Flags: CmdNotificationsList.Flags,
+	}
+	require.NoError(t, cmd.Set("mine", "true"))
+	require.NoError(t, cmd.Set("output", "json"))
+
+	require.NoError(t, RunNotificationsList(stdctx.Background(), &cmd))
+}

cmd/notifications/mark_as.go

@@ -24,7 +24,7 @@ var CmdNotificationsMarkRead = cli.Command{
 	ArgsUsage:   "[all | <notification id>]",
 	Flags:       flags.NotificationFlags,
 	Action: func(requestCtx stdctx.Context, cmd *cli.Command) error {
-		ctx, err := context.InitCommand(cmd)
+		ctx, err := context.InitCommandWithOptions(cmd, context.InitOptions{SkipLocalRepo: cmd.Bool("mine")})
 		if err != nil {
 			return err
 		}
@@ -48,7 +48,7 @@ var CmdNotificationsMarkUnread = cli.Command{
 	ArgsUsage:   "[all | <notification id>]",
 	Flags:       flags.NotificationFlags,
 	Action: func(requestCtx stdctx.Context, cmd *cli.Command) error {
-		ctx, err := context.InitCommand(cmd)
+		ctx, err := context.InitCommandWithOptions(cmd, context.InitOptions{SkipLocalRepo: cmd.Bool("mine")})
 		if err != nil {
 			return err
 		}
@@ -72,7 +72,7 @@ var CmdNotificationsMarkPinned = cli.Command{
 	ArgsUsage:   "[all | <notification id>]",
 	Flags:       flags.NotificationFlags,
 	Action: func(requestCtx stdctx.Context, cmd *cli.Command) error {
-		ctx, err := context.InitCommand(cmd)
+		ctx, err := context.InitCommandWithOptions(cmd, context.InitOptions{SkipLocalRepo: cmd.Bool("mine")})
 		if err != nil {
 			return err
 		}
@@ -95,7 +95,7 @@ var CmdNotificationsUnpin = cli.Command{
 	ArgsUsage:   "[all | <notification id>]",
 	Flags:       flags.NotificationFlags,
 	Action: func(requestCtx stdctx.Context, cmd *cli.Command) error {
-		ctx, err := context.InitCommand(cmd)
+		ctx, err := context.InitCommandWithOptions(cmd, context.InitOptions{SkipLocalRepo: cmd.Bool("mine")})
 		if err != nil {
 			return err
 		}

modules/context/context.go

@@ -37,6 +37,12 @@ type TeaContext struct {
 	LocalRepo *git.TeaRepo  // is set if flags specified a local repo via --repo, or if $PWD is a git repo
 }
 
+// InitOptions controls which optional sources InitCommand may inspect.
+type InitOptions struct {
+	// SkipLocalRepo avoids probing the current directory for a git repository.
+	SkipLocalRepo bool
+}
+
 // GetRemoteRepoHTMLURL returns the web-ui url of the remote repo,
 // after ensuring a remote repo is present in the context.
 func (ctx *TeaContext) GetRemoteRepoHTMLURL() (string, error) {
@@ -61,6 +67,12 @@ func shouldPromptFallbackLogin(login *config.Login, canPrompt bool) bool {
 // the remotes of the .git repo specified in repoFlag or $PWD, and using overrides from
 // command flags. If a local git repo can't be found, repo slug values are unset.
 func InitCommand(cmd *cli.Command) (*TeaContext, error) {
+	return InitCommandWithOptions(cmd, InitOptions{})
+}
+
+// InitCommandWithOptions resolves the application context like InitCommand, with
+// optional controls for commands that do not need repository context.
+func InitCommandWithOptions(cmd *cli.Command, opts InitOptions) (*TeaContext, error) {
 	// these flags are used as overrides to the context detection via local git repo
 	repoFlag := cmd.String("repo")
 	loginFlag := cmd.String("login")
@@ -76,7 +88,7 @@ func InitCommand(cmd *cli.Command) (*TeaContext, error) {
 	)
 
 	// check if repoFlag can be interpreted as path to local repo.
-	if len(repoFlag) != 0 {
+	if len(repoFlag) != 0 && !opts.SkipLocalRepo {
 		if repoFlagPathExists, err = utils.DirExists(repoFlag); err != nil {
 			return nil, err
 		}
@@ -85,6 +97,8 @@ func InitCommand(cmd *cli.Command) (*TeaContext, error) {
 		} else {
 			c.RepoSlug = repoFlag
 		}
+	} else if len(repoFlag) != 0 {
+		c.RepoSlug = repoFlag
 	}
 
 	if len(remoteFlag) == 0 {
@@ -101,24 +115,26 @@ func InitCommand(cmd *cli.Command) (*TeaContext, error) {
 		extraLogins = append(extraLogins, *envLogin)
 	}
 
-	// try to read local git repo & extract context: if repoFlag specifies a valid path, read repo in that dir,
-	// otherwise attempt PWD. if no repo is found, continue with default login
-	if repoPath == "" {
-		if repoPath, err = os.Getwd(); err != nil {
-			return nil, err
+	if !opts.SkipLocalRepo {
+		// try to read local git repo & extract context: if repoFlag specifies a valid path, read repo in that dir,
+		// otherwise attempt PWD. if no repo is found, continue with default login
+		if repoPath == "" {
+			if repoPath, err = os.Getwd(); err != nil {
+				return nil, err
+			}
 		}
-	}
 
-	var localSlug string
-	if c.LocalRepo, c.Login, localSlug, err = contextFromLocalRepo(repoPath, remoteFlag, extraLogins); err != nil {
-		if err == errNotAGiteaRepo || err == git.ErrRepositoryNotExists {
-			// we can deal with that, commands needing the optional values use ctx.Ensure()
-		} else {
-			return nil, err
+		var localSlug string
+		if c.LocalRepo, c.Login, localSlug, err = contextFromLocalRepo(repoPath, remoteFlag, extraLogins); err != nil {
+			if err == errNotAGiteaRepo || err == git.ErrRepositoryNotExists {
+				// we can deal with that, commands needing the optional values use ctx.Ensure()
+			} else {
+				return nil, err
+			}
+		}
+		if c.RepoSlug == "" && localSlug != "" {
+			c.RepoSlug = localSlug
 		}
-	}
-	if c.RepoSlug == "" && localSlug != "" {
-		c.RepoSlug = localSlug
 	}
 
 	// If env vars are set, always use the env login (but repo slug was already
@@ -150,7 +166,7 @@ and then run your command again`)
 		if shouldPromptFallbackLogin(c.Login, canPrompt) {
 			fallback := false
 			if err := huh.NewConfirm().
-				Title(fmt.Sprintf("NOTE: no gitea login detected, whether falling back to login '%s'?", c.Login.Name)).
+				Title(fmt.Sprintf("NOTE: no login matched this repository. Fall back to login '%s'?", c.Login.Name)).
 				Value(&fallback).
 				WithTheme(theme.GetTheme()).
 				Run(); err != nil {
@@ -160,7 +176,7 @@ and then run your command again`)
 				return nil, ErrCommandCanceled
 			}
 		} else if !c.Login.Default {
-			fmt.Fprintf(os.Stderr, "NOTE: no gitea login detected, falling back to login '%s' in non-interactive mode.\n", c.Login.Name)
+			fmt.Fprintf(os.Stderr, "NOTE: no login matched this repository, falling back to login '%s' in non-interactive mode.\n", c.Login.Name)
 		}
 	}
 

scripts/upload-r2.sh

@@ -0,0 +1,112 @@
+#!/bin/sh
+# Copyright 2026 The Gitea Authors. All rights reserved.
+# SPDX-License-Identifier: MIT
+#
+# upload-r2.sh uploads a single local file to a single object key in a
+# Cloudflare R2 bucket, using curl's built-in AWS SigV4 signer (R2 is
+# S3-API compatible).
+#
+# This is the R2 half of the release process's parallel S3+R2 upload
+# period: goreleaser's `blobs:` pipe still uploads every release
+# artifact to AWS S3, and this script is invoked once per artifact
+# (via a goreleaser `publishers:` entry) to mirror the same artifact
+# into R2. Once the migration away from S3 is complete, the `blobs:`
+# block and the AWS_* secrets can be dropped without touching this
+# script.
+#
+# Usage:
+#   upload-r2.sh <local-file> <remote-key>
+#   upload-r2.sh --check-config
+#
+# The second form only validates that the required environment
+# variables below are set (it does not touch the network or the
+# filesystem beyond that), and is meant to be run as an early
+# preflight step in CI: goreleaser custom publishers run as the very
+# last step of the publish pipeline, so without a preflight check a
+# missing R2_* secret would only be discovered after the Gitea release
+# has already been created and every artifact already uploaded to S3.
+#
+# Required environment variables:
+#   R2_ENDPOINT          Base URL of the R2 endpoint, e.g.
+#                        https://<account>.r2.cloudflarestorage.com
+#   R2_BUCKET            Destination bucket name.
+#   R2_ACCESS_KEY_ID     R2 access key id.
+#   R2_SECRET_ACCESS_KEY R2 secret access key.
+
+set -eu
+
+# check_env validates that all required R2_* environment variables are
+# set and non-empty, printing a single "missing required environment
+# variable(s): ..." message and exiting non-zero otherwise. Used by
+# both the normal upload mode and --check-config, so the validation
+# logic only exists in one place.
+check_env() {
+  missing=""
+
+  if [ -z "${R2_ENDPOINT:-}" ]; then
+    missing="$missing R2_ENDPOINT"
+  fi
+  if [ -z "${R2_BUCKET:-}" ]; then
+    missing="$missing R2_BUCKET"
+  fi
+  if [ -z "${R2_ACCESS_KEY_ID:-}" ]; then
+    missing="$missing R2_ACCESS_KEY_ID"
+  fi
+  if [ -z "${R2_SECRET_ACCESS_KEY:-}" ]; then
+    missing="$missing R2_SECRET_ACCESS_KEY"
+  fi
+
+  if [ -n "$missing" ]; then
+    echo "upload-r2.sh: missing required environment variable(s):$missing" >&2
+    exit 1
+  fi
+}
+
+if [ "$#" -eq 1 ] && [ "$1" = "--check-config" ]; then
+  check_env
+  echo "upload-r2.sh: R2 configuration OK"
+  exit 0
+fi
+
+if [ "$#" -ne 2 ]; then
+  echo "usage: upload-r2.sh <local-file> <remote-key>" >&2
+  echo "       upload-r2.sh --check-config" >&2
+  exit 1
+fi
+
+local_file="$1"
+remote_key="$2"
+
+if [ ! -f "$local_file" ]; then
+  echo "upload-r2.sh: local file not found: $local_file" >&2
+  exit 1
+fi
+
+check_env
+
+# Strip a single trailing slash from the endpoint, if present, so that
+# building the path-style URL below never produces a double slash.
+endpoint="${R2_ENDPOINT%/}"
+url="$endpoint/$R2_BUCKET/$remote_key"
+
+# Credentials are passed to curl through a config file read from
+# stdin rather than as a command-line argument, so they never show up
+# in `ps` output.
+#
+# --fail-with-body (instead of plain --fail) still exits non-zero on
+# HTTP errors, but also prints R2's XML error body, which is where the
+# actual error code lives (SignatureDoesNotMatch, NoSuchBucket,
+# AccessDenied, ...); with plain --fail that body is discarded and the
+# failure is silent. --retry 3 (without --retry-all-errors) still
+# retries the transient cases (5xx, 408, 429, connection failures);
+# --retry-all-errors would additionally retry permanent 4xx responses
+# three times with backoff, which only delays an inevitable failure.
+printf 'user = "%s:%s"\n' "$R2_ACCESS_KEY_ID" "$R2_SECRET_ACCESS_KEY" | curl \
+  --config - \
+  --fail-with-body \
+  --silent \
+  --show-error \
+  --retry 3 \
+  --aws-sigv4 "aws:amz:auto:s3" \
+  --upload-file "$local_file" \
+  "$url"