Repository navigation
Publish over R2's S3 API; require the CDN to serve the uploaded pair - #20
Merged
Merged
Conversation
The repo's R2 credential is an S3 access key pair, which Wrangler cannot use. publish-database.sh now uploads with the aws CLI when R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY and R2_ENDPOINT are set, and with Wrangler otherwise. Post-upload verification checked only that the CDN pair was internally consistent, so a failed upload would pass on the previous pair. It now requires the CDN to serve the exact uploaded bytes, retrying past the 300 s cache. Publishing moves to publish-database.yml (workflow_call from the weekly update, or workflow_dispatch with a ref to publish or roll back). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A8mvWkYd1YBhFyvbFx7UF7
Rollback dispatches with an older ref checked out that commit's publish script, which predates S3 support and fails (Codex P1). Check out the publisher from the workflow's own revision and only the Resources directory from ref, and verify the pair before publishing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A8mvWkYd1YBhFyvbFx7UF7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The R2 credential for this bucket is an S3-style key pair (access key ID, secret, endpoint), which Wrangler can't use, so the weekly publish from #18 could never authenticate. This switches CI publishing to R2's S3 API and fixes a verification gap found while testing: the script could report success after a failed upload.
Changes
Scripts/publish-database.sh: uploads withaws s3api put-objectwhenR2_ACCESS_KEY_ID,R2_SECRET_ACCESS_KEYandR2_ENDPOINTare all set (exit 64 if only some are), and with Wrangler otherwise, so maintainer machines are unchanged.publish-database.yml(new):workflow_callfrom the weekly update after merge, andworkflow_dispatchwith arefto publishmainnow or roll back to an earlier commit.Verification
With stub
awsandwranglerbinaries onPATH(nothing uploaded):R2_ACCESS_KEY_IDsetput-objectargs: bucket, key, body, content type, cache-control,AWS_REGION=autowrangler r2 object putcalls as beforeshellcheckandactionlintare clean apart from the existing SC2129 note.Not yet verified: a real upload with the R2 keys. That happens when
publish-database.ymlis dispatched once the three secrets are set.🤖 Generated with Claude Code
https://claude.ai/code/session_01A8mvWkYd1YBhFyvbFx7UF7