From c9cbe0d5ebc76ab169fc64fd8b591d665689e91e Mon Sep 17 00:00:00 2001 From: Louis Parkin Date: Mon, 17 Aug 2026 11:20:03 +0200 Subject: [PATCH] STAC-25590 Publish pre-release DEBs to the tooling bucket The publish lane was denied s3:PutObject because stackstate-agent-3-test lives in the master account while the OIDC role lives in tooling, so the write crossed an account boundary. terraform-infra#88 creates a tooling-owned replacement, sts-agent-prerelease, rather than granting cross-account access to a bucket whose policy serves the public apt repository. S3 names are global, so the new bucket could not keep the old name. The yum and Windows repositories are deliberately left pointing at the master buckets: nothing in this lane publishes to them, and that is where their content is. install.sh therefore renders a deb URL in tooling and yum/Windows URLs in master until those buckets move too. Depends on terraform-infra#88 being applied. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/build-deb.yml | 8 ++++---- README.md | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml index 4206a3bceceb..94bce90a4b53 100644 --- a/.github/workflows/build-deb.yml +++ b/.github/workflows/build-deb.yml @@ -471,7 +471,7 @@ jobs: SIGNING_PRIVATE_KEY: ${{ secrets.SIGNING_PRIVATE_KEY }} SIGNING_PRIVATE_PASSPHRASE: ${{ secrets.SIGNING_PRIVATE_PASSPHRASE }} SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }} - run: ./omnibus/package-scripts/publish_package.sh stackstate-agent-3-test + run: ./omnibus/package-scripts/publish_package.sh sts-agent-prerelease generate-install-script: name: Generate the pre-release agent install script @@ -494,7 +494,7 @@ jobs: - name: Render install.sh against the pre-release repositories env: - STS_AWS_TEST_BUCKET: stackstate-agent-3-test + STS_AWS_TEST_BUCKET: sts-agent-prerelease STS_AWS_TEST_BUCKET_YUM: stackstate-agent-3-rpm-test STS_AWS_TEST_BUCKET_WIN: stackstate-agent-3-test run: | @@ -544,8 +544,8 @@ jobs: - name: Upload install.sh run: | set -euo pipefail - aws s3 cp ./install.sh s3://stackstate-agent-3-test/install.sh --acl public-read - aws s3 ls s3://stackstate-agent-3-test/ + aws s3 cp ./install.sh s3://sts-agent-prerelease/install.sh --acl public-read + aws s3 ls s3://sts-agent-prerelease/ cerberus-notify: name: Report failure to Slack (Cerberus) diff --git a/README.md b/README.md index e6fc6b7b8329..4d1c4fe8f37d 100644 --- a/README.md +++ b/README.md @@ -109,9 +109,9 @@ To install the official release: If you want to install a branch version use the test repository: - $ curl -o- https://stackstate-agent-3-test.s3.amazonaws.com/install.sh | STS_API_KEY="xxx" STS_URL="yyy" CODE_NAME="PR_NAME" bash + $ curl -o- https://sts-agent-prerelease.s3.amazonaws.com/install.sh | STS_API_KEY="xxx" STS_URL="yyy" CODE_NAME="PR_NAME" bash or - $ wget -qO- https://stackstate-agent-3-test.s3.amazonaws.com/install.sh | STS_API_KEY="xxx" STS_URL="yyy" CODE_NAME="PR_NAME" bash + $ wget -qO- https://sts-agent-prerelease.s3.amazonaws.com/install.sh | STS_API_KEY="xxx" STS_URL="yyy" CODE_NAME="PR_NAME" bash and replace `PR_NAME` with the branch name (e.g. `master`, `STAC-xxxx`).