Skip to content

ci(repo): upload slim natives to S3 without waiting on the ECR mirror #6717

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
avallete merged 1 commit into from
Sep 23, 2026
Merged

ci(repo): upload slim natives to S3 without waiting on the ECR mirror #6717

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 14 additions & 9 deletions .github/workflows/mirror-slim-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,11 +11,12 @@ name: Mirror Slim Image
# `.github/scripts/mirror-slim-image.ts` rather than trusted from the payload, and the source
# must resolve to the claimed digest before anything is copied.
#
# `upload-natives-s3` then copies the same native triplets (fetched from GHCR by digest and
# `upload-natives-s3` copies the same native triplets (fetched from GHCR by digest and
# re-verified) to the public-read S3 bucket in the cli-artifacts-prod account, for sandboxes that
# allow `*.amazonaws.com` but block registry blob CDNs. It runs only after the image mirror and its
# digest checks succeeded, is best-effort like the native ECR copy, and uses the PutObject-only
# `slim-artifacts-publisher` role (infra/cli-artifacts/README.md).
# allow `*.amazonaws.com` but block registry blob CDNs. It runs in parallel with the ECR copy so an
# ECR Public outage or missing permission never holds back the S3 mirror, is best-effort like the
# native ECR copy, and uses the PutObject-only `slim-artifacts-publisher` role
# (infra/cli-artifacts/README.md).
#
# Replay locally: `bun .github/scripts/mirror-slim-image.ts --help`
# Full contract: docs/design/ecr-mirror-dispatch.md in supabase/slim-services.
Expand Down Expand Up @@ -145,12 +146,10 @@ jobs:
run: bun .github/scripts/mirror-slim-image.ts copy-natives

upload-natives-s3:
needs: mirror
# Natives only ride in repository_dispatch payloads. Nothing reaches the public bucket from a
# dispatch whose image digest check failed; a release whose mirror failed for other reasons is
# re-dispatched by the sender's backfill. The job is skipped until the cli-artifacts-prod
# account exists and its ID is set as a repository variable.
if: ${{ success() && github.event_name == 'repository_dispatch' && vars.CLI_ARTIFACTS_AWS_ACCOUNT_ID != '' }}
# dispatch whose source image digest check fails. The job is skipped until the
# cli-artifacts-prod account exists and its ID is set as a repository variable.
if: ${{ github.event_name == 'repository_dispatch' && vars.CLI_ARTIFACTS_AWS_ACCOUNT_ID != '' }}
runs-on: ubuntu-latest
timeout-minutes: 15
continue-on-error: true
Expand Down Expand Up @@ -196,6 +195,12 @@ jobs:
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Verify source digest
env:
REFERENCE: ${{ steps.validate.outputs.source }}
DIGEST: ${{ steps.validate.outputs.digest }}
run: bun .github/scripts/mirror-slim-image.ts verify-digest
Comment thread
avallete marked this conversation as resolved.
Resolved

- name: Fetch and verify native artifacts
id: fetch
env:
Expand Down
Loading