Publish every build to someones.computer's download channels #13

Merged

geusebio merged 1 commit from feature/s3-binary-distribution into main

2026-08-06 12:22:08 +00:00

geusebio commented

2026-08-06 12:02:58 +00:00

Owner

This repo is private, so its Forgejo release assets are unreachable to exactly the people who need sc. goreleaser now mirrors what it builds into the platform's object store, and the platform hands it out from its own domain — see the companion PR on someones.computer.

Two channels, one pipeline

Trigger	goreleaser	Forgejo release	Channel	Version
push to `main`	`--snapshot`	none	`dev`	`0.0.1-snapshot-<sha>`
`v*` tag	`release --clean`	yes	`stable`	the tag

No rolling dev git tag. A snapshot version already names the commit it came from, so a moving tag would add nothing and force-push something.

The mirror

scripts/publish-s3.sh — six PUTs signed with curl --aws-sigv4, rather than installing an AWS CLI into a runner that otherwise needs nothing but Go. It writes the archives and goreleaser's checksums.txt under releases/<version>/, then moves channels/<channel> last, so a half-finished upload leaves the channel on the previous version instead of on a set of 404s.

checksums.txt doubles as the manifest the platform reads: the set of downloadable files is exactly the set somebody can verify, with no second hand-written index to disagree with the bytes.

Its own bucket

sc-builder is this pipeline's alone and the key can reach nothing else on that object store; the platform's own keys have read on it and nothing more. Garage grants permissions per bucket and no finer, so sharing the platform's data bucket would have handed this repo's CI write access to every stored build context — which the build worker feeds to kaniko by object key.

Five settings, already configured on this repo (SC_S3_ENDPOINT, SC_S3_REGION, SC_S3_BUCKET as variables; SC_S3_ACCESS_KEY / SC_S3_SECRET_KEY as secrets). SC_S3_REGION is us-east-1, not garage — s3.grey.ooo reports the former and SigV4 rejects the wrong region outright. Missing credentials warn rather than fail: a release that reached Forgejo has done this repo's job, and a fork should still be able to cut one.

Verified

goreleaser release --snapshot locally, then publish-s3.sh into a dev Garage — six archives + checksums + pointer, keys exactly as above.
The credential this pipeline will use, round-tripped against the real sc-builder on s3.grey.ooo: PUT 200, GET returns the body, DELETE 204, follow-up GET 404.
Installed from the resulting channel through the platform on macOS/arm64 and inside Alpine (busybox wget/sha256sum/tar); sc --help runs in both.
shellcheck clean; actionlint clean.

The first dev publish happens on the merge commit itself.

This repo is private, so its Forgejo release assets are unreachable to exactly the people who need `sc`. goreleaser now mirrors what it builds into the platform's object store, and the platform hands it out from its own domain — see the companion PR on `someones.computer`. ## Two channels, one pipeline | Trigger | goreleaser | Forgejo release | Channel | Version | |---|---|---|---|---| | push to `main` | `--snapshot` | none | `dev` | `0.0.1-snapshot-<sha>` | | `v*` tag | `release --clean` | yes | `stable` | the tag | **No rolling `dev` git tag.** A snapshot version already names the commit it came from, so a moving tag would add nothing and force-push something. ## The mirror `scripts/publish-s3.sh` — six PUTs signed with `curl --aws-sigv4`, rather than installing an AWS CLI into a runner that otherwise needs nothing but Go. It writes the archives and goreleaser's `checksums.txt` under `releases/<version>/`, then moves `channels/<channel>` **last**, so a half-finished upload leaves the channel on the previous version instead of on a set of 404s. `checksums.txt` doubles as the manifest the platform reads: the set of downloadable files is exactly the set somebody can verify, with no second hand-written index to disagree with the bytes. ## Its own bucket `sc-builder` is this pipeline's alone and the key can reach nothing else on that object store; the platform's own keys have **read** on it and nothing more. Garage grants permissions per bucket and no finer, so sharing the platform's data bucket would have handed this repo's CI write access to every stored build context — which the build worker feeds to kaniko by object key. Five settings, already configured on this repo (`SC_S3_ENDPOINT`, `SC_S3_REGION`, `SC_S3_BUCKET` as variables; `SC_S3_ACCESS_KEY` / `SC_S3_SECRET_KEY` as secrets). `SC_S3_REGION` is `us-east-1`, not `garage` — s3.grey.ooo reports the former and SigV4 rejects the wrong region outright. Missing credentials **warn rather than fail**: a release that reached Forgejo has done this repo's job, and a fork should still be able to cut one. ## Verified - `goreleaser release --snapshot` locally, then `publish-s3.sh` into a dev Garage — six archives + checksums + pointer, keys exactly as above. - The credential this pipeline will use, round-tripped against the real `sc-builder` on s3.grey.ooo: PUT 200, GET returns the body, DELETE 204, follow-up GET 404. - Installed from the resulting channel through the platform on macOS/arm64 and inside Alpine (busybox `wget`/`sha256sum`/`tar`); `sc --help` runs in both. - `shellcheck` clean; `actionlint` clean. The first `dev` publish happens on the merge commit itself.

geusebio added 1 commit

2026-08-06 12:02:58 +00:00

Publish every build to someones.computer's download channels

CI / build (pull_request) Successful in 2m24s

Details

a910278333

The binaries existed but nobody could get them: this repo is private, so
its Forgejo release assets are unreachable to exactly the people who need
`sc`. goreleaser now mirrors what it builds into the platform's object
store, and the platform hands it out from its own domain.

Two channels out of one pipeline — a `v*` tag cuts a Forgejo release and
publishes to `stable`; a push to `main` builds a snapshot and publishes to
`dev`. No rolling `dev` git tag: a snapshot version already names the
commit it came from, so a moving tag would add nothing and force-push
something.

scripts/publish-s3.sh is the mirror — six PUTs signed with `curl
--aws-sigv4` rather than an AWS CLI in a runner that otherwise needs only
Go. It writes the archives and goreleaser's checksums.txt under
releases/<version>/, then moves channels/<channel> last, so a
half-finished upload leaves the channel on the previous version instead of
on a set of 404s.

The bucket (sc-builder) is this pipeline's alone and the key can reach
nothing else on that store. Garage grants permissions per bucket and no
finer, so sharing the platform's data bucket would have handed this repo's
CI write access to every stored build context — which the build worker
feeds to kaniko by object key.

Missing credentials warn rather than fail: a release that reached Forgejo
has done this repo's job, and a fork should still be able to cut one.

geusebio started working

2026-08-06 12:13:49 +00:00

geusebio added the

⏳in-progress

label

2026-08-06 12:14:06 +00:00

geusebio changed title from ~~WIP: Publish every build to someones.computer's download channels~~ to Publish every build to someones.computer's download channels

2026-08-06 12:17:38 +00:00

geusebio stopped working

2026-08-06 12:18:13 +00:00

4 minutes 24 seconds

geusebio removed the

⏳in-progress

label

2026-08-06 12:18:14 +00:00

geusebio merged commit 7ffde46510 into main

2026-08-06 12:22:08 +00:00

geusebio referenced this pull request

2026-08-06 14:19:37 +00:00