From 511b6358d966fdff510f37a48eaa6859d905ac5b Mon Sep 17 00:00:00 2001 From: Louis Parkin Date: Mon, 17 Aug 2026 11:20:03 +0200 Subject: [PATCH] STAC-25590 Publish pre-release DEBs to the tooling bucket The publish lane was denied s3:PutObject because stackstate-agent-3-test lives in the master account while the OIDC role lives in tooling, so the write crossed an account boundary. terraform-infra#89 creates a tooling-owned replacement, sts-agent-prerelease, rather than granting cross-account access to a bucket whose policy serves the public apt repository. S3 names are global, so the new bucket could not keep the old name. The yum and Windows repositories are deliberately left pointing at the master buckets: nothing in this lane publishes to them, and that is where their content is. install.sh therefore renders a deb URL in tooling and yum/Windows URLs in master until those buckets move too. The README described a per-branch install contract that this lane has not honoured since the move to GitHub Actions: the publish job is gated on pushes to the release branch and publish_package.sh takes the apt codename from the ref, so master and STAC-xxxx codenames stopped being produced. The old bucket still serves them from 2024, which masked the gap. Document what is actually published and point at the old bucket for the historical ones. The install fetch gains -fL so the pre-release bucket's regional 307 is followed rather than piped into bash. Depends on terraform-infra#89, which is applied. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/build-deb.yml | 8 ++++---- README.md | 15 ++++++++++----- 2 files changed, 14 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml index 4206a3bceceb..94bce90a4b53 100644 --- a/.github/workflows/build-deb.yml +++ b/.github/workflows/build-deb.yml @@ -471,7 +471,7 @@ jobs: SIGNING_PRIVATE_KEY: ${{ secrets.SIGNING_PRIVATE_KEY }} SIGNING_PRIVATE_PASSPHRASE: ${{ secrets.SIGNING_PRIVATE_PASSPHRASE }} SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }} - run: ./omnibus/package-scripts/publish_package.sh stackstate-agent-3-test + run: ./omnibus/package-scripts/publish_package.sh sts-agent-prerelease generate-install-script: name: Generate the pre-release agent install script @@ -494,7 +494,7 @@ jobs: - name: Render install.sh against the pre-release repositories env: - STS_AWS_TEST_BUCKET: stackstate-agent-3-test + STS_AWS_TEST_BUCKET: sts-agent-prerelease STS_AWS_TEST_BUCKET_YUM: stackstate-agent-3-rpm-test STS_AWS_TEST_BUCKET_WIN: stackstate-agent-3-test run: | @@ -544,8 +544,8 @@ jobs: - name: Upload install.sh run: | set -euo pipefail - aws s3 cp ./install.sh s3://stackstate-agent-3-test/install.sh --acl public-read - aws s3 ls s3://stackstate-agent-3-test/ + aws s3 cp ./install.sh s3://sts-agent-prerelease/install.sh --acl public-read + aws s3 ls s3://sts-agent-prerelease/ cerberus-notify: name: Report failure to Slack (Cerberus) diff --git a/README.md b/README.md index e6fc6b7b8329..5806ca657fa5 100644 --- a/README.md +++ b/README.md @@ -105,15 +105,20 @@ To install the official release: or $ wget -qO- https://stackstate-agent-3.s3.amazonaws.com/install.sh | STS_API_KEY="xxx" STS_URL="yyy" bash -##### Test +##### Pre-release -If you want to install a branch version use the test repository: +If you want to install a pre-release build use the pre-release repository: - $ curl -o- https://stackstate-agent-3-test.s3.amazonaws.com/install.sh | STS_API_KEY="xxx" STS_URL="yyy" CODE_NAME="PR_NAME" bash + $ curl -fLo- https://sts-agent-prerelease.s3.amazonaws.com/install.sh | STS_API_KEY="xxx" STS_URL="yyy" CODE_NAME="RELEASE_BRANCH" bash or - $ wget -qO- https://stackstate-agent-3-test.s3.amazonaws.com/install.sh | STS_API_KEY="xxx" STS_URL="yyy" CODE_NAME="PR_NAME" bash + $ wget -qO- https://sts-agent-prerelease.s3.amazonaws.com/install.sh | STS_API_KEY="xxx" STS_URL="yyy" CODE_NAME="RELEASE_BRANCH" bash -and replace `PR_NAME` with the branch name (e.g. `master`, `STAC-xxxx`). +and replace `RELEASE_BRANCH` with the release branch name (e.g. `stackstate-7.78.2`). + +Only the release branch is published here: the publishing job runs on pushes to +that branch and uses the branch name as the apt codename. Per-branch builds such +as `master` or `STAC-xxxx` are no longer produced — historical ones remain +readable at `https://stackstate-agent-3-test.s3.amazonaws.com`. ### Docker