diff --git a/.github/workflows/publish-mirror.yml b/.github/workflows/publish-mirror.yml new file mode 100644 index 0000000000000..f16818dc61bc6 --- /dev/null +++ b/.github/workflows/publish-mirror.yml @@ -0,0 +1,43 @@ +# Publish uv releases to a mirror +# +# Assumed to run as a subworkflow of .github/workflows/release.yml as a custom publish job +name: publish-mirror + +on: + workflow_call: + inputs: + plan: + required: true + type: string + +permissions: {} + +jobs: + publish-mirror: + runs-on: ubuntu-latest + environment: + name: release + env: + VERSION: ${{ fromJson(inputs.plan).announcement_tag }} + steps: + - name: "Download GitHub Artifacts" + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + with: + pattern: artifacts-* + path: artifacts + merge-multiple: true + - name: "Upload to R2" + env: + AWS_ACCESS_KEY_ID: ${{ secrets.MIRROR_R2_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.MIRROR_R2_SECRET_ACCESS_KEY }} + AWS_ENDPOINT_URL: https://${{ secrets.MIRROR_R2_CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com + AWS_DEFAULT_REGION: auto + R2_BUCKET: ${{ secrets.MIRROR_R2_BUCKET_NAME }} + PROJECT: uv + run: | + aws s3 cp --recursive --output table --color on \ + --exclude '*' \ + --include '*.zip' --include '*.tar.gz' \ + --cache-control "public, max-age=31536000, immutable" \ + artifacts/ \ + s3://${R2_BUCKET}/github/$PROJECT/releases/download/$VERSION/ diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d0cd669431d1a..836990fecaa26 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -307,3 +307,14 @@ jobs: with: plan: ${{ needs.plan.outputs.val }} secrets: inherit + + custom-publish-mirror: + needs: + - plan + - announce + uses: ./.github/workflows/publish-mirror.yml + with: + plan: ${{ needs.plan.outputs.val }} + secrets: inherit + permissions: + "contents": "read" diff --git a/dist-workspace.toml b/dist-workspace.toml index 0ac151ea8f2ae..257efd455eb62 100644 --- a/dist-workspace.toml +++ b/dist-workspace.toml @@ -61,9 +61,9 @@ local-artifacts-jobs = ["./build-release-binaries", "./build-docker"] # Publish jobs to run in CI publish-jobs = ["./publish-pypi", "./publish-crates"] # Post-announce jobs to run in CI -post-announce-jobs = ["./publish-docs", "./publish-versions"] +post-announce-jobs = ["./publish-docs", "./publish-versions", "./publish-mirror"] # Custom permissions for GitHub Jobs -github-custom-job-permissions = { "build-docker" = { packages = "write", contents = "read", id-token = "write", attestations = "write" }, "publish-crates" = { contents = "read" } } +github-custom-job-permissions = { "build-docker" = { packages = "write", contents = "read", id-token = "write", attestations = "write" }, "publish-crates" = { contents = "read" }, "publish-mirror" = { contents = "read" } } # Whether to install an updater program install-updater = false # Path that installers should place binaries in