Upload uv releases to a mirror

.github/workflows/publish-mirror.yml

@@ -0,0 +1,43 @@
+# Publish uv releases to a mirror
+#
+# Assumed to run as a subworkflow of .github/workflows/release.yml as a custom publish job
+name: publish-mirror
+
+on:
+  workflow_call:
+    inputs:
+      plan:
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  publish-mirror:
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+    env:
+      VERSION: ${{ fromJson(inputs.plan).announcement_tag }}
+    steps:
+      - name: "Download GitHub Artifacts"
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          pattern: artifacts-*
+          path: artifacts
+          merge-multiple: true
+      - name: "Upload to R2"
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.MIRROR_R2_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.MIRROR_R2_SECRET_ACCESS_KEY }}
+          AWS_ENDPOINT_URL: https://${{ secrets.MIRROR_R2_CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com
+          AWS_DEFAULT_REGION: auto
+          R2_BUCKET: ${{ secrets.MIRROR_R2_BUCKET_NAME }}
+          PROJECT: uv
+        run: |
+          aws s3 cp --recursive --output table --color on \
+            --exclude '*' \
+            --include '*.zip' --include '*.tar.gz' \
+            --cache-control "public, max-age=31536000, immutable" \
+            artifacts/ \
+            s3://${R2_BUCKET}/github/$PROJECT/releases/download/$VERSION/

.github/workflows/release.yml

@@ -307,3 +307,14 @@
     with:
       plan: ${{ needs.plan.outputs.val }}
     secrets: inherit
+
+  custom-publish-mirror:
+    needs:
+      - plan
+      - announce
+    uses: ./.github/workflows/publish-mirror.yml
+    with:
+      plan: ${{ needs.plan.outputs.val }}
+    secrets: inherit
+    permissions:
+      "contents": "read"

dist-workspace.toml

@@ -61,9 +61,9 @@ local-artifacts-jobs = ["./build-release-binaries", "./build-docker"]
 # Publish jobs to run in CI
 publish-jobs = ["./publish-pypi", "./publish-crates"]
 # Post-announce jobs to run in CI
-post-announce-jobs = ["./publish-docs", "./publish-versions"]
+post-announce-jobs = ["./publish-docs", "./publish-versions", "./publish-mirror"]
 # Custom permissions for GitHub Jobs
-github-custom-job-permissions = { "build-docker" = { packages = "write", contents = "read", id-token = "write", attestations = "write" }, "publish-crates" = { contents = "read" } }
+github-custom-job-permissions = { "build-docker" = { packages = "write", contents = "read", id-token = "write", attestations = "write" }, "publish-crates" = { contents = "read" }, "publish-mirror" = { contents = "read" } }
 # Whether to install an updater program
 install-updater = false
 # Path that installers should place binaries in