Skip to content

Add R2 dual-write for nightly appcast and DMGs #2335

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lawrencecchen merged 4 commits into from
Mar 30, 2026
Merged

Add R2 dual-write for nightly appcast and DMGs #2335

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1c51281
Add R2 dual-write for nightly appcast and DMGs
lawrencecchen Mar 30, 2026
17a1f24
Add continue-on-error to R2 steps
lawrencecchen Mar 30, 2026
b0e785c
Add R2 dual-write for stable release appcast and DMG
lawrencecchen Mar 30, 2026
7ba3ea0
Address review feedback: cache headers, no double build, AWS CLI guard
lawrencecchen Mar 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions .github/workflows/nightly.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -503,6 +503,43 @@ jobs:
# installs to migrate onto the unified nightly appcast.
cp appcast.xml appcast-universal.xml

- name: Upload nightly assets to R2
if: needs.decide.outputs.should_publish == 'true' && steps.current_head_prebuild.outputs.still_current == 'true' && steps.current_head_postbuild.outputs.still_current == 'true'
continue-on-error: true
env:
AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: auto
R2_ENDPOINT: "https://${{ secrets.CF_R2_ACCOUNT_ID }}.r2.cloudflarestorage.com"
Comment on lines +506 to +513

@greptile-apps greptile-apps Bot Mar 30, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 AWS CLI availability not verified

The step calls aws s3 cp directly without installing or validating that the AWS CLI is present on the warp-macos-26-arm64-6x runner. macOS GitHub-hosted and many self-hosted macOS runners do not ship with the AWS CLI pre-installed. If it is absent the step will fail with a cryptic "command not found" error rather than a clear message.

Consider adding a guard or an explicit install:

- name: Install AWS CLI (if needed)
  run: |
    if ! command -v aws &>/dev/null; then
      brew install awscli
    fi

Or verify in the run script itself:

command -v aws >/dev/null 2>&1 || { echo "aws CLI not found; install awscli" >&2; exit 1; }

run: |
set -euo pipefail
command -v aws >/dev/null 2>&1 || { echo "Installing AWS CLI..."; brew install awscli; }
BUCKET=cmux-binaries

# Derive R2 appcast from the GitHub one by replacing the download URL prefix.
# EdDSA signature is over the DMG content, not the URL, so this is safe.
sed 's|https://github.com/manaflow-ai/cmux/releases/download/nightly/|https://files.cmux.com/nightly/|g' \
appcast.xml > appcast-r2.xml

# Upload immutable versioned DMG (cacheable forever).
aws s3 cp "$NIGHTLY_DMG_IMMUTABLE" \
"s3://${BUCKET}/nightly/${NIGHTLY_DMG_IMMUTABLE}" \
--endpoint-url "$R2_ENDPOINT" \
--cache-control "max-age=31536000, immutable"
# Upload mutable latest DMG (no cache).
aws s3 cp cmux-nightly-macos.dmg \
"s3://${BUCKET}/nightly/cmux-nightly-macos.dmg" \
--endpoint-url "$R2_ENDPOINT" \
--cache-control "no-cache, no-store, must-revalidate"

# Upload appcast last (atomic PutObject, no 404 window).
aws s3 cp appcast-r2.xml \
"s3://${BUCKET}/nightly/appcast.xml" \
--endpoint-url "$R2_ENDPOINT" \
--cache-control "no-cache, no-store, must-revalidate"

echo "R2 upload complete: https://files.cmux.com/nightly/appcast.xml"

Comment on lines +509 to +542

@coderabbitai coderabbitai Bot Mar 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Add fail-fast checks for R2 secrets before upload.

If any R2 secret is empty, this step fails later with opaque endpoint/auth errors. Validate upfront for clearer failures.

Suggested patch 
       - name: Upload nightly assets to R2
         if: needs.decide.outputs.should_publish == 'true' && steps.current_head_prebuild.outputs.still_current == 'true' && steps.current_head_postbuild.outputs.still_current == 'true'
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: auto
-          R2_ENDPOINT: "https://${{ secrets.CF_R2_ACCOUNT_ID }}.r2.cloudflarestorage.com"
+          CF_R2_ACCOUNT_ID: ${{ secrets.CF_R2_ACCOUNT_ID }}
         run: |
           set -euo pipefail
+          : "${AWS_ACCESS_KEY_ID:?Missing CF_R2_ACCESS_KEY_ID secret}"
+          : "${AWS_SECRET_ACCESS_KEY:?Missing CF_R2_SECRET_ACCESS_KEY secret}"
+          : "${CF_R2_ACCOUNT_ID:?Missing CF_R2_ACCOUNT_ID secret}"
+          R2_ENDPOINT="https://${CF_R2_ACCOUNT_ID}.r2.cloudflarestorage.com"
           BUCKET=cmux-binaries
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/nightly.yml around lines 517 - 540, Add explicit fail-fast
validation of the R2 secrets and endpoint before any aws s3 cp calls: check that
environment variables CF_R2_ACCESS_KEY_ID, CF_R2_SECRET_ACCESS_KEY,
CF_R2_ACCOUNT_ID (used to build R2_ENDPOINT) and NIGHTLY_DMG_IMMUTABLE are
non-empty and exit with a clear error if any are missing. Locate the workflow
step that sets env and runs the upload (references: env variables
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, R2_ENDPOINT, the BUCKET variable, and
the aws s3 cp commands) and add simple checks after set -euo pipefail that print
which variable is missing and call exit 1 so the job fails fast with an
informative message.

- name: Attest remote daemon nightly assets
if: needs.decide.outputs.should_publish != 'true' || (steps.current_head_prebuild.outputs.still_current == 'true' && steps.current_head_postbuild.outputs.still_current == 'true')
uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
Expand Down
31 changes: 31 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -336,6 +336,37 @@ jobs:
fi
./scripts/sparkle_generate_appcast.sh cmux-macos.dmg "$GITHUB_REF_NAME" appcast.xml

- name: Upload release assets to R2
if: steps.guard_release_assets.outputs.skip_upload != 'true' && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')

@chatgpt-codex-connector chatgpt-codex-connector Bot Mar 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Gate stable R2 publishes to the latest release tag

In .github/workflows/release.yml, this new step runs on any pushed tag and then uploads to fixed keys under stable/ (cmux-macos.dmg and appcast.xml), so a backport or older tag pushed later can overwrite the stable feed with an older build. When clients are switched to files.cmux.com/stable/appcast.xml, that can surface a downgrade path unintentionally. Add a recency/semver guard (or equivalent latest-release check) before writing the stable objects.

Useful? React with 👍 / 👎.

continue-on-error: true
env:
AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: auto
R2_ENDPOINT: "https://${{ secrets.CF_R2_ACCOUNT_ID }}.r2.cloudflarestorage.com"
run: |
set -euo pipefail
command -v aws >/dev/null 2>&1 || { echo "Installing AWS CLI..."; brew install awscli; }
BUCKET=cmux-binaries

# Derive R2 appcast by replacing the download URL prefix.
sed "s|https://github.com/manaflow-ai/cmux/releases/download/${GITHUB_REF_NAME}/|https://files.cmux.com/stable/|g" \
appcast.xml > appcast-r2.xml

# Upload DMG first so the appcast never references a missing file.
aws s3 cp cmux-macos.dmg \
"s3://${BUCKET}/stable/cmux-macos.dmg" \
--endpoint-url "$R2_ENDPOINT" \
--cache-control "no-cache, no-store, must-revalidate"

# Upload appcast last (atomic PutObject, no 404 window).
aws s3 cp appcast-r2.xml \
"s3://${BUCKET}/stable/appcast.xml" \
--endpoint-url "$R2_ENDPOINT" \
--cache-control "no-cache, no-store, must-revalidate"

echo "R2 upload complete: https://files.cmux.com/stable/appcast.xml"

- name: Attest remote daemon release assets
if: steps.guard_release_assets.outputs.skip_all != 'true'
uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
Expand Down
Loading