From 559aa89ca7848ad84dc32a16f84936b1d6a4d4cd Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Mon, 27 Jul 2026 07:54:03 -0700 Subject: [PATCH] ci: set AWS_REGION for Cloudflare R2 upload steps (#38658) The `configure-aws-credentials` step earlier in the same job exports **both** `AWS_DEFAULT_REGION` and `AWS_REGION` into `$GITHUB_ENV` (verified in `exportRegion()` at the pinned SHA `517a711`), so `secrets.AWS_REGION` (the real AWS region) stays set for every later step in that job. The AWS CLI v2 region resolution order is `--region` > `AWS_REGION` > `AWS_DEFAULT_REGION`. The R2 step only set `AWS_DEFAULT_REGION: auto`, so the leaked `AWS_REGION` won and R2 rejected it, since R2 only accepts `wnam`, `enam`, `weur`, `eeur`, `apac`, `oc` or `auto`. The failure log shows both `AWS_DEFAULT_REGION: auto` and `AWS_REGION: ***` in the step env, which confirms the leak. ### Fix Set `AWS_REGION: auto` explicitly in the R2 upload step env of all three release workflows. Step-level `env:` is applied after `GITHUB_ENV`-derived variables, so this reliably overrides the leaked value. No other variable leaks from `configure-aws-credentials` matter here: `AWS_SESSION_TOKEN` is only exported when a session token exists, and these workflows use static access keys without `role-to-assume`; `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are already overridden in the R2 step. Consolidating the three duplicated upload steps into a composite action remains a follow-up, as noted in #38635. --- .github/workflows/release-nightly.yml | 2 ++ .github/workflows/release-tag-rc.yml | 2 ++ .github/workflows/release-tag-version.yml | 2 ++ 3 files changed, 6 insertions(+) diff --git a/.github/workflows/release-nightly.yml b/.github/workflows/release-nightly.yml index b89dcfbb559..d070f4627b7 100644 --- a/.github/workflows/release-nightly.yml +++ b/.github/workflows/release-nightly.yml @@ -67,11 +67,13 @@ jobs: BRANCH: ${{ steps.clean_name.outputs.branch }} run: | aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress + # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here - name: upload binaries to cloudflare r2 env: AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }} AWS_DEFAULT_REGION: auto + AWS_REGION: auto CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }} CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }} BRANCH: ${{ steps.clean_name.outputs.branch }} diff --git a/.github/workflows/release-tag-rc.yml b/.github/workflows/release-tag-rc.yml index 68d337675f4..17d37579cf1 100644 --- a/.github/workflows/release-tag-rc.yml +++ b/.github/workflows/release-tag-rc.yml @@ -68,11 +68,13 @@ jobs: BRANCH: ${{ steps.clean_name.outputs.branch }} run: | aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress + # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here - name: upload binaries to cloudflare r2 env: AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }} AWS_DEFAULT_REGION: auto + AWS_REGION: auto CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }} CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }} BRANCH: ${{ steps.clean_name.outputs.branch }} diff --git a/.github/workflows/release-tag-version.yml b/.github/workflows/release-tag-version.yml index 82cfd7454bb..86970b7c2c7 100644 --- a/.github/workflows/release-tag-version.yml +++ b/.github/workflows/release-tag-version.yml @@ -71,11 +71,13 @@ jobs: BRANCH: ${{ steps.clean_name.outputs.branch }} run: | aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress + # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here - name: upload binaries to cloudflare r2 env: AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }} AWS_DEFAULT_REGION: auto + AWS_REGION: auto CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }} CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }} BRANCH: ${{ steps.clean_name.outputs.branch }}