mirror of
https://github.com/go-gitea/gitea.git
synced 2026-07-28 09:15:18 +02:00
4a77fbce28
Backport #38658 by @lunny ## What to build Fix the Cloudflare R2 upload steps added in #38635, which currently fail on every release run: ``` fatal error: An error occurred (InvalidRegionName) when calling the ListObjectsV2 operation: The region name '***' is not valid. Must be one of: wnam, enam, weur, eeur, apac, oc, auto ``` ### Root cause The `configure-aws-credentials` step earlier in the same job exports **both** `AWS_DEFAULT_REGION` and `AWS_REGION` into `$GITHUB_ENV` (verified in `exportRegion()` at the pinned SHA `517a711`), so `secrets.AWS_REGION` (the real AWS region) stays set for every later step in that job. The AWS CLI v2 region resolution order is `--region` > `AWS_REGION` > `AWS_DEFAULT_REGION`. The R2 step only set `AWS_DEFAULT_REGION: auto`, so the leaked `AWS_REGION` won and R2 rejected it, since R2 only accepts `wnam`, `enam`, `weur`, `eeur`, `apac`, `oc` or `auto`. The failure log shows both `AWS_DEFAULT_REGION: auto` and `AWS_REGION: ***` in the step env, which confirms the leak. ### Fix Set `AWS_REGION: auto` explicitly in the R2 upload step env of all three release workflows. Step-level `env:` is applied after `GITHUB_ENV`-derived variables, so this reliably overrides the leaked value. No other variable leaks from `configure-aws-credentials` matter here: `AWS_SESSION_TOKEN` is only exported when a session token exists, and these workflows use static access keys without `role-to-assume`; `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are already overridden in the R2 step. Consolidating the three duplicated upload steps into a composite action remains a follow-up, as noted in #38635. ## Acceptance criteria - [x] `AWS_REGION: auto` set in the R2 upload step of `release-nightly.yml`, `release-tag-rc.yml` and `release-tag-version.yml` - [x] No other behaviour changed; the existing S3 upload steps are untouched - [x] All three workflows still pass `actionlint` and YAML parsing - [ ] The next nightly release run syncs to R2 without `InvalidRegionName` ## Blocked by - None -- can start immediately. --- Generated by Codet Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>