mirror of
https://github.com/go-gitea/gitea.git
synced 2026-07-27 16:55:17 +02:00
559aa89ca7
The `configure-aws-credentials` step earlier in the same job exports **both** `AWS_DEFAULT_REGION` and `AWS_REGION` into `$GITHUB_ENV` (verified in `exportRegion()` at the pinned SHA `517a711`), so `secrets.AWS_REGION` (the real AWS region) stays set for every later step in that job. The AWS CLI v2 region resolution order is `--region` > `AWS_REGION` > `AWS_DEFAULT_REGION`. The R2 step only set `AWS_DEFAULT_REGION: auto`, so the leaked `AWS_REGION` won and R2 rejected it, since R2 only accepts `wnam`, `enam`, `weur`, `eeur`, `apac`, `oc` or `auto`. The failure log shows both `AWS_DEFAULT_REGION: auto` and `AWS_REGION: ***` in the step env, which confirms the leak. ### Fix Set `AWS_REGION: auto` explicitly in the R2 upload step env of all three release workflows. Step-level `env:` is applied after `GITHUB_ENV`-derived variables, so this reliably overrides the leaked value. No other variable leaks from `configure-aws-credentials` matter here: `AWS_SESSION_TOKEN` is only exported when a session token exists, and these workflows use static access keys without `role-to-assume`; `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are already overridden in the R2 step. Consolidating the three duplicated upload steps into a composite action remains a follow-up, as noted in #38635.