From ca6468744cc6e5c215e5154084789a33ff6c3fb2 Mon Sep 17 00:00:00 2001
From: Angel Yanev <angel.yanev@redis.com>
Date: Mon, 27 Jul 2026 12:33:04 +0300
Subject: [PATCH] Add --acl option to publish.sh and use public-read for prod
 releases

Public releases must serve world-readable objects from the prod bucket,
so pass --acl public-read for release_type=public. Staging (internal)
keeps the old private behavior. The ACL applies to every uploaded
object: versioned binaries and .sha256 files, install.sh, and the
stable/latest pointers.
---
 .github/workflows/release_publish.yml |  8 +++++++-
 publish.sh                            | 20 +++++++++++++++-----
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release_publish.yml b/.github/workflows/release_publish.yml
index aa168c9..7ca8379 100644
--- a/.github/workflows/release_publish.yml
+++ b/.github/workflows/release_publish.yml
@@ -118,6 +118,12 @@ jobs:
           if [ "${{ inputs.release_type }}" = "public" ] || [ "${{ inputs.make_latest }}" = "true" ]; then
             MAKE_LATEST="--make-latest"
           fi
+          # Public releases are served world-readable from the prod bucket;
+          # staging keeps the old (private) behavior.
+          PUBLIC_READ=""
+          if [ "${{ inputs.release_type }}" = "public" ]; then
+            PUBLIC_READ="--public-read"
+          fi
           echo "Publishing release_type=${{ inputs.release_type }} bucket=$BUCKET base=$BASE_URL prefix=$PREFIX"
           ./publish.sh \
             --version "${{ steps.v.outputs.release_tag }}" \
@@ -125,7 +131,7 @@ jobs:
             --base-url "$BASE_URL" \
             --prefix "$PREFIX" \
             --dist dist \
-            $MAKE_LATEST
+            $MAKE_LATEST $PUBLIC_READ
 
       # Record the publish outcome for the release orchestrator to read.
       - name: Write release_info
diff --git a/publish.sh b/publish.sh
index 5cbfb5e..754213d 100755
--- a/publish.sh
+++ b/publish.sh
@@ -18,6 +18,10 @@
 # Usage:
 #   publish.sh --version V --bucket BUCKET --base-url URL
 #              [--prefix PREFIX] [--dist DIR] [--profile NAME] [--make-latest]
+#              [--public-read]
+#
+# For public releases, pass --public-read so uploaded objects are
+# world-readable (e.g. served straight from the bucket over HTTP).
 #
 # Requires the AWS CLI, configured with credentials that can write to BUCKET
 # (use --profile NAME to select a named profile, e.g. --profile stage).
@@ -27,7 +31,7 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 VERSION=""; BUCKET=""; BASE_URL=""; PREFIX="redis-cli"
-DIST="$SCRIPT_DIR/dist"; MAKE_LATEST=0; PROFILE=""
+DIST="$SCRIPT_DIR/dist"; MAKE_LATEST=0; PROFILE=""; PUBLIC_READ=0
 
 while [ $# -gt 0 ]; do
     case "$1" in
@@ -38,7 +42,8 @@ while [ $# -gt 0 ]; do
         --dist) DIST="$2"; shift 2 ;;
         --profile) PROFILE="$2"; shift 2 ;;
         --make-latest) MAKE_LATEST=1; shift ;;
-        -h|--help) sed -n '12,23p' "$0"; exit 0 ;;
+        --public-read) PUBLIC_READ=1; shift ;;
+        -h|--help) sed -n '12,27p' "$0"; exit 0 ;;
         *) echo "unknown argument: $1" >&2; exit 1 ;;
     esac
 done
@@ -53,20 +58,25 @@ command -v aws >/dev/null 2>&1 || { echo "aws CLI not found" >&2; exit 1; }
 
 S3="s3://${BUCKET}/${PREFIX}"
 
+# Appended (unquoted) to every upload; empty by default. --public-read makes
+# objects world-readable for public releases.
+ACL=""
+[ "$PUBLIC_READ" = "1" ] && ACL="--acl public-read"
+
 echo ">> Uploading artifacts for $VERSION to ${S3}/${VERSION}/"
 shopt -s nullglob
 artifacts=("$DIST"/redis-cli-"$VERSION"-*)
 [ ${#artifacts[@]} -gt 0 ] || { echo "no artifacts for $VERSION found in $DIST" >&2; exit 1; }
 for f in "${artifacts[@]}"; do
     echo "   $(basename "$f")"
-    aws s3 cp "$f" "${S3}/${VERSION}/$(basename "$f")"
+    aws s3 cp "$f" "${S3}/${VERSION}/$(basename "$f")" $ACL
 done
 
 echo ">> Publishing install.sh with base URL ${BASE_URL}/${PREFIX}"
 TMP_INSTALL="$(mktemp "${TMPDIR:-/tmp}/install.XXXXXX.sh")"
 sed "s|https://DOWNLOAD_BASE_URL_PLACEHOLDER|${BASE_URL}/${PREFIX}|g" \
     "$SCRIPT_DIR/install.sh" > "$TMP_INSTALL"
-aws s3 cp "$TMP_INSTALL" "${S3}/install.sh" --content-type "text/x-shellscript"
+aws s3 cp "$TMP_INSTALL" "${S3}/install.sh" --content-type "text/x-shellscript" $ACL
 rm -f "$TMP_INSTALL"
 
 if [ "$MAKE_LATEST" = "1" ]; then
@@ -74,7 +84,7 @@ if [ "$MAKE_LATEST" = "1" ]; then
     # "latest". Publish both, pointing at this version, so either idiom works.
     for alias in stable latest; do
         echo ">> Updating $alias -> $VERSION"
-        printf '%s\n' "$VERSION" | aws s3 cp - "${S3}/${alias}" --content-type "text/plain"
+        printf '%s\n' "$VERSION" | aws s3 cp - "${S3}/${alias}" --content-type "text/plain" $ACL
     done
 fi