Add public read ACL option to publish.sh and prod releases

.github/workflows/release_publish.yml

@@ -118,14 +118,20 @@ jobs:
           if [ "${{ inputs.release_type }}" = "public" ] || [ "${{ inputs.make_latest }}" = "true" ]; then
             MAKE_LATEST="--make-latest"
           fi
+          # Public releases are served world-readable from the prod bucket;
+          # staging keeps the old (private) behavior.
+          PUBLIC_READ=""
+          if [ "${{ inputs.release_type }}" = "public" ]; then
+            PUBLIC_READ="--public-read"
+          fi
           echo "Publishing release_type=${{ inputs.release_type }} bucket=$BUCKET base=$BASE_URL prefix=$PREFIX"
           ./publish.sh \
             --version "${{ steps.v.outputs.release_tag }}" \
             --bucket "$BUCKET" \
             --base-url "$BASE_URL" \
             --prefix "$PREFIX" \
             --dist dist \
-            $MAKE_LATEST
+            $MAKE_LATEST $PUBLIC_READ
 
       # Record the publish outcome for the release orchestrator to read.
       - name: Write release_info

publish.sh

@@ -18,6 +18,10 @@
 # Usage:
 #   publish.sh --version V --bucket BUCKET --base-url URL
 #              [--prefix PREFIX] [--dist DIR] [--profile NAME] [--make-latest]
+#              [--public-read]
+#
+# For public releases, pass --public-read so uploaded objects are
+# world-readable (e.g. served straight from the bucket over HTTP).
 #
 # Requires the AWS CLI, configured with credentials that can write to BUCKET
 # (use --profile NAME to select a named profile, e.g. --profile stage).
@@ -27,7 +31,7 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 VERSION=""; BUCKET=""; BASE_URL=""; PREFIX="redis-cli"
-DIST="$SCRIPT_DIR/dist"; MAKE_LATEST=0; PROFILE=""
+DIST="$SCRIPT_DIR/dist"; MAKE_LATEST=0; PROFILE=""; PUBLIC_READ=0
 
 while [ $# -gt 0 ]; do
     case "$1" in
@@ -38,7 +42,8 @@ while [ $# -gt 0 ]; do
         --dist) DIST="$2"; shift 2 ;;
         --profile) PROFILE="$2"; shift 2 ;;
         --make-latest) MAKE_LATEST=1; shift ;;
-        -h|--help) sed -n '12,23p' "$0"; exit 0 ;;
+        --public-read) PUBLIC_READ=1; shift ;;
+        -h|--help) sed -n '12,27p' "$0"; exit 0 ;;
         *) echo "unknown argument: $1" >&2; exit 1 ;;
     esac
 done
@@ -53,28 +58,33 @@ command -v aws >/dev/null 2>&1 || { echo "aws CLI not found" >&2; exit 1; }
 
 S3="s3://${BUCKET}/${PREFIX}"
 
+# Appended (unquoted) to every upload; empty by default. --public-read makes
+# objects world-readable for public releases.
+ACL=""
+[ "$PUBLIC_READ" = "1" ] && ACL="--acl public-read"
+
 echo ">> Uploading artifacts for $VERSION to ${S3}/${VERSION}/"
 shopt -s nullglob
 artifacts=("$DIST"/redis-cli-"$VERSION"-*)
 [ ${#artifacts[@]} -gt 0 ] || { echo "no artifacts for $VERSION found in $DIST" >&2; exit 1; }
 for f in "${artifacts[@]}"; do
     echo "   $(basename "$f")"
-    aws s3 cp "$f" "${S3}/${VERSION}/$(basename "$f")"
+    aws s3 cp "$f" "${S3}/${VERSION}/$(basename "$f")" $ACL
 done
 
 echo ">> Publishing install.sh with base URL ${BASE_URL}/${PREFIX}"
 TMP_INSTALL="$(mktemp "${TMPDIR:-/tmp}/install.XXXXXX.sh")"
 sed "s|https://DOWNLOAD_BASE_URL_PLACEHOLDER|${BASE_URL}/${PREFIX}|g" \
     "$SCRIPT_DIR/install.sh" > "$TMP_INSTALL"
-aws s3 cp "$TMP_INSTALL" "${S3}/install.sh" --content-type "text/x-shellscript"
+aws s3 cp "$TMP_INSTALL" "${S3}/install.sh" --content-type "text/x-shellscript" $ACL
 rm -f "$TMP_INSTALL"
 
 if [ "$MAKE_LATEST" = "1" ]; then
     # download.redis.io calls the stable-release alias "stable"; docker uses
     # "latest". Publish both, pointing at this version, so either idiom works.
     for alias in stable latest; do
         echo ">> Updating $alias -> $VERSION"
-        printf '%s\n' "$VERSION" | aws s3 cp - "${S3}/${alias}" --content-type "text/plain"
+        printf '%s\n' "$VERSION" | aws s3 cp - "${S3}/${alias}" --content-type "text/plain" $ACL
     done
 fi