ci: publish S3 via geniex repo to satisfy OIDC trust#1102
Merged
Conversation
Copilot started reviewing on behalf of
RemiliaForever (RemiliaForever)
June 26, 2026 04:15
View session
The bitsyfactory IAM role's OIDC trust only allows repo:qcom-ai-hub/geniex, so after the qualcomm/nexa-sdk migration the publish-s3 job can no longer assume it. Replace the inline S3 upload with a dispatch to geniex's chore/publish-s3 workflow (PAT with actions:rw on geniex), passing this run's id; geniex pulls our release-assets artifact cross-repo and uploads to S3 under its own trusted identity. We then watch the geniex run with --exit-status so an S3 failure still fails this job. Remove the now-unused AWS actions (configure-multiple-aws-roles, configure-aws-profile) and release_s3_manifest.py — they moved to the geniex chore/publish-s3 branch. Requires a new GENIEX_PUBLISH_PAT secret. Signed-off-by: RemiliaForever <remilia@koumakan.cc>
RemiliaForever (RemiliaForever)
force-pushed
the
ci/publish-s3-via-geniex
branch
from
317bbba to
7574cdc
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Routes S3 publishing through the still-trusted qcom-ai-hub/geniex repository to satisfy the existing AWS OIDC trust policy after the geniex → nexa-sdk migration, while keeping nexa-sdk as the source of release artifacts.
Changes:
- Reworks
publish-s3to dispatch and then watch aqcom-ai-hub/geniexworkflow run (usingGH_PAT) instead of uploading to S3 directly. - Removes local AWS credential/config actions and the local S3 manifest generator script (now hosted in geniex on
chore/publish-s3). - Updates release documentation to point to the relocated manifest schema/script.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| notes/release.md | Updates the manifest/schema documentation to reflect cross-repo S3 publishing and link to geniex’s script. |
| .github/workflows/release.yml | Changes publish-s3 to dispatch and watch the geniex workflow instead of assuming AWS role and uploading directly. |
| .github/scripts/release_s3_manifest.py | Removes the local manifest generator (moved to geniex branch). |
| .github/actions/configure-multiple-aws-roles/action.yml | Removes the unused composite action previously used for AWS role configuration. |
| .github/actions/configure-aws-profile/index.js | Removes the unused AWS profile configurator implementation. |
| .github/actions/configure-aws-profile/cleanup.js | Removes the unused cleanup script tied to the AWS profile action. |
| .github/actions/configure-aws-profile/action.yml | Removes the unused AWS profile action definition. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+409
to
+416
| target="" | ||
| for _ in $(seq 1 12); do | ||
| target=$(gh run list --repo qcom-ai-hub/geniex --workflow release.yml \ | ||
| --branch chore/publish-s3 --json databaseId,displayTitle \ | ||
| --jq "[.[] | select(.displayTitle | contains(\"run ${RUN_ID}\"))][0].databaseId") | ||
| [ -n "${target}" ] && break | ||
| sleep 5 | ||
| done |
…x dispatch The submodule-recursive checkout in build/test/lint reused GH_PAT, which this branch repurposed for dispatching geniex's publish-s3. Move all checkout tokens to a dedicated CLONE_PAT so the two roles no longer collide; CLONE_PAT becomes droppable once the repos go public. Signed-off-by: RemiliaForever <remilia@koumakan.cc>
RemiliaForever (RemiliaForever)
merged commit f758439
into
main
94 of 108 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
After the
qcom-ai-hub/geniex→qualcomm/nexa-sdkmigration, thepublish-s3job can no longer push to S3: the
github-bitsyfactoryIAM role's OIDC trustonly allows
repo:qcom-ai-hub/geniex, notqualcomm/nexa-sdk. We are notallowed to touch the trust policy.
What
Instead of touching IAM, the still-trusted geniex repo publishes on our behalf:
publish-s3no longer uploads to S3 directly. It dispatchesgeniex's
chore/publish-s3workflow (viaGH_PAT,--ref chore/publish-s3),passing the tag and this run's
run_id, thengh run watch --exit-statuswatches the geniex run so an S3 failure still fails this job rather than
passing silently.
package-releaseis unchanged — itsrelease-assetsartifact is the cross-repo data source.
configure-multiple-aws-roles,configure-aws-profile) andrelease_s3_manifest.py— they live on thegeniex
chore/publish-s3branch now.The geniex side is a trimmed, single-job
release.ymlon a long-livedchore/publish-s3branch (never merged to geniex main); it downloads ourrelease-assetsartifact cross-repo and uploads tos3://qaihub-public-assets/qai-hub-geniex/under geniex's trusted identity.Verified
Smoke-tested the full cross-repo path end to end with a synthetic
release-assetsartifact + av0.0.0-rc.testprerelease dispatch:GH_PAT, actions:read on nexa-sdk)chore/publish-s3branch (trust is notref-pinned)
is_prerelease/
llama_sha/htp_signedpropagate correctly; latest pointers correctlyskipped for the prerelease
Requires
GH_PATsecret in both repos must be a token withactions:writeongeniex +
actions:readon nexa-sdk (already configured).Notes
release-assetsretention is 1 day; geniex must run shortly after dispatch(job ordering ensures this).
DenyDeleteS3— publish-s3 can only upload, neverdelete (matches the "published assets are immutable" constraint).