From 1cb0cb1afdaaf006529beea5301362696530cd5f Mon Sep 17 00:00:00 2001
From: Maximilian Hils <git@maximilianhils.com>
Date: Sun, 2 Jul 2023 21:42:15 +0200
Subject: [PATCH] release ci: upload binaries to r2

---
 .github/workflows/main.yml |  3 +++
 release/deploy.py          | 32 ++++++++++++++++++++++++++++----
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index fb6b351d8..919673afb 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -231,6 +231,9 @@ jobs:
       MSFT_TENANT_ID: ${{ secrets.MSFT_TENANT_ID }}
       MSFT_CLIENT_ID: ${{ secrets.MSFT_CLIENT_ID }}
       MSFT_CLIENT_SECRET: ${{ secrets.MSFT_CLIENT_SECRET }}
+      R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
+      R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+      R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
     steps:
       - uses: actions/checkout@v3
         with:
diff --git a/release/deploy.py b/release/deploy.py
index cd7d41bf4..9e652a148 100755
--- a/release/deploy.py
+++ b/release/deploy.py
@@ -23,6 +23,7 @@ if __name__ == "__main__":
         upload_dir = tag
     else:
         upload_dir = f"branches/{branch}"
+    # Ideally we could have R2 pull from S3 automatically, but that's not possible yet. So we upload to both.
     print(f"Uploading binaries to snapshots.mitmproxy.org/{upload_dir}...")
     subprocess.check_call(
         [
@@ -30,14 +31,37 @@ if __name__ == "__main__":
             "s3",
             "sync",
             "--delete",
-            "--acl",
-            "public-read",
-            "--exclude",
-            "*.msix",
+            *("--acl", "public-read"),
+            *("--exclude", "*.msix"),
             root / "release/dist",
             f"s3://snapshots.mitmproxy.org/{upload_dir}",
         ]
     )
+    if tag:
+        # We can't scope R2 tokens, so they are only exposed in the deploy env.
+        print(f"Uploading binaries to downloads.mitmproxy.org/{upload_dir}...")
+        subprocess.check_call(
+            [
+                "aws",
+                "s3",
+                "sync",
+                "--delete",
+                *("--acl", "public-read"),
+                *("--exclude", "*.msix"),
+                *(
+                    "--endpoint-url",
+                    f"https://{os.environ['R2_ACCOUNT_ID']}.r2.cloudflarestorage.com",
+                ),
+                root / "release/dist",
+                f"s3://downloads/{upload_dir}",
+            ],
+            env={
+                **os.environ,
+                "AWS_REGION": "auto",
+                "AWS_ACCESS_KEY_ID": os.environ["R2_ACCESS_KEY_ID"],
+                "AWS_SECRET_ACCESS_KEY": os.environ["R2_SECRET_ACCESS_KEY"],
+            },
+        )
 
     # Upload releases to PyPI
     if tag: