fix(zelnet): move the macOS SDK to the pkg bucket, out of ilm expiry range #2038

Merged

pipeline-bot merged 1 commit from fix/sdk-durable-home into trunk

2026-08-13 16:18:53 +00:00

sean commented

2026-08-13 16:15:00 +00:00

Owner

The workflows bucket carries a blanket 3-day ilm expiry with no prefix (the MinIO-exhaustion fix), and MinIO lifecycle cannot express "everything except sdk/" — so it silently deleted workflows/sdk/macos-sdk.tgz and every zelnet release died at compile-macos/fetch-sdk. pkg has no lifecycle rules and already holds the durable published packages.

Two coupled edits, deployed together: the build-key policy's SDK read grant moves workflows/sdk/* → pkg/sdk/*, and zelnet's sdkObject follows. The object is already at pkg/sdk/macos-sdk.tgz (re-uploaded from the Mac via the recovered recipe); the stale workflows copy is left for the expiry rule to collect.

⚠ Same-bucket finding, flagged not fixed here: release evidence durableURIs (s3://workflows/pipelines/evidence/…) live under that same 3-day expiry — only the last ~3 releases' durable copies still exist. The codeberg package copies survive, but the durableURI is broken-by-configuration and deserves its own decision (move evidence to pkg, or prefix the expiry rules).

The seanfarm make zelnet-sdk-upload target is restored separately in that repo, pointing at pkg.

The workflows bucket carries a **blanket 3-day ilm expiry with no prefix** (the MinIO-exhaustion fix), and MinIO lifecycle cannot express "everything except sdk/" — so it silently deleted `workflows/sdk/macos-sdk.tgz` and every zelnet release died at `compile-macos`/fetch-sdk. `pkg` has no lifecycle rules and already holds the durable published packages. Two coupled edits, deployed together: the build-key policy's SDK read grant moves `workflows/sdk/*` → `pkg/sdk/*`, and zelnet's `sdkObject` follows. The object is already at `pkg/sdk/macos-sdk.tgz` (re-uploaded from the Mac via the recovered recipe); the stale workflows copy is left for the expiry rule to collect. ⚠ **Same-bucket finding, flagged not fixed here:** release evidence `durableURI`s (`s3://workflows/pipelines/evidence/…`) live under that same 3-day expiry — only the last ~3 releases' durable copies still exist. The codeberg package copies survive, but the durableURI is broken-by-configuration and deserves its own decision (move evidence to pkg, or prefix the expiry rules). The seanfarm `make zelnet-sdk-upload` target is restored separately in that repo, pointing at pkg.

sean added 1 commit

2026-08-13 16:15:00 +00:00

fix(zelnet): move the macOS SDK to the pkg bucket, out of ilm expiry range

pipeline/ci CI green @ 0d1dd8e88e17

Details

0d1dd8e88e

The workflows bucket carries a blanket 3-day expiry with no prefix — the
MinIO-exhaustion fix — and MinIO lifecycle rules cannot express "everything
except sdk/". So the rule silently deleted workflows/sdk/macos-sdk.tgz, and
every zelnet release died at compile-macos: fetch-sdk refuses to ship a
release without the .app/.pkg. The pkg bucket has no lifecycle rules and
already holds the durable published packages, so the SDK moves there.

Two coupled edits, deployed together: the build-key policy's SDK read grant
moves from workflows/sdk/* to pkg/sdk/*, and zelnet's sdkObject follows.
The object is already present at pkg/sdk/macos-sdk.tgz (uploaded from the
Mac via the recovered sdk-upload recipe); the stale workflows copy is left
for the expiry rule to collect.

The seanfarm `make zelnet-sdk-upload` target that maintains the object is
restored separately in that repo, pointing at the pkg bucket.