fix(release): support stable previews without publishing packages to R2

.github/workflows/ci-docs-only.yml

@@ -22,7 +22,7 @@ name: Continuous Integration (docs only)
 on:
   pull_request:
     types: [ opened, synchronize, reopened ]
-    branches: [ main ]
+    branches: [ main, release ]
     paths:
       - "**.md"
       - "docs/**"

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ name: Continuous Integration
 
 on:
   push:
-    branches: [ main ]
+    branches: [ main, release ]
     paths-ignore:
       - "**.md"
       - "docs/**"
@@ -36,7 +36,7 @@ on:
       - "flake.lock"
   pull_request:
     types: [ opened, synchronize, reopened, closed ]
-    branches: [ main ]
+    branches: [ main, release ]
     # Keep this list in sync with the `paths` list in ci-docs-only.yml, which
     # reports the required "Test and Lint" check for PRs skipped here.
     paths-ignore:
@@ -872,13 +872,14 @@ jobs:
     # Merge gate only (backlog#1149 ci-5): the never-automated user-visible
     # suites — KMS, object_lock, multipart_auth, quota, checksum, encryption,
     # security-boundary, ... — via the e2e-full nextest profile. Too heavy for
-    # every PR, so it is gated to main pushes, the merge queue, and manual
+    # every PR, so it is gated to main/release pushes, the merge queue, and manual
     # dispatch. protocols / the 7 cluster suites / replication / #[ignore] are
     # owned by other lanes (see .config/nextest.toml profile.e2e-full).
     if: >-
       github.event_name == 'workflow_dispatch' ||
       github.event_name == 'merge_group' ||
-      (github.event_name == 'push' && github.ref == 'refs/heads/main')
+      (github.event_name == 'push' &&
+        (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/release'))
     needs: [ build-rustfs-debug-binary ]
     runs-on: sm-standard-2
     timeout-minutes: 55

.github/workflows/package.yml

@@ -122,7 +122,7 @@ jobs:
           semver_core='(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)'
           prerelease_id='(alpha|beta|rc)\.(0|[1-9][0-9]*)'
           if [[ -n "$TAG" ]]; then
-            if [[ "$TAG" =~ ^${semver_core}-${prerelease_id}-preview\.(0|[1-9][0-9]*)$ ]]; then
+            if [[ "$TAG" =~ ^${semver_core}(-${prerelease_id})?-preview\.(0|[1-9][0-9]*)$ ]]; then
               BUILD_TYPE=preview
             elif [[ "$TAG" =~ ^${semver_core}-${prerelease_id}$ ]]; then
               BUILD_TYPE=prerelease
@@ -498,7 +498,7 @@ jobs:
           retention-days: 30
 
       - name: Upload packages to Cloudflare R2
-        if: env.R2_ACCESS_KEY_ID != ''
+        if: env.R2_ACCESS_KEY_ID != '' && needs.resolve.outputs.build_type != 'preview'
         env:
           R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}

crates/e2e_test/src/inline_fast_path_cluster_test.rs

@@ -2234,6 +2234,7 @@ async fn four_node_manual_transition_distributed_admission_conflict_reports_stat
     let bucket = format!("distributed-admission-{}", Uuid::new_v4().simple());
     let prefix = "transition/distributed-admission/";
     hot_client.create_bucket().bucket(&bucket).send().await?;
+    put_lifecycle_with_transition_retry(&hot_client, &bucket, &tier_name).await?;
     for index in 0u8..64 {
         let key = format!("{prefix}object-{index:02}.bin");
         hot_client
@@ -2244,7 +2245,6 @@ async fn four_node_manual_transition_distributed_admission_conflict_reports_stat
             .send()
             .await?;
     }
-    put_lifecycle_with_transition_retry(&hot_client, &bucket, &tier_name).await?;
 
     let (node0, node1) = tokio::join!(
         start_manual_transition_job_on_node(&hot, 0, &bucket, prefix, &tier_name, false, 64),

crates/ecstore/src/bucket/replication/replication_resyncer.rs

@@ -8220,7 +8220,7 @@ mod tests {
     }
     mod multipart_transport_tests {
         use super::super::super::replication_filemeta_boundary::ObjectPartInfo;
-        use super::super::super::replication_storage_boundary::ObjectIO as _;
+        use super::super::super::replication_storage_boundary::{ObjectIO as _, ReadPlan};
         use super::*;
         use bytes::Bytes;
         use http_body_util::{BodyExt, Full};
@@ -8229,6 +8229,7 @@ mod tests {
         #[derive(Debug)]
         struct Source {
             body: Bytes,
+            stored: Option<Bytes>,
             info: ObjectInfo,
             ranges: StdMutex<Vec<(i64, i64)>>,
             full_reads: std::sync::atomic::AtomicUsize,
@@ -8257,6 +8258,17 @@ mod tests {
                     self.info.version_id.map(|id| id.to_string()),
                     "every read retains the selected source version"
                 );
+                if let Some(stored) = &self.stored {
+                    if let Some(range) = &range {
+                        self.ranges.lock().expect("range journal lock").push((range.start, range.end));
+                    } else {
+                        self.full_reads.fetch_add(1, Ordering::Relaxed);
+                    }
+                    let plan = ReadPlan::build_for_request(range, &self.info, opts, &HeaderMap::new(), None).await?;
+                    let start = plan.storage_offset();
+                    let end = start + usize::try_from(plan.storage_length()).expect("nonnegative storage length");
+                    return plan.into_object_reader(Box::new(std::io::Cursor::new(stored.slice(start..end))), &self.info);
+                }
                 if range.is_none() {
                     self.full_reads.fetch_add(1, Ordering::Relaxed);
                     return Ok(GetObjectReader {
@@ -8415,6 +8427,7 @@ mod tests {
                     ..Default::default()
                 },
                 body: body.clone(),
+                stored: Some(Bytes::from(stored)),
                 ranges: StdMutex::new(Vec::new()),
                 full_reads: std::sync::atomic::AtomicUsize::new(0),
             });
@@ -8656,6 +8669,7 @@ mod tests {
                     ..Default::default()
                 },
                 body: body.clone(),
+                stored: None,
                 ranges: StdMutex::new(Vec::new()),
                 full_reads: std::sync::atomic::AtomicUsize::new(0),
             });

crates/ecstore/src/bucket/replication/replication_storage_boundary.rs

@@ -22,7 +22,7 @@ pub(crate) use crate::object_api::{
     GetObjectReader, ObjectInfo, ObjectOptions, PutObjReader, ReplicationStatusWritebackCondition, ReplicationStatusWritebackMode,
 };
 #[cfg(test)]
-pub(crate) use crate::object_api::{NamespaceLockFence, NamespaceLockSignalTestFence};
+pub(crate) use crate::object_api::{NamespaceLockFence, NamespaceLockSignalTestFence, ReadPlan};
 pub(crate) use crate::storage_api_contracts::list::{
     ListOperations, StorageListObjectVersionsInfo, StorageListObjectsV2Info, StorageObjectInfoOrErr, StorageWalkOptions,
 };

scripts/release/package_versions.sh

@@ -71,8 +71,8 @@ case "$build_type" in
     ;;
   preview)
     [[ -z "$dev_sequence" ]] || fail "preview must not have a development sequence"
-    [[ "$source_version" =~ ^${semver_core}-${prerelease_id}-preview\.(0|[1-9][0-9]*)$ ]] ||
-      fail "preview version must be strict prerelease-preview SemVer"
+    [[ "$source_version" =~ ^${semver_core}(-${prerelease_id})?-preview\.(0|[1-9][0-9]*)$ ]] ||
+      fail "preview version must be strict stable-preview or prerelease-preview SemVer"
 
     deb_version=${source_version/-/$tilde}
     rpm_version=${source_version//-/_}

scripts/security/check_preview_release_workflow.sh

@@ -4,6 +4,7 @@ set -euo pipefail
 build_workflow=".github/workflows/build.yml"
 docker_workflow=".github/workflows/docker.yml"
 helm_workflow=".github/workflows/helm-package.yml"
+package_workflow=".github/workflows/package.yml"
 release_script="scripts/release/create_or_update_release.sh"
 
 # shellcheck source=scripts/release/create_or_update_release.sh
@@ -133,6 +134,7 @@ for block in "$tag_branch_tail" "$post_strategy"; do
 done
 require_line "$build_workflow" "          if [[ \"\$BUILD_TYPE\" == \"release\" ]] || [[ \"\$BUILD_TYPE\" == \"prerelease\" ]]; then" "latest artifact guard"
 require_line "$build_workflow" "        if: env.R2_ACCESS_KEY_ID != '' && (needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease' || needs.build-check.outputs.build_type == 'development')" "R2 publication guard"
+require_line "$package_workflow" "        if: env.R2_ACCESS_KEY_ID != '' && needs.resolve.outputs.build_type != 'preview'" "preview packages must not publish to R2"
 release_guard="startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')"
 for job in create-release upload-release-assets publish-release; do
   require_job_if "$build_workflow" "$job" "    if: $release_guard"

scripts/test_package_versions.sh

@@ -85,6 +85,9 @@ run_success rc-amd64 \
 run_success preview-amd64 \
   $'deb_version=1.0.0~rc.5-preview.2\nrpm_version=1.0.0_rc.5_preview.2\nrpm_release=1\ndeb_file=rustfs_1.0.0~rc.5-preview.2_amd64.deb\nrpm_file=rustfs-1.0.0_rc.5_preview.2-1.x86_64.rpm' \
   preview 1.0.0-rc.5-preview.2 '' amd64 x86_64
+run_success stable-preview-arm64 \
+  $'deb_version=1.0.0~preview.1\nrpm_version=1.0.0_preview.1\nrpm_release=1\ndeb_file=rustfs_1.0.0~preview.1_arm64.deb\nrpm_file=rustfs-1.0.0_preview.1-1.aarch64.rpm' \
+  preview 1.0.0-preview.1 '' arm64 aarch64
 run_success development-amd64 \
   "deb_version=0~dev.7463.${sha}
 rpm_version=0
@@ -108,7 +111,9 @@ run_failure release-with-sequence release 1.2.3 1 amd64 x86_64
 run_failure release-prerelease-mismatch release 1.2.3-rc.1 '' amd64 x86_64
 run_failure prerelease-release-mismatch prerelease 1.2.3 '' amd64 x86_64
 run_failure preview-malformed preview 1.2.3-rc.1-preview '' amd64 x86_64
-run_failure preview-wrong-shape preview 1.2.3-preview.1 '' amd64 x86_64
+run_failure preview-wrong-shape preview 1.2.3-dev-preview.1 '' amd64 x86_64
+run_failure preview-leading-zero preview 1.2.3-preview.01 '' amd64 x86_64
+run_failure preview-extra-suffix preview 1.2.3-preview.1-extra '' amd64 x86_64
 run_failure short-semver release 1.2 '' amd64 x86_64
 run_failure leading-v release v1.2.3 '' amd64 x86_64
 run_failure leading-zero release 01.2.3 '' amd64 x86_64