fix(release): support stable previews without publishing packages to R2

.github/workflows/ci-docs-only.yml

@@ -22,7 +22,7 @@ name: Continuous Integration (docs only)
 on:
   pull_request:
     types: [ opened, synchronize, reopened ]
-    branches: [ main ]
+    branches: [ main, release ]
     paths:
       - "**.md"
       - "docs/**"

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ name: Continuous Integration
 
 on:
   push:
-    branches: [ main ]
+    branches: [ main, release ]
     paths-ignore:
       - "**.md"
       - "docs/**"
@@ -36,7 +36,7 @@ on:
       - "flake.lock"
   pull_request:
     types: [ opened, synchronize, reopened, closed ]
-    branches: [ main ]
+    branches: [ main, release ]
     # Keep this list in sync with the `paths` list in ci-docs-only.yml, which
     # reports the required "Test and Lint" check for PRs skipped here.
     paths-ignore:
@@ -872,13 +872,14 @@ jobs:
     # Merge gate only (backlog#1149 ci-5): the never-automated user-visible
     # suites — KMS, object_lock, multipart_auth, quota, checksum, encryption,
     # security-boundary, ... — via the e2e-full nextest profile. Too heavy for
-    # every PR, so it is gated to main pushes, the merge queue, and manual
+    # every PR, so it is gated to main/release pushes, the merge queue, and manual
     # dispatch. protocols / the 7 cluster suites / replication / #[ignore] are
     # owned by other lanes (see .config/nextest.toml profile.e2e-full).
     if: >-
       github.event_name == 'workflow_dispatch' ||
       github.event_name == 'merge_group' ||
-      (github.event_name == 'push' && github.ref == 'refs/heads/main')
+      (github.event_name == 'push' &&
+        (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/release'))
     needs: [ build-rustfs-debug-binary ]
     runs-on: sm-standard-2
     timeout-minutes: 55

.github/workflows/package.yml

@@ -122,7 +122,7 @@ jobs:
           semver_core='(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)'
           prerelease_id='(alpha|beta|rc)\.(0|[1-9][0-9]*)'
           if [[ -n "$TAG" ]]; then
-            if [[ "$TAG" =~ ^${semver_core}-${prerelease_id}-preview\.(0|[1-9][0-9]*)$ ]]; then
+            if [[ "$TAG" =~ ^${semver_core}(-${prerelease_id})?-preview\.(0|[1-9][0-9]*)$ ]]; then
               BUILD_TYPE=preview
             elif [[ "$TAG" =~ ^${semver_core}-${prerelease_id}$ ]]; then
               BUILD_TYPE=prerelease
@@ -498,7 +498,7 @@ jobs:
           retention-days: 30
 
       - name: Upload packages to Cloudflare R2
-        if: env.R2_ACCESS_KEY_ID != ''
+        if: env.R2_ACCESS_KEY_ID != '' && needs.resolve.outputs.build_type != 'preview'
         env:
           R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}

crates/ecstore/src/bucket/replication/replication_resyncer.rs

@@ -8220,7 +8220,7 @@ mod tests {
     }
     mod multipart_transport_tests {
         use super::super::super::replication_filemeta_boundary::ObjectPartInfo;
-        use super::super::super::replication_storage_boundary::ObjectIO as _;
+        use super::super::super::replication_storage_boundary::{ObjectIO as _, ReadPlan};
         use super::*;
         use bytes::Bytes;
         use http_body_util::{BodyExt, Full};
@@ -8264,8 +8264,7 @@ mod tests {
                     } else {
                         self.full_reads.fetch_add(1, Ordering::Relaxed);
                     }
-                    let plan =
+                    let plan = ReadPlan::build_for_request(range, &self.info, opts, &HeaderMap::new(), None).await?;
-                        crate::object_api::ReadPlan::build_for_request(range, &self.info, opts, &HeaderMap::new(), None).await?;
                     let start = plan.storage_offset();
                     let end = start + usize::try_from(plan.storage_length()).expect("nonnegative storage length");
                     return plan.into_object_reader(Box::new(std::io::Cursor::new(stored.slice(start..end))), &self.info);

crates/ecstore/src/bucket/replication/replication_storage_boundary.rs

@@ -22,7 +22,7 @@ pub(crate) use crate::object_api::{
     GetObjectReader, ObjectInfo, ObjectOptions, PutObjReader, ReplicationStatusWritebackCondition, ReplicationStatusWritebackMode,
 };
 #[cfg(test)]
-pub(crate) use crate::object_api::{NamespaceLockFence, NamespaceLockSignalTestFence};
+pub(crate) use crate::object_api::{NamespaceLockFence, NamespaceLockSignalTestFence, ReadPlan};
 pub(crate) use crate::storage_api_contracts::list::{
     ListOperations, StorageListObjectVersionsInfo, StorageListObjectsV2Info, StorageObjectInfoOrErr, StorageWalkOptions,
 };

scripts/release/package_versions.sh

@@ -71,8 +71,8 @@ case "$build_type" in
     ;;
   preview)
     [[ -z "$dev_sequence" ]] || fail "preview must not have a development sequence"
-    [[ "$source_version" =~ ^${semver_core}-${prerelease_id}-preview\.(0|[1-9][0-9]*)$ ]] ||
+    [[ "$source_version" =~ ^${semver_core}(-${prerelease_id})?-preview\.(0|[1-9][0-9]*)$ ]] ||
-      fail "preview version must be strict prerelease-preview SemVer"
+      fail "preview version must be strict stable-preview or prerelease-preview SemVer"
 
     deb_version=${source_version/-/$tilde}
     rpm_version=${source_version//-/_}

scripts/security/check_preview_release_workflow.sh

@@ -4,6 +4,7 @@ set -euo pipefail
 build_workflow=".github/workflows/build.yml"
 docker_workflow=".github/workflows/docker.yml"
 helm_workflow=".github/workflows/helm-package.yml"
+package_workflow=".github/workflows/package.yml"
 release_script="scripts/release/create_or_update_release.sh"
 
 # shellcheck source=scripts/release/create_or_update_release.sh
@@ -133,6 +134,7 @@ for block in "$tag_branch_tail" "$post_strategy"; do
 done
 require_line "$build_workflow" "          if [[ \"\$BUILD_TYPE\" == \"release\" ]] || [[ \"\$BUILD_TYPE\" == \"prerelease\" ]]; then" "latest artifact guard"
 require_line "$build_workflow" "        if: env.R2_ACCESS_KEY_ID != '' && (needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease' || needs.build-check.outputs.build_type == 'development')" "R2 publication guard"
+require_line "$package_workflow" "        if: env.R2_ACCESS_KEY_ID != '' && needs.resolve.outputs.build_type != 'preview'" "preview packages must not publish to R2"
 release_guard="startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')"
 for job in create-release upload-release-assets publish-release; do
   require_job_if "$build_workflow" "$job" "    if: $release_guard"

scripts/test_package_versions.sh

@@ -85,6 +85,9 @@ run_success rc-amd64 \
 run_success preview-amd64 \
   $'deb_version=1.0.0~rc.5-preview.2\nrpm_version=1.0.0_rc.5_preview.2\nrpm_release=1\ndeb_file=rustfs_1.0.0~rc.5-preview.2_amd64.deb\nrpm_file=rustfs-1.0.0_rc.5_preview.2-1.x86_64.rpm' \
   preview 1.0.0-rc.5-preview.2 '' amd64 x86_64
+run_success stable-preview-arm64 \
+  $'deb_version=1.0.0~preview.1\nrpm_version=1.0.0_preview.1\nrpm_release=1\ndeb_file=rustfs_1.0.0~preview.1_arm64.deb\nrpm_file=rustfs-1.0.0_preview.1-1.aarch64.rpm' \
+  preview 1.0.0-preview.1 '' arm64 aarch64
 run_success development-amd64 \
   "deb_version=0~dev.7463.${sha}
 rpm_version=0
@@ -108,7 +111,9 @@ run_failure release-with-sequence release 1.2.3 1 amd64 x86_64
 run_failure release-prerelease-mismatch release 1.2.3-rc.1 '' amd64 x86_64
 run_failure prerelease-release-mismatch prerelease 1.2.3 '' amd64 x86_64
 run_failure preview-malformed preview 1.2.3-rc.1-preview '' amd64 x86_64
-run_failure preview-wrong-shape preview 1.2.3-preview.1 '' amd64 x86_64
+run_failure preview-wrong-shape preview 1.2.3-dev-preview.1 '' amd64 x86_64
+run_failure preview-leading-zero preview 1.2.3-preview.01 '' amd64 x86_64
+run_failure preview-extra-suffix preview 1.2.3-preview.1-extra '' amd64 x86_64
 run_failure short-semver release 1.2 '' amd64 x86_64
 run_failure leading-v release v1.2.3 '' amd64 x86_64
 run_failure leading-zero release 01.2.3 '' amd64 x86_64