STAC-25590 Publish pre-release DEBs to the tooling bucket

[LouisParkin]

The DEB publish lane assumes its OIDC role and signs the package, then gets denied s3:PutObject. stackstate-agent-3-test lives in the master account while the role lives in tooling, so the write crosses an account boundary and would need a bucket policy the bucket does not have.

StackVista/terraform-infra#89 creates a tooling-owned replacement, sts-agent-prerelease, instead of granting cross-account access to a bucket whose existing policy is what serves the public apt repository. S3 names are global, so it could not keep the old name. It was applied on 17 Aug, so the bucket now exists.

STS_AWS_TEST_BUCKET_YUM and STS_AWS_TEST_BUCKET_WIN deliberately still point at the master buckets — nothing in this lane publishes to them, and that is where their content is. install.sh therefore renders a deb URL in tooling and yum/Windows URLs in master until those buckets move too.

The README's per-branch install instructions are corrected to describe what the lane actually publishes. That contract broke at the GitLab-to-Actions port, not here: the publish job is gated on pushes to the release branch and publish_package.sh derives the apt codename from the ref, so master and STAC-xxxx codenames stopped being produced. dists/master/Release in the old bucket is unchanged since September 2024 — stale content that made the docs look correct.

Validation

• zizmor clean on the changed workflow
• YAML parses
• The publish itself can only be verified by a push to the release branch, since the job is push-gated

STAC-25590

[LouisParkin]

Unblocked: terraform-infra #89 applied at 11:36 UTC — sts-agent-prerelease now exists in tooling/eu-west-1, and the master-account role from #88 is destroyed.

Two things verified before marking this ready:

• Region. deb-s3 reads AWS_DEFAULT_REGION only (falling back to us-east-1), never AWS_REGION. The old bucket was us-east-1, so this was never exercised. configure-aws-credentials exports AWS_DEFAULT_REGION whenever aws-profile is unset, which it is here, so the eu-west-1 bucket resolves correctly.
• Anonymous ListBucket is now denied on the new bucket (403); the old one returns 200 and exposes every historical branch name.

Note for whoever validates the README URL: the bucket is ~2h old, so sts-agent-prerelease.s3.amazonaws.com still 307-redirects to the regional endpoint until S3 DNS propagates (up to 24h). curl -o- has no -L, so test the install one-liner after propagation, not before. Publishing itself is unaffected — the SDK is region-aware.

[LouisLotter]

Requesting changes for two issues:

• GitHub reports the head commit as unsigned. Repository policy requires every commit to be cryptographically signed; please amend and sign it. While amending, correct the dependency reference: terraform-infra #89 created and applied the tooling bucket, not #88.
• See the inline comment for the branch-install documentation gap.

[LouisLotter]

This new URL does not preserve the branch-install contract described below. build-deb.yml only publishes pushes to stackstate-7.78.2, and publish_package.sh uses that ref as the APT codename, so the new bucket will never receive the documented master or STAC-xxxx codenames. The old dists/master/Release is live, while the new one is 404. Either migrate/continue publishing the supported codenames, retain the old endpoint for historical builds, or document that only the release branch is supported.

[LouisParkin]

Good catch, and it goes back further than this PR. dists/master/Release in the old bucket has Last-Modified: Mon, 23 Sep 2024 — the per-branch contract broke when publishing moved to Actions and became push-gated on the release branch, with publish_package.sh taking the codename from the ref. The old bucket kept serving two-year-old artifacts for those codenames, which is why the docs still looked correct.

Taken your third option: the README now documents release-branch-only and points at stackstate-agent-3-test for the historical codenames, which keeps working since this PR does not delete that bucket. Migrating the codenames would mean copying those stale builds into the new bucket, and the new bucket deliberately denies anonymous ListBucket — the old one returns 200 and enumerates every historical branch name.

Also added -fL to the curl one-liner so the regional 307 is followed rather than piped into bash.

[LouisParkin]

All three points addressed in 511b6358d9 (force-push, was b5adfdb08):

• Commit is signed; GitHub now reports verified=true.
• terraform-infra#88 corrected to #89 in the commit message and in the one place the PR body still had it. Netcat flickering #89 is what created and applied the bucket; STAC-4766 aws-eks kubernetes services #88's master-account role was destroyed.
• README documents what the lane actually publishes — see the reply on the inline comment for why the per-branch contract was already broken before this change.