feat(ci): Replace S3 upload with a rolling nightly pre-release

.github/workflows/ci_main.yml

@@ -24,13 +24,13 @@ jobs:
       ref: ${{ github.sha }}
       go_version: "1.26.4"
 
-  upload:
-    name: Upload
+  release:
+    name: Rolling release
     needs: build
-    uses: ./.github/workflows/upload_s3.yml
+    permissions:
+      contents: write
+    uses: ./.github/workflows/rolling_release.yml
     with:
       ref: ${{ github.sha }}
-    secrets:
-      AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      tag: nightly
 

.github/workflows/rolling_release.yml

@@ -0,0 +1,85 @@
+name: Rolling release
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: 'Commit SHA the binaries were built from'
+        required: true
+        type: string
+      tag:
+        description: 'Rolling release tag to (re)point at the commit'
+        required: false
+        type: string
+        default: 'nightly'
+
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Commit SHA the binaries were built from'
+        required: true
+        type: string
+      tag:
+        description: 'Rolling release tag to (re)point at the commit'
+        required: false
+        type: string
+        default: 'nightly'
+
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    name: Publish ${{ inputs.tag }} pre-release
+    runs-on: ubuntu-22.04
+
+    steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      with:
+        egress-policy: audit
+
+    - name: Download build artifacts
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        pattern: '*_static_*-${{ github.run_id }}'
+        path: dist
+        merge-multiple: true
+
+    - name: Move ${{ inputs.tag }} tag to ${{ inputs.ref }}
+      env:
+        GH_TOKEN: ${{ github.token }}
+        REPO: ${{ github.repository }}
+        TAG: ${{ inputs.tag }}
+        SHA: ${{ inputs.ref }}
+      run: |
+        if gh api "repos/${REPO}/git/ref/tags/${TAG}" >/dev/null 2>&1; then
+          echo "Updating existing tag ${TAG} -> ${SHA}"
+          gh api --method PATCH "repos/${REPO}/git/refs/tags/${TAG}" \
+            -f sha="${SHA}" -F force=true
+        else
+          echo "Creating tag ${TAG} -> ${SHA}"
+          gh api --method POST "repos/${REPO}/git/refs" \
+            -f ref="refs/tags/${TAG}" -f sha="${SHA}"
+        fi
+
+    - name: Publish pre-release
+      uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+      with:
+        tag_name: ${{ inputs.tag }}
+        target_commitish: ${{ inputs.ref }}
+        name: ${{ inputs.tag }} (${{ github.ref_name }} @ ${{ inputs.ref }})
+        body: |
+          Rolling build of `${{ github.ref_name }}` at commit ${{ inputs.ref }}.
+
+        prerelease: true
+        make_latest: false
+        draft: false
+        generate_release_notes: false
+        overwrite_files: true
+        fail_on_unmatched_files: true
+        files: |
+          dist/urunc_static_amd64
+          dist/urunc_static_arm64
+          dist/containerd-shim-urunc-v2_static_amd64
+          dist/containerd-shim-urunc-v2_static_arm64

docs/installation.md

@@ -527,12 +527,14 @@ sudo mv $CONTAINERD_BINARY_FILENAME /usr/local/bin/containerd-shim-urunc-v2
 
 #### Option 3: Install from latest artifacts (tip of the main branch)
 
-Alternatively, to get a `urunc` binary based on the main branch:
+Alternatively, to get a `urunc` binary based on the main branch, use the
+rolling [`nightly`](https://github.com/urunc-dev/urunc/releases/tag/nightly)
+pre-release.
 
 ```bash
-URUNC_VERSION=main
+URUNC_VERSION=nightly
 URUNC_BINARY_FILENAME="urunc_static_$(dpkg --print-architecture)"
-wget -q https://s3.nbfc.io/nbfc-assets/github/urunc/dist/$URUNC_VERSION/$(dpkg --print-architecture)/$URUNC_BINARY_FILENAME
+wget -q https://github.com/urunc-dev/urunc/releases/download/$URUNC_VERSION/$URUNC_BINARY_FILENAME
 chmod +x $URUNC_BINARY_FILENAME
 sudo mv $URUNC_BINARY_FILENAME /usr/local/bin/urunc
 ```
@@ -541,7 +543,7 @@ And for `containerd-shim-urunc-v2`:
 
 ```bash
 CONTAINERD_BINARY_FILENAME="containerd-shim-urunc-v2_static_$(dpkg --print-architecture)"
-wget -q https://s3.nbfc.io/nbfc-assets/github/urunc/dist/$URUNC_VERSION/$(dpkg --print-architecture)/$CONTAINERD_BINARY_FILENAME
+wget -q https://github.com/urunc-dev/urunc/releases/download/$URUNC_VERSION/$CONTAINERD_BINARY_FILENAME
 chmod +x $CONTAINERD_BINARY_FILENAME
 sudo mv $CONTAINERD_BINARY_FILENAME /usr/local/bin/containerd-shim-urunc-v2
 ```