feat(ci): Replace S3 upload with a rolling nightly pre-release

.github/workflows/ci_main.yml

@@ -1,13 +1,8 @@
-name: Build & Upload
+name: Build and push binaries for rolling release
 
 on:
   push:
     branches: ["main"]
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
 
 permissions:
   contents: read
@@ -19,18 +14,26 @@ permissions:
 jobs:
   build:
     name: Build
+    # A newer push supersedes an in-flight build of the same ref.
+    concurrency:
+      group: ${{ github.workflow }}-build-${{ github.ref }}
+      cancel-in-progress: true
     uses: ./.github/workflows/build.yml
     with:
       ref: ${{ github.sha }}
       go_version: "1.26.4"
 
-  upload:
-    name: Upload
+  release:
+    name: Rolling release
     needs: build
-    uses: ./.github/workflows/upload_s3.yml
+    # Publishing is not atomic (tag move + asset delete/re-upload), so never
+    # cancel a publish in progress; queue the next one behind it instead.
+    concurrency:
+      group: ${{ github.workflow }}-release
+      cancel-in-progress: false
+    permissions:
+      contents: write
+    uses: ./.github/workflows/rolling_release.yml
     with:
       ref: ${{ github.sha }}
-    secrets:
-      AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-
+      tag: nightly

.github/workflows/rolling_release.yml

@@ -0,0 +1,84 @@
+name: Rolling release
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: 'Commit SHA the binaries were built from'
+        required: true
+        type: string
+      tag:
+        description: 'Rolling release tag to (re)point at the commit'
+        required: true
+        type: string
+
+jobs:
+  publish:
+    name: Publish ${{ inputs.tag }} pre-release
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: write
+
+    steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      with:
+        egress-policy: audit
+
+    # A re-run of an old run keeps its original github.sha, and a slow build can
+    # finish after a newer push has already published. Either would rewind the
+    # rolling release, so only the current tip of the branch may publish.
+    - name: Check that ${{ inputs.ref }} is still the tip of ${{ github.ref_name }}
+      id: tip
+      env:
+        GH_TOKEN: ${{ github.token }}
+        REPO: ${{ github.repository }}
+        BRANCH: ${{ github.ref_name }}
+        SHA: ${{ inputs.ref }}
+      run: |
+        tip=$(gh api "repos/${REPO}/git/ref/heads/${BRANCH}" --jq .object.sha)
+        if [ "${tip}" = "${SHA}" ]; then
+          echo "current=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "::notice::${BRANCH} has moved on to ${tip}; not publishing ${SHA}. The run for ${tip} publishes it."
+          echo "current=false" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Download build artifacts
+      if: steps.tip.outputs.current == 'true'
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        pattern: '*_static_*-${{ github.run_id }}'
+        path: dist
+        merge-multiple: true
+
+    - name: Publish pre-release
+      if: steps.tip.outputs.current == 'true'
+      uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+      with:
+        tag_name: ${{ inputs.tag }}
+        target_commitish: ${{ inputs.ref }}
+        name: ${{ inputs.tag }} (${{ github.ref_name }} @ ${{ inputs.ref }})
+        body: |
+          Rolling build of `${{ github.ref_name }}` at commit ${{ inputs.ref }}.
+
+        prerelease: true
+        make_latest: false
+        draft: false
+        generate_release_notes: false
+        overwrite_files: true
+        preserve_order: true
+        fail_on_unmatched_files: true
+        files: |
+          dist/*_static_*
+
+    - name: Move ${{ inputs.tag }} tag to ${{ inputs.ref }}
+      if: steps.tip.outputs.current == 'true'
+      env:
+        GH_TOKEN: ${{ github.token }}
+        REPO: ${{ github.repository }}
+        TAG: ${{ inputs.tag }}
+        SHA: ${{ inputs.ref }}
+      run: |
+        gh api --method PATCH "repos/${REPO}/git/refs/tags/${TAG}" \
+          -f sha="${SHA}" -F force=true

docs/installation.md

@@ -527,12 +527,14 @@ sudo mv $CONTAINERD_BINARY_FILENAME /usr/local/bin/containerd-shim-urunc-v2
 
 #### Option 3: Install from latest artifacts (tip of the main branch)
 
-Alternatively, to get a `urunc` binary based on the main branch:
+Alternatively, to get a `urunc` binary based on the main branch, use the
+rolling [`nightly`](https://github.com/urunc-dev/urunc/releases/tag/nightly)
+pre-release.
 
 ```bash
-URUNC_VERSION=main
+URUNC_VERSION=nightly
 URUNC_BINARY_FILENAME="urunc_static_$(dpkg --print-architecture)"
-wget -q https://s3.nbfc.io/nbfc-assets/github/urunc/dist/$URUNC_VERSION/$(dpkg --print-architecture)/$URUNC_BINARY_FILENAME
+wget -q https://github.com/urunc-dev/urunc/releases/download/$URUNC_VERSION/$URUNC_BINARY_FILENAME
 chmod +x $URUNC_BINARY_FILENAME
 sudo mv $URUNC_BINARY_FILENAME /usr/local/bin/urunc
 ```
@@ -541,7 +543,7 @@ And for `containerd-shim-urunc-v2`:
 
 ```bash
 CONTAINERD_BINARY_FILENAME="containerd-shim-urunc-v2_static_$(dpkg --print-architecture)"
-wget -q https://s3.nbfc.io/nbfc-assets/github/urunc/dist/$URUNC_VERSION/$(dpkg --print-architecture)/$CONTAINERD_BINARY_FILENAME
+wget -q https://github.com/urunc-dev/urunc/releases/download/$URUNC_VERSION/$CONTAINERD_BINARY_FILENAME
 chmod +x $CONTAINERD_BINARY_FILENAME
 sudo mv $CONTAINERD_BINARY_FILENAME /usr/local/bin/containerd-shim-urunc-v2
 ```