Skip to content

docs: clarify gcloud release upload permissions #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ibetitsmike merged 2 commits into from
Sep 16, 2026
Merged

docs: clarify gcloud release upload permissions #14

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
262ba17
ci: upload release objects without listing the bucket
ibetitsmike Sep 11, 2026
114c024
ci: restore gcloud release uploads
ibetitsmike Sep 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 11 additions & 4 deletions RELEASING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,9 +30,10 @@ Desktop. All of them are produced by the
to `gs://coder-desktop/mutagen/<tag>/` without rebuilding or re-signing them.
The bucket permissions described below must be in place first.

Uploads refuse to overwrite existing objects. Re-running a successful
upload fails; after a partial failure, an operator must inspect and remove
the partial upload before retrying.
Uploads use `gcloud storage cp` with generation preconditions to refuse
overwrites, and upload `SHA256SUMS` last. Re-running a successful upload
fails; after a partial failure, an operator must inspect and remove the
partial upload before retrying.

4. Bump the Mutagen version in Coder Desktop: `$mutagenVersion` in
`scripts/Get-Mutagen.ps1` (coder/coder-desktop-windows) and
Expand Down Expand Up @@ -73,8 +74,14 @@ account needs `roles/storage.objectCreator` on the `coder-desktop` bucket,
with an IAM condition limiting writes to objects whose resource name starts
with `projects/_/buckets/coder-desktop/objects/mutagen/`.

The account also needs `roles/storage.objectViewer` on the bucket so
`gcloud storage cp` can inspect destination objects and list the bucket.
This read binding must be unconditional: object-prefix conditions cannot
restrict bucket listing. It permits reading and listing the whole bucket,
while writes remain limited to `mutagen/`. Neither role permits deletion.

The `coder-desktop` bucket already exists in project `coder-ci`. Its bucket
resource, IAM policy, and import declarations are managed in coder/gcp under
`projects/production/coder-ci`. Add the uploader binding to that existing
`projects/production/coder-ci`. Add both uploader bindings to that existing
policy before running the upload workflow; do not create another bucket.
No service account key or new GitHub secret is needed.
Loading