change artifact upload to Cloudflare R2 and auth pattern uses GCP Secrets manager

.github/workflows/release-prefect-dagger.yml

@@ -4,7 +4,7 @@
 # Architecture:
 #   - Windows build runs natively on windows-latest (cannot containerize)
 #   - Linux builds run via Dagger containers orchestrated by Prefect
-#   - Signing, release creation, and S3 upload handled by Prefect tasks
+#   - Signing, release creation, and R2 upload handled by Prefect tasks
 #   - Container runtime: Podman (Dagger connects via Podman socket)
 #
 # Local equivalent:
@@ -206,7 +206,7 @@ jobs:
             dist/android-file-handler-rhel.sha256
             pkg_dist_rhel/**
 
-  # ── Release + S3 Upload (Prefect) ───────────────────────────────────
+  # ── Release + R2 Upload (Prefect) ───────────────────────────────────
   do-release:
     needs: [build-windows, build-linux]
     runs-on: ubuntu-latest
@@ -246,42 +246,52 @@ jobs:
           poetry run python -m ci.prefect_flow release \
             --github-token "$GITHUB_TOKEN"
 
-  upload-s3:
+  upload-r2:
     runs-on: ubuntu-latest
     needs: do-release
     if: needs.do-release.result == 'success'
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           ref: main
 
-      - name: Install AWS CLI
-        run: python -m pip install --upgrade pip awscli
+      - name: Set up Python 3.13
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+
+      - name: Install Poetry
+        uses: snok/install-poetry@v1
+        with:
+          version: latest
+          virtualenvs-create: true
+          virtualenvs-in-project: true
+
+      - name: Install project + CI dependencies
+        run: poetry install --with ci
 
       - name: Download build artifacts
         uses: actions/download-artifact@v4
         with:
           merge-multiple: true
-          path: ./binaries
+          path: ./release-files
 
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v2
+      - name: Authenticate to GCP
+        uses: google-github-actions/auth@v2
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ secrets.AWS_REGION }}
+          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
 
-      - name: Upload artifacts to S3
+      - name: Upload artifacts to Cloudflare R2
         run: |
-          set -euo pipefail
-          if [ -z "${{ secrets.S3_BUCKET }}" ]; then
-            echo "S3_BUCKET secret not set; skipping upload"
-            exit 0
-          fi
-          aws s3 sync ./binaries s3://${{ secrets.S3_BUCKET }}/builds/${{ github.run_id }}/ --acl private
-        env:
-          AWS_PAGER: ""
+          poetry run python -m ci.prefect_flow upload-r2 \
+            --gcp-project-id "${{ secrets.GCP_PROJECT_ID }}" \
+            --run-id "${{ github.run_id }}" \
+            --release-dir "./release-files"
 
   sync-wiki:
     needs: do-release