From 7396178f12137cf4ce7da88c0c9a1d751e6fd0fb Mon Sep 17 00:00:00 2001
From: Janghoon Lee <44862514+savagemanage@users.noreply.github.com>
Date: Wed, 14 Oct 2026 13:16:06 +0000
Subject: [PATCH] ci(cdn-version-marker): do not read the marker back from the
 bucket

The CDN key is write-only: the first run uploaded 0.6.3 and then failed
on its own read-back with HeadObject 403. The upload's exit status is the
proof; the CDN read stays as a notice.
---
 .github/workflows/cdn-version-marker.yml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/cdn-version-marker.yml b/.github/workflows/cdn-version-marker.yml
index 0e2cf5797d..7d6bc64b36 100644
--- a/.github/workflows/cdn-version-marker.yml
+++ b/.github/workflows/cdn-version-marker.yml
@@ -78,12 +78,11 @@ jobs:
           printf '%s\n' "$VERSION" > version
           aws s3 cp version "s3://${REDROB_CDN_BUCKET}/code/latest/version" \
             --content-type "text/plain" --cache-control "public, max-age=300" --no-progress
-          # Read it back from the bucket, which is authoritative. The CDN in front has no
-          # cache-control on the old object, so it may serve the previous marker for up to its
-          # default TTL (a day); that is reported, not failed, since the bucket is right.
-          got="$(aws s3 cp "s3://${REDROB_CDN_BUCKET}/code/latest/version" - | tr -d '\n')"
-          [ "$got" = "$VERSION" ] || { echo "::error::bucket holds '$got', expected '$VERSION'"; exit 1; }
-          echo "OK s3://${REDROB_CDN_BUCKET}/code/latest/version = $got"
+          # The CDN key can write the bucket but not read it (HeadObject is 403), so the upload's
+          # own exit status is the proof. The CDN in front has no cache-control on the old object,
+          # so it may serve the previous marker for up to its default TTL (a day); that is reported,
+          # not failed.
+          echo "OK s3://${REDROB_CDN_BUCKET}/code/latest/version = $VERSION"
           cdn="$(curl --fail --silent --location https://cdn.redrob.ai/code/latest/version || true)"
           if [ "$cdn" != "$VERSION" ]; then
             echo "::notice::cdn.redrob.ai still serves '$cdn'; it refreshes when the cached copy expires."