chore(infra): prune dotcom-deploy-assets-cache R2 bucket for closed PRs (tldraw#8746)

The `prune-preview-deploys` workflow already tears down preview workers,
Supabase branches, fly.io zero-cache apps, and Zero litestream R2
backups, but it didn't touch `dotcom-deploy-assets-cache` — the R2
bucket where `coalesceWithPreviousAssets`
(`internal/scripts/deploy-dotcom.ts:957`) writes a tarball per deploy.
Closed PRs were leaving `pr-<n>/` folders behind forever.

This PR adds a fifth prune pass over that bucket, reusing the existing
closed-for-2-days filter via `processItems`. Since both R2 prunes were
near-duplicates, I refactored them into shared `listR2PrPrefixes` /
`deleteR2Prefix` helpers parameterized by an `R2BucketRef` ({client,
bucket, label}). Adding more buckets in future is one literal each. Net
diff is +43/-80.

`staging/` and `production/` prefixes are intentionally untouched —
they're required by `coalesceWithPreviousAssets` for rollback safety.

Also broadens the fly.io app regex from `^pr-\d+-zero-cache$` to
`^pr-\d+-zero-(cache|rm|vs)$` so preview `zero-rm` and `zero-vs` apps
get torn down alongside `zero-cache`. Without this, the leftover apps
kept writing new litestream backups into already-pruned `pr-<n>/`
prefixes in the Zero R2 bucket, so the same prefix kept reappearing in
nightly runs.

Closes tldraw#8745.

### Change type

- [x] `other`

### Test plan

- Workflow runs daily on cron; will be exercised on the next scheduled
run after merge. Reuses the same `R2_ACCESS_KEY_ID` /
`R2_ACCESS_KEY_SECRET` secrets the dotcom deploy job already uses for
this bucket, so no new secrets needed.

Author: MitjaBezensek

.github/workflows/prune-preview-deploys.yml

@@ -54,6 +54,8 @@ jobs:
           ZERO_R2_BUCKET_NAME: ${{ secrets.ZERO_R2_BUCKET_NAME }}
           ZERO_R2_ACCESS_KEY_ID: ${{ secrets.ZERO_R2_ACCESS_KEY_ID }}
           ZERO_R2_SECRET_ACCESS_KEY: ${{ secrets.ZERO_R2_SECRET_ACCESS_KEY }}
+          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          R2_ACCESS_KEY_SECRET: ${{ secrets.R2_ACCESS_KEY_SECRET }}
 
       - name: Notify Discord on failure
         if: failure()

internal/scripts/prune-preview-deploys.ts

@@ -16,6 +16,8 @@ const env = makeEnv([
 	'ZERO_R2_BUCKET_NAME',
 	'ZERO_R2_ACCESS_KEY_ID',
 	'ZERO_R2_SECRET_ACCESS_KEY',
+	'R2_ACCESS_KEY_ID',
+	'R2_ACCESS_KEY_SECRET',
 ])
 
 interface ListWorkersResult {
@@ -171,7 +173,7 @@ async function listPreviewDatabases() {
 	}
 	return preview.map((b) => b.name)
 }
-const ZERO_CACHE_APP_REGEX = /^pr-\d+-zero-cache$/
+const ZERO_CACHE_APP_REGEX = /^pr-\d+-zero-(cache|rm|vs)$/
 async function listFlyioPreviewApps() {
 	// This is the kind of output this returns.
 	// We'll skip the first line then get the first column of each line.
@@ -189,22 +191,19 @@ async function listFlyioPreviewApps() {
 	return appNames.filter((name) => ZERO_CACHE_APP_REGEX.test(name))
 }
 
-const R2 = new S3Client({
-	region: 'auto',
-	endpoint: env.ZERO_R2_ENDPOINT,
-	credentials: {
-		accessKeyId: env.ZERO_R2_ACCESS_KEY_ID,
-		secretAccessKey: env.ZERO_R2_SECRET_ACCESS_KEY,
-	},
-})
+interface R2BucketRef {
+	client: S3Client
+	bucket: string
+	label: string
+}
 
-async function listR2BackupPrefixes(): Promise<string[]> {
+async function listR2PrPrefixes({ client, bucket }: R2BucketRef): Promise<string[]> {
 	const prefixes: string[] = []
 	let continuationToken: string | undefined
 	do {
-		const res = await R2.send(
+		const res = await client.send(
 			new ListObjectsV2Command({
-				Bucket: env.ZERO_R2_BUCKET_NAME,
+				Bucket: bucket,
 				Prefix: 'pr-',
 				Delimiter: '/',
 				ContinuationToken: continuationToken,
@@ -218,20 +217,15 @@ async function listR2BackupPrefixes(): Promise<string[]> {
 	return prefixes
 }
 
-async function deleteR2Backup(prefix: string) {
-	nicelog('Deleting R2 backup data:', prefix)
+async function deleteR2Prefix({ client, bucket, label }: R2BucketRef, prefix: string) {
+	nicelog(`Deleting ${label}:`, prefix)
 	while (true) {
-		const list = await R2.send(
-			new ListObjectsV2Command({
-				Bucket: env.ZERO_R2_BUCKET_NAME,
-				Prefix: prefix,
-			})
-		)
+		const list = await client.send(new ListObjectsV2Command({ Bucket: bucket, Prefix: prefix }))
 		const objects = list.Contents
 		if (!objects || objects.length === 0) break
-		const result = await R2.send(
+		const result = await client.send(
 			new DeleteObjectsCommand({
-				Bucket: env.ZERO_R2_BUCKET_NAME,
+				Bucket: bucket,
 				Delete: { Objects: objects.map((o) => ({ Key: o.Key })) },
 			})
 		)
@@ -243,6 +237,33 @@ async function deleteR2Backup(prefix: string) {
 	}
 }
 
+const zeroBackups: R2BucketRef = {
+	client: new S3Client({
+		region: 'auto',
+		endpoint: env.ZERO_R2_ENDPOINT,
+		credentials: {
+			accessKeyId: env.ZERO_R2_ACCESS_KEY_ID,
+			secretAccessKey: env.ZERO_R2_SECRET_ACCESS_KEY,
+		},
+	}),
+	bucket: env.ZERO_R2_BUCKET_NAME,
+	label: 'Zero litestream backup',
+}
+
+// Matches the bucket / endpoint used by `coalesceWithPreviousAssets` in deploy-dotcom.ts.
+const dotcomAssetsCache: R2BucketRef = {
+	client: new S3Client({
+		region: 'auto',
+		endpoint: 'https://c34edc4e76350954b63adebde86d5eb1.r2.cloudflarestorage.com',
+		credentials: {
+			accessKeyId: env.R2_ACCESS_KEY_ID,
+			secretAccessKey: env.R2_ACCESS_KEY_SECRET,
+		},
+	}),
+	bucket: 'dotcom-deploy-assets-cache',
+	label: 'dotcom deploy assets cache',
+}
+
 const deletionErrors: string[] = []
 
 async function main() {
@@ -252,8 +273,13 @@ async function main() {
 	await processItems(listPreviewDatabases, deletePreviewDatabase)
 	nicelog('\nPruning fly.io preview apps')
 	await processItems(listFlyioPreviewApps, deleteFlyioPreviewApp)
-	nicelog('\nPruning R2 litestream backups')
-	await processItems(listR2BackupPrefixes, deleteR2Backup)
+	for (const r2 of [zeroBackups, dotcomAssetsCache]) {
+		nicelog(`\nPruning ${r2.label}`)
+		await processItems(
+			() => listR2PrPrefixes(r2),
+			(prefix) => deleteR2Prefix(r2, prefix)
+		)
+	}
 	nicelog('\nDone')
 	if (deletionErrors.length > 0) {
 		nicelog('\nDeletion errors:')