ci(release): harden R2 upload with aws CLI auto-install and R2-compatible checksums

Author: loverustfs

.github/workflows/release.yml

@@ -255,9 +255,29 @@ jobs:
             exit 0
           fi
 
+          # Ensure aws CLI is available; k8s/docker build images may not ship it.
+          if ! command -v aws >/dev/null 2>&1; then
+            echo "ℹ️ aws CLI not found, installing AWS CLI v2 for Linux..."
+            ARCH="$(uname -m)"
+            case "$ARCH" in
+              x86_64) AWS_CLI_ARCH="x86_64" ;;
+              aarch64|arm64) AWS_CLI_ARCH="aarch64" ;;
+              *) echo "❌ Unsupported architecture for aws CLI install: $ARCH"; exit 1 ;;
+            esac
+            curl -sL "https://awscli.amazonaws.com/awscli-exe-linux-${AWS_CLI_ARCH}.zip" -o awscliv2.zip
+            unzip -q awscliv2.zip
+            ./aws/install --update -i "${RUNNER_TEMP:-/tmp}/aws-cli" -b "${RUNNER_TEMP:-/tmp}/aws-bin"
+            export PATH="${RUNNER_TEMP:-/tmp}/aws-bin:$PATH"
+            rm -rf awscliv2.zip aws
+          fi
+
           export AWS_ACCESS_KEY_ID="$R2_ACCESS_KEY_ID"
           export AWS_SECRET_ACCESS_KEY="$R2_SECRET_ACCESS_KEY"
           export AWS_DEFAULT_REGION="auto"
+          # AWS CLI v2.23+ enables data integrity checksums by default, which
+          # Cloudflare R2 does not fully support; only send them when required.
+          export AWS_REQUEST_CHECKSUM_CALCULATION="when_required"
+          export AWS_RESPONSE_CHECKSUM_VALIDATION="when_required"
 
           R2_PATH="s3://${R2_BUCKET}/artifacts/rustfs-cli/release/"
 
@@ -380,9 +400,29 @@ jobs:
             exit 0
           fi
 
+          # Ensure aws CLI is available; k8s/docker build images may not ship it.
+          if ! command -v aws >/dev/null 2>&1; then
+            echo "ℹ️ aws CLI not found, installing AWS CLI v2 for Linux..."
+            ARCH="$(uname -m)"
+            case "$ARCH" in
+              x86_64) AWS_CLI_ARCH="x86_64" ;;
+              aarch64|arm64) AWS_CLI_ARCH="aarch64" ;;
+              *) echo "❌ Unsupported architecture for aws CLI install: $ARCH"; exit 1 ;;
+            esac
+            curl -sL "https://awscli.amazonaws.com/awscli-exe-linux-${AWS_CLI_ARCH}.zip" -o awscliv2.zip
+            unzip -q awscliv2.zip
+            ./aws/install --update -i "${RUNNER_TEMP:-/tmp}/aws-cli" -b "${RUNNER_TEMP:-/tmp}/aws-bin"
+            export PATH="${RUNNER_TEMP:-/tmp}/aws-bin:$PATH"
+            rm -rf awscliv2.zip aws
+          fi
+
           export AWS_ACCESS_KEY_ID="$R2_ACCESS_KEY_ID"
           export AWS_SECRET_ACCESS_KEY="$R2_SECRET_ACCESS_KEY"
           export AWS_DEFAULT_REGION="auto"
+          # AWS CLI v2.23+ enables data integrity checksums by default, which
+          # Cloudflare R2 does not fully support; only send them when required.
+          export AWS_REQUEST_CHECKSUM_CALCULATION="when_required"
+          export AWS_RESPONSE_CHECKSUM_VALIDATION="when_required"
 
           R2_PATH="s3://${R2_BUCKET}/artifacts/rustfs-cli/release/${RELEASE_VERSION}/"