chore(ci): make nightly S3 verify resilient to CDN staleness (#25259)

* chore(ci): remove dead nightly artifact-redirect loop

The loop referenced an undefined $i (copy-paste from the release branch
where $i iterates over version tags). Under set -u the subshell errored,
the for loop received empty input, and the body never ran — so this has
been a no-op since it was added.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(ci): retry verify_artifact on CDN cache staleness

packages.timber.io is fronted by a CDN; after `aws s3 rm --recursive` +
`cp --recursive` on nightly/latest, the edge can keep serving stale
bytes for longer than the existing 30s VERIFY_TIMEOUT, failing `cmp`
and the whole job. wget's --retry-on-http-error=404 only retries 404s,
not a 200 with stale content.

Wrap the compare in an exponential-backoff retry loop
(1, 2, 4, 8, 16, 32s; 7 attempts, ~63s of total sleep) so a transient
stale-cache hit no longer fails the release.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: pront

scripts/release-s3.sh

@@ -36,11 +36,27 @@ ls "$td_nightly"
 #
 # A helper function for verifying a published artifact.
 #
+# Retries a content mismatch as well as a 404, since packages.timber.io is
+# fronted by a CDN and an object we just overwrote via `aws s3 rm` + `cp` can
+# serve stale bytes at the edge for a while.
 verify_artifact() {
   local URL="$1"
   local FILENAME="$2"
+  local attempts=7
+  local delay=1
   echo "Verifying $URL"
-  cmp <(wget -qO- --retry-on-http-error=404 --wait 10 --tries "$VERIFY_RETRIES" "$URL") "$FILENAME"
+  for ((attempt = 1; attempt <= attempts; attempt++)); do
+    if cmp <(wget -qO- --retry-on-http-error=404 --wait 10 --tries "$VERIFY_RETRIES" "$URL") "$FILENAME"; then
+      return 0
+    fi
+    if (( attempt < attempts )); then
+      echo "Attempt $attempt/$attempts did not match (likely stale CDN cache); retrying in ${delay}s"
+      sleep "$delay"
+      delay=$((delay * 2))
+    fi
+  done
+  echo "Verification of $URL failed after $attempts attempts"
+  return 1
 }
 
 #
@@ -59,15 +75,6 @@ if [[ "$CHANNEL" == "nightly" ]]; then
   aws s3 cp "$td_nightly" "s3://packages.timber.io/vector/nightly/latest" --recursive --sse --acl public-read
   echo "Uploaded archives"
 
-  echo "Redirecting old artifact names"
-  for file in $(aws s3api list-objects-v2 --bucket packages.timber.io --prefix "vector/$i/" --query 'Contents[*].Key' --output text  | tr "\t" "\n" | grep '\-nightly'); do
-    file=$(basename "$file")
-    # vector-nightly-amd64.deb -> vector-amd64.deb
-    echo -n "" | aws s3 cp - "s3://packages.timber.io/vector/nightly/$DATE/${file/-nightly/}" --website-redirect "/vector/nightly/$DATE/$file" --acl public-read
-    echo -n "" | aws s3 cp - "s3://packages.timber.io/vector/nightly/latest/${file/-nightly/}" --website-redirect "/vector/nightly/latest/$file" --acl public-read
-  done
-  echo "Redirected old artifact names"
-
   # Verify that the files exist and can be downloaded
   echo "Waiting for $VERIFY_TIMEOUT seconds before running the verifications"
   sleep "$VERIFY_TIMEOUT"