From 7e233fa7534d820ea4e7355707e1fcf08ed033de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1rton=20Boros?= <martonboros@gmail.com>
Date: Fri, 16 Oct 2026 03:05:39 +0300
Subject: [PATCH 1/2] ci: verify the site-env publish step

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/verify-site-env-publish.yml | 42 +++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 .github/workflows/verify-site-env-publish.yml

diff --git a/.github/workflows/verify-site-env-publish.yml b/.github/workflows/verify-site-env-publish.yml
new file mode 100644
index 0000000000..9085d61cf0
--- /dev/null
+++ b/.github/workflows/verify-site-env-publish.yml
@@ -0,0 +1,42 @@
+name: Verify site-env publish
+
+on:
+  push:
+    branches:
+      - ci/verify-site-env-publish
+
+permissions:
+  contents: read
+  id-token: write
+
+env:
+  AWS_REGION: us-east-1
+
+jobs:
+  publish:
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Checkout Repo
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        with:
+          role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Install nix
+        uses: ./.github/actions/nix-install-ephemeral
+
+      - name: Publish site-env store path
+        run: |
+          GIT_SHA="${{ github.sha }}"
+          SYSTEM=$(nix eval --impure --raw --expr 'builtins.currentSystem')
+          SITE_ENV_NAME="site-env-17"
+          SITE_ENV_PATH=$(nix eval --raw ".#${SITE_ENV_NAME}.outPath")
+          PREFIX="s3://supabase-public-artifacts-bucket/nix-catalog/ci-test/${GITHUB_RUN_ID}"
+
+          aws s3 cp - "${PREFIX}-${GIT_SHA}-${SITE_ENV_NAME}-${SYSTEM}" <<< "$SITE_ENV_PATH"
+
+          echo "published:"
+          aws s3 cp "${PREFIX}-${GIT_SHA}-${SITE_ENV_NAME}-${SYSTEM}" -

From 0e23b8b57ffcdfc741a64fbf62d53869e9b5b2c2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1rton=20Boros?= <martonboros@gmail.com>
Date: Fri, 16 Oct 2026 15:05:02 +0300
Subject: [PATCH 2/2] ci: publish with the catalog role chain

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/verify-site-env-publish.yml | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/verify-site-env-publish.yml b/.github/workflows/verify-site-env-publish.yml
index 9085d61cf0..a55c5f222c 100644
--- a/.github/workflows/verify-site-env-publish.yml
+++ b/.github/workflows/verify-site-env-publish.yml
@@ -19,11 +19,21 @@ jobs:
       - name: Checkout Repo
         uses: supabase/postgres/.github/actions/shared-checkout@HEAD
 
-      - name: Configure AWS credentials
+      - name: GitHub OIDC Auth
         uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
         with:
-          role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
-          aws-region: ${{ env.AWS_REGION }}
+          aws-region: us-east-1
+          role-to-assume: arn:aws:iam::279559813984:role/supabase-github-oidc-role
+          role-session-name: shared-services-jump
+
+      - name: Assume destination role
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        with:
+          aws-region: us-east-1
+          role-to-assume: arn:aws:iam::279559813984:role/supabase-nix-catalog-artifacts-role-6387512
+          role-skip-session-tagging: true
+          role-session-name: upload-assets
+          role-chaining: true
 
       - name: Install nix
         uses: ./.github/actions/nix-install-ephemeral