Improve artifacts upload when ACL disabled

[olexandr13]

CodeAnt-AI Description

Avoid sending ACL on artifact uploads; retry without ACL and improve logs; update publish workflow

What Changed

• Artifact uploads no longer attach ACL headers when using IAM role credentials, when uploading to Google Cloud Storage endpoints, or when TESTOMATIO_S3_NO_ACL=1 is set.
• If an upload fails with "Invalid argument" or access denied due to unsupported ACLs, the uploader retries once without an ACL and succeeds for buckets enforcing no-ACL policies.
• Upload logs and failure messages now include the file path and human-readable file size for clearer diagnostics.
• Documentation adds TESTOMATIO_S3_NO_ACL environment variable to disable ACLs.
• Release workflow updated: Node 20, registry configured, OIDC id-token permissions enabled, automatic npm tag detection, and publish uses npm publish with provenance (no custom token-publish step).

Impact

✅ Fewer artifact upload failures for GCS and buckets with Bucket Owner Enforced
✅ Clearer upload error logs showing file path and size
✅ More reliable automated npm publishing with tag detection and OIDC-based credentials

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

CodeAnt AI is reviewing your PR.

[codeant-ai]

Sequence Diagram

This PR adds a new TESTOMATIO_S3_NO_ACL flag and changes upload logic to avoid sending ACL for IAM roles, GCS, or when explicitly disabled; if an upload fails due to unsupported ACL, the uploader retries without the ACL and returns the artifact link on success.

sequenceDiagram
    participant Uploader
    participant Config
    participant S3

    Uploader->>Config: Read S3_BUCKET, PRIVATE_ARTIFACTS, TESTOMATIO_S3_NO_ACL, endpoint, credentials
    Uploader->>S3: Build upload params (Bucket, Key, Body[, ACL?])
    note right of Uploader: ACL added only if not sessionToken, not GCS, and not TESTOMATIO_S3_NO_ACL
    Uploader->>S3: Attempt upload (with ACL)
    alt Upload fails due to unsupported ACL (InvalidArgument/AccessDenied)
        Uploader->>S3: Retry upload without ACL
        S3-->>Uploader: Uploaded (link)
    else Upload succeeds
        S3-->>Uploader: Uploaded (link)
    end

Loading

---

Generated by CodeAnt AI

[codeant-ai]

Nitpicks 🔍

🔒 No security issues identified

⚡ Recommended areas for review Config parsing The new env var TESTOMATIO_S3_NO_ACL is read as a raw string from process.env and then used in boolean expressions. This treats any non-empty value (including 'false') as truthy which can lead to unexpected behavior. Normalise/parsing of this env var to a boolean should be validated. Retry condition robustness The retry-on-failure logic inspects e.name and e.message for specific strings. AWS / S3-compatible providers may return different error shapes (e.g., code or nested fields). Consider broadening or standardising error checks (or logging full error metadata) to avoid missing retryable cases.

[codeant-ai]

CodeAnt AI finished reviewing your PR.

[codeant-ai]

CodeAnt AI is running Incremental review

[codeant-ai]

CodeAnt AI Incremental review completed.

[DavertMik]

Sorry I don't understand what is ACL
Maybe this is already solved by sharing credentials for public reports?

[DavertMik]

Ok, but we need to test this on GCS