[myleshorton]

context

Shipping an egress change currently also needs a deploy/egress/VERSION bump PR in lantern-cloud. This adds a deploy job to release-egress.yml that ships the release itself, the way lantern-box's CI pushes sing-box:latest into lantern-cloud.

Depends on getlantern/lantern-cloud#3545 being merged and applied in staging and prod first. That PR creates the gha-unbounded-egress service account this job authenticates as.

what the deploy job does

• Runs after release, only on runs that publish (the same release == 'true' gate).
• Uses a matrix of {staging, prod} × {amd64, arm64} with fail-fast: false, so one environment failing doesn't cancel the others.
• Reuses the build job's artifact and re-checks its .sha256.
• Packages it exactly as lantern-cloud's deploy-egress.yml did: <version>/bin/egress, <version>/REVISION, a latest symlink, <version>.tar.gz and latest.tar.gz, each with a .sha256.
• Authenticates through lantern-cloud's GitHub WIF provider as gha-unbounded-egress, which can write only the egress-artifacts bucket and only from refs/heads/main.
• Uploads to lantern-cloud[-staging]-egress-artifacts/egress/linux-<arch>/. Hosts' lantern-autoupdate installs it within 5 minutes.
• Job permissions are contents: read and id-token: write. The version reaches the shell only through env, and it was already validated in the version job.

It also updates the header comment, which still said lantern-cloud's cloud-init fetched releases at boot.

not changed

Merges still produce a version-bump PR like #453, because branch protection blocks the workflow's push to main. Removing that step would need an app on the ruleset's bypass list.

testing

• actionlint reports only a pre-existing SC2129 style note in the version step.
• The upload path can only be exercised on main after lantern-cloud#3545 is applied. Verify it on the first release after merging:
  • all 4 deploy jobs succeed
  • egress-us-east's /opt/lantern/egress/latest/REVISION shows the new tag within 5 minutes

🤖 Generated with Claude Code

https://claude.ai/code/session_014raE9kFV5Ton7jzgNi8ADf

Summary by CodeRabbit

• Release Delivery
  • Releases are now published to environment-specific artifact storage and made available to egress hosts within five minutes.
  • Release packages include versioned binaries, revision information, and checksums for verification.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 428d9b6e-c4a1-41fe-8364-33fddfb10d7d

📥 Commits

Reviewing files that changed from the base of the PR and between 3c60d2e and e4209ee.

📒 Files selected for processing (1)

• .github/workflows/release-egress.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The release workflow now deploys verified amd64 and arm64 binaries to staging and production egress-artifacts buckets. It packages each binary with a REVISION file and latest symlink, then uploads the package and checksum aliases.

Changes

Egress Release Deployment

Layer / File(s)	Summary
Package and deploy release artifacts .github/workflows/release-egress.yml	The workflow description now states that egress hosts install artifacts from lantern-cloud buckets within five minutes. A release-gated matrix job verifies, packages, and uploads artifacts for staging and production across amd64 and arm64.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions as GitHub Actions deploy job
  participant BuildArtifact as Build artifact
  participant WorkloadIdentity as Google Cloud workload identity
  participant EgressBucket as Egress-artifacts bucket
  GitHubActions->>BuildArtifact: Download architecture build artifact
  BuildArtifact-->>GitHubActions: Return binary and checksum
  GitHubActions->>GitHubActions: Verify checksum and package binary
  GitHubActions->>WorkloadIdentity: Authenticate for the target environment
  WorkloadIdentity-->>GitHubActions: Provide authenticated access
  GitHubActions->>EgressBucket: Upload package and checksum aliases

Loading

Suggested reviewers: jay-418

Merge Risk: ⚪ Minimal · up to e4209

No confirmed issue blocks merging. The upload and host-side checksum behavior remain untested, so confirm the four deploy jobs and host update after the cloud dependency is applied.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to e4209

Release automation can now directly publish updates for staging and production hosts. Publication can complete only in part, while the cloud authorization policies and updater recovery behavior needed to bound that risk are not available for review. No exploitable security defect was confirmed.

Retained concerns

• Medium · reliability · inferred: The new publisher can leave only part of an update visible after failure or interruption. Archive and checksum aliases are separate uploads, and environment/architecture jobs progress independently without workflow-level compensation. Patch convergence and recovery therefore depend on downstream reconciliation behavior that was not available for review. This does not establish that hosts install unverified binaries.

Security review details

Security Blast Radius

• inferred — The intended deployment scope covers executable updates for both architectures in staging and production. Abuse of accepted publishing authority could affect hosts consuming those artifacts. Fixed destinations do not prove the effective credential permission ceiling, and host, tenant, and downstream data exposure were not established.

Security Findings and Attack Paths

• inferred — A relevant attack path is unauthorized workflow content or a non-main dispatch being accepted by the external identity provider and gaining update-bucket write authority. Reachability is unresolved, not a verified finding: push events are main-only, dispatch already existed before this PR, and the claimed main-only cloud enforcement was unavailable for verification.

Trust Boundaries and Controls

• observed — The new trust transition is GitHub job identity to an environment-specific Google service account and then artifact storage. Local controls include release gating, fixed matrix destinations, separate staging and production identities, and job-scoped OIDC permission. Provider claim restrictions, impersonation bindings, effective bucket permissions, and provisioning readiness remain external proof gaps.

Resilience and Maintainability Implications

• inferred — A failure before upload leaves this job's bucket publication untouched; interruption during upload can leave completed objects visible while others remain old or absent. Whether consumers fail closed, retry safely, or remain on an older release is unknown. This uncertainty affects patch delivery and recovery, not a demonstrated integrity bypass.

Hardening Proposals

• proposed — Validate the external authorization and consumer contracts before relying on automatic fleet updates: confirm intended repository/ref restrictions and storage authority, and establish fail-closed checksum handling and recovery for split publication. If the consumer lacks safe reconciliation, consider immutable version publication followed by a single committed update reference.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: deploying each egress release to Lantern Cloud buckets.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟡 Changes recommended

Generated checksum manifests reference runner-local or mismatched archive paths, preventing standard post-download verification.

1 open finding

• Generate portable checksums with archive-relative paths · New

What changed in this PR

Adds automated deployment of released egress binaries to staging and production artifact buckets.

Changes:

• Packages amd64/arm64 releases for Lantern autoupdate.
• Authenticates via Workload Identity Federation and uploads to both environments.

File	Description
.github/​workflows/​release-egress.yml	Adds the matrix deployment job and updates workflow documentation.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.