Struct Store 

pub struct Store {
    access_key: String,
    secret_key: String,
    bucket: String,
    endpoint: String,
}

Credentials and endpoint for the artifacts bucket.

Fields

access_key: String

secret_key: String

bucket: String

endpoint: String

Implementations

impl Store

pub fn from_env() -> Result<Self>

Reads the bucket configuration, failing closed.

Only ever called on a branch where the workflow decided this run may hold the write key; a PR run builds and verifies everything and never reaches here.

fn s3(&self, args: &[&str]) -> Result<()>

pub fn publish( &self, kind: Kind, tarball: &Path, identity: &Identity, ) -> Result<Meta>

Uploads a payload under its content-addressed key, then the meta that points at it. Order matters: a meta must never name an object that is not there yet, since a reader that sees the meta will go fetch it.

impl Store

fn s3_get(&self, remote: &str, local: &Path) -> Result<()>

pub fn fetch_meta( &self, kind: Kind, identity: &Identity, into: &Path, ) -> Result<Meta>

Reads one kind’s meta out of a run’s prefix.

pub fn verify_object( &self, meta: &Meta, identity: &Identity, into: &Path, ) -> Result<PathBuf>

Downloads a payload and checks it against what its meta claims.

The key is content-addressed, so bytes cannot change under a name — but verifying on read is what turns that from an argument into a check.

pub fn write_manifest( &self, metas: &[Meta], identity: &Identity, from: &Path, ) -> Result<()>

Writes the manifest. Only finalize calls this, and only after both kinds have been fetched and verified — the manifest existing is the signal that the pair is complete and consistent.