From 7285a46532032817bc593b57d780c54975e9028d Mon Sep 17 00:00:00 2001
From: Musa Misto <64855513+MusaMisto@users.noreply.github.com>
Date: Tue, 13 Oct 2026 10:04:16 +0300
Subject: [PATCH] ci: production runs on a limited Spaces key

Spaces gives limited (per-bucket Read/Write/Delete) keys no bucket settings,
so SW-CloudFiles' startup read of the bucket's lifecycle rules was refused and
the first production deploy exited with Access Denied. Production skips that
step (CloudFiles__DisableAutoLifecycle=true); the temp expiry rules go on
bitweenprod once by hand. Every object operation the app makes works with the
limited key (put, get, head bucket, delete: checked against bitweenprod).
---
 .github/workflows/bitween-api-cicd-gateway.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/bitween-api-cicd-gateway.yml b/.github/workflows/bitween-api-cicd-gateway.yml
index 0463c5ec..fd15c5e0 100644
--- a/.github/workflows/bitween-api-cicd-gateway.yml
+++ b/.github/workflows/bitween-api-cicd-gateway.yml
@@ -187,6 +187,11 @@ jobs:
       # Every line is handed to helm --set as it stands, so no comments inside.
       # AWS_*_CHECKSUM_*=when_required: production stores files in DigitalOcean Spaces too, so it
       # carries develop's checksum setting (see the note there) until the fix lands in SW-CloudFiles.
+      # CloudFiles__DisableAutoLifecycle=true: production's Spaces key is a limited (Read/Write/Delete)
+      # key for bitweenprod alone, and Spaces gives limited keys no bucket settings, so the read of the
+      # bucket's lifecycle rules that SW-CloudFiles makes at startup is refused and the app exits. The
+      # temp1/7/30/365 expiry rules (temp30/ holds exchange files: 30-day retention) were put on the
+      # bucket once by hand instead; keep them in step with SW-CloudFiles' if those ever change.
       helm-set-values: |
         global.environment=Production
         replicaCount=2
@@ -196,6 +201,7 @@ jobs:
         environmentVariables.Bitween__BusProvidersEnabled=true
         environmentVariables.AWS_REQUEST_CHECKSUM_CALCULATION=when_required
         environmentVariables.AWS_RESPONSE_CHECKSUM_VALIDATION=when_required
+        environmentVariables.CloudFiles__DisableAutoLifecycle=true
     secrets:
       registry-username: ${{ secrets.DOCKERHUB_USERNAME }}
       registry-password: ${{ secrets.DOCKERHUB_TOKEN }}