From eb98fd1e99b23cbfd04d589f55a6eee9e917b258 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 16 Oct 2026 10:03:18 +0200
Subject: [PATCH] chore: upload EE debug info to a private bucket, not GitHub
 releases (#11809)

* chore: upload EE debug info to a private bucket, not GitHub releases

* chore: pass tag and arch to the debug upload through env
---
 .github/workflows/docker-image.yml | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 7e05675495..51da953ab0 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -239,7 +239,7 @@ jobs:
             ${{ steps.extract-ee.outputs.destination }}/*
             ${{ steps.extract-duckdb-ffi-internal.outputs.destination }}/*
 
-  attach_ee_debug_to_release:
+  upload_ee_debug_to_s3:
     needs: [build_ee]
     runs-on: ubicloud
     if: ${{ startsWith(github.ref, 'refs/tags/v') }}
@@ -284,14 +284,21 @@ jobs:
             WM_BUILD_VERSION=${{ github.sha }}
           outputs: type=local,dest=./debuginfo
 
-      - name: Rename debug file with corresponding architecture
+      # The debug file names every EE function with its source file and line, so it
+      # goes to a private bucket, never to the public release.
+      - name: Upload debug file to private bucket
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-east-1
+          TAG: ${{ github.ref_name }}
+          ARCH: ${{ matrix.arch }}
         run: |
-          mv ./debuginfo/windmill.debug ./debuginfo/windmill-ee-${{ matrix.arch }}.debug
-
-      - name: Attach debug file to release
-        uses: softprops/action-gh-release@v2
-        with:
-          files: ./debuginfo/windmill-ee-${{ matrix.arch }}.debug
+          aws --version
+          aws configure set default.s3.multipart_chunksize 64MB
+          aws s3 cp ./debuginfo/windmill.debug \
+            "s3://windmill-ee-debuginfo/$TAG/windmill-ee-$ARCH.debug" \
+            --storage-class GLACIER_IR --only-show-errors
 
   # attach_arm64_binary_to_release:
   #   needs: [build, build_ee]