tetherto
diff --git a/‎.github/actions/run-mobile-integration-tests/collect-and-upload-logs/action.yml‎
Lines changed: 35 additions & 0 deletions b/‎.github/actions/run-mobile-integration-tests/collect-and-upload-logs/action.yml‎
Lines changed: 35 additions & 0 deletions
diff --git a/‎.github/actions/run-mobile-integration-tests/seed-and-presign-models/action.yml‎
Lines changed: 129 additions & 0 deletions b/‎.github/actions/run-mobile-integration-tests/seed-and-presign-models/action.yml‎
Lines changed: 129 additions & 0 deletions
diff --git a/‎.github/actions/run-mobile-integration-tests/seed-and-presign-models/rewrite-manifest-urls.mjs‎
Lines changed: 48 additions & 0 deletions b/‎.github/actions/run-mobile-integration-tests/seed-and-presign-models/rewrite-manifest-urls.mjs‎
Lines changed: 48 additions & 0 deletions
@@ -428,6 +428,41 @@ runs:
           echo "found=false" >> "$GITHUB_OUTPUT"
         fi
 
+    # The prestage/download commands can echo presigned S3 URLs into the Device
+    # Farm test-spec / console output collected above. This repo is public and
+    # these artifacts are world-readable for 30 days, so redact the AWS SigV4
+    # credential fields before upload. Runner ::add-mask:: does not cover uploaded
+    # file contents, so this file-level scrub is required in addition to it.
+    - name: Scrub presigned credentials from console logs
+      if: always() && inputs.run-arns != '[]' && inputs.run-arns != ''
+      shell: bash
+      run: |
+        set -euo pipefail
+        [ -d console-logs ] || exit 0
+        node -e '
+          const fs = require("fs")
+          const path = require("path")
+          const root = "console-logs"
+          // Neutralise the signature (the secret) and the access-key-id / session
+          // token that AWS SigV4 puts in the query string of a presigned URL. The
+          // value stops at the next query separator, whitespace or quote.
+          const re = /X-Amz-(Signature|Credential|Security-Token)=[^&\s"<>]+/gi
+          let scrubbed = 0
+          const walk = (dir) => {
+            for (const ent of fs.readdirSync(dir, { withFileTypes: true })) {
+              const p = path.join(dir, ent.name)
+              if (ent.isDirectory()) { walk(p); continue }
+              let text
+              try { text = fs.readFileSync(p, "utf8") } catch { continue }
+              if (!text.includes("X-Amz-")) continue
+              const out = text.replace(re, (m, f) => "X-Amz-" + f + "=REDACTED")
+              if (out !== text) { fs.writeFileSync(p, out); scrubbed++ }
+            }
+          }
+          walk(root)
+          console.log("[scrub] redacted presigned credentials in " + scrubbed + " file(s)")
+        '
+
     - name: Upload console logs
       id: upload_console_log
       if: always() && inputs.run-arns != '[]' && inputs.run-arns != ''
 
@@ -0,0 +1,129 @@
+name: Seed & presign mobile models (US bucket)
+description: >-
+  Mirror a HuggingFace-bound addon's pinned models into the Device-Farm-local US
+  bucket if missing, then presign them, writing a name -> presigned-URL map for
+  the caller to feed into its staging path. Uses an auto-refreshing OIDC
+  credential_process so a multi-GB first seed survives the 2h STS session cap.
+
+inputs:
+  manifest-path:
+    description: "Path (relative to workspace) to the addon's pinned models.manifest.json"
+    required: true
+  s3-bucket:
+    description: "Destination US bucket"
+    required: false
+    default: tether-ai-dev-us
+  s3-prefix:
+    description: "Destination key prefix (must end with '/')"
+    required: true
+  aws-region:
+    description: "US region (same as the Device Farm fleet)"
+    required: false
+    default: us-west-2
+  aws-role-to-assume:
+    description: "OIDC role ARN to assume for S3 access"
+    required: true
+  hf-token:
+    description: "HuggingFace token for gated model downloads"
+    required: false
+    default: ""
+  output-map:
+    description: "Path to write the name -> presigned-URL JSON map (required for mode=presign|both)"
+    required: false
+    default: ""
+  model-names:
+    description: "Optional comma-separated allowlist of model names to seed (the mobile subset). Empty = every model in the manifest."
+    required: false
+    default: ""
+  expires-in:
+    description: "Presigned-URL lifetime in seconds (effective TTL capped by the STS session)"
+    required: false
+    default: "7200"
+  mode:
+    description: "both = seed then presign (default); seed = mirror-only (one writer, no map); presign = presign already-seeded objects (per matrix leg)"
+    required: false
+    default: "both"
+
+runs:
+  using: composite
+  steps:
+    - name: Bootstrap auto-refreshing AWS credentials
+      shell: bash
+      env:
+        OIDC_ROLE_ARN: ${{ inputs.aws-role-to-assume }}
+        STS_REGION: ${{ inputs.aws-region }}
+      run: |
+        set -uo pipefail
+        # credential_process helper the AWS CLI re-invokes near expiry, so a long
+        # first seed survives the 2h STS cap. It mints a fresh OIDC JWT and
+        # exchanges it via assume-role-with-web-identity (no pre-existing creds).
+        CRED_HELPER="${RUNNER_TEMP}/oidc-cred-process-seed.sh"
+        cat > "${CRED_HELPER}" <<'HELPER'
+        #!/usr/bin/env bash
+        set -euo pipefail
+        JWT=$(curl -sS -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
+          "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=sts.amazonaws.com" | jq -r '.value')
+        # UNSET (not blank) so the CLI does not recurse into this helper's profile.
+        unset AWS_PROFILE AWS_DEFAULT_PROFILE
+        export AWS_CONFIG_FILE=/dev/null
+        export AWS_SHARED_CREDENTIALS_FILE=/dev/null
+        CREDS=$(aws sts assume-role-with-web-identity \
+          --role-arn "${OIDC_ROLE_ARN}" \
+          --role-session-name seed-presign-mobile-models \
+          --web-identity-token "${JWT}" \
+          --duration-seconds 7200 \
+          --region "${STS_REGION}" \
+          --output json)
+        echo "${CREDS}" | jq '{Version:1, AccessKeyId:.Credentials.AccessKeyId, SecretAccessKey:.Credentials.SecretAccessKey, SessionToken:.Credentials.SessionToken, Expiration:.Credentials.Expiration}'
+        HELPER
+        chmod +x "${CRED_HELPER}"
+
+        AWS_CONFIG_FILE="${RUNNER_TEMP}/aws-config-seed"
+        cat > "${AWS_CONFIG_FILE}" <<CONFIG
+        [profile seed]
+        credential_process = ${CRED_HELPER}
+        CONFIG
+
+        {
+          echo "AWS_CONFIG_FILE=${AWS_CONFIG_FILE}"
+          echo "AWS_PROFILE=seed"
+          echo "OIDC_ROLE_ARN=${OIDC_ROLE_ARN}"
+          echo "STS_REGION=${STS_REGION}"
+        } >> "$GITHUB_ENV"
+
+    - name: Seed missing models + presign
+      shell: bash
+      env:
+        MANIFEST_PATH: ${{ inputs.manifest-path }}
+        S3_BUCKET: ${{ inputs.s3-bucket }}
+        S3_PREFIX: ${{ inputs.s3-prefix }}
+        AWS_REGION: ${{ inputs.aws-region }}
+        OUTPUT_MAP: ${{ inputs.output-map }}
+        MODEL_NAMES: ${{ inputs.model-names }}
+        EXPIRES_IN: ${{ inputs.expires-in }}
+        HF_TOKEN: ${{ inputs.hf-token }}
+        MODE: ${{ inputs.mode }}
+      run: |
+        set -euo pipefail
+        unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
+        node "$GITHUB_ACTION_PATH/seed-and-presign.mjs"
+
+    # The presigned URLs carry bearer credentials and this repo is public, so
+    # register each with the runner so it is redacted wherever the workflow would
+    # otherwise echo it (e.g. the prestage block / manifest, step inputs). Masking
+    # only covers this job's log stream; the Device Farm artifact half is scrubbed
+    # separately in collect-and-upload-logs.
+    - name: Mask presigned URLs in the runner log
+      if: inputs.mode != 'seed'
+      shell: bash
+      env:
+        OUTPUT_MAP: ${{ inputs.output-map }}
+      run: |
+        set -euo pipefail
+        node -e '
+          const fs = require("fs")
+          const map = JSON.parse(fs.readFileSync(process.env.OUTPUT_MAP, "utf8"))
+          for (const url of Object.values(map)) {
+            if (typeof url === "string" && url) console.log("::add-mask::" + url)
+          }
+        '
@@ -0,0 +1,48 @@
+'use strict'
+// Prepend the US-bucket presigned URL to each model's urls[] in diffusion's
+// on-device manifest before the app is built, keeping the original source(s) as
+// fallbacks. sha256/bytes pins are untouched, so integrity checks are unchanged.
+import { readFileSync, writeFileSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+
+function env(name) {
+  const v = process.env[name]
+  if (!v) throw new Error(`[rewrite] required env ${name} is not set`)
+  return v
+}
+
+// Prepend each presigned URL to the matching model's urls[], keeping the
+// original source(s) as ordered fallbacks and leaving sha256/bytes pins intact.
+// Returns the number of models repointed. Mutates `manifest` in place.
+function rewriteManifest(manifest, map) {
+  if (!manifest || !manifest.models) {
+    throw new Error('[rewrite] manifest has no models object')
+  }
+
+  let rewritten = 0
+  for (const [name, presignedUrl] of Object.entries(map)) {
+    const entry = manifest.models[name]
+    if (!entry) {
+      console.log(`[rewrite] ${name}: not in manifest, skipping`)
+      continue
+    }
+    const existing = Array.isArray(entry.urls) ? entry.urls : []
+    const fallbacks = existing.filter((u) => u !== presignedUrl)
+    entry.urls = [presignedUrl, ...fallbacks]
+    rewritten++
+  }
+  return rewritten
+}
+
+function main() {
+  const manifestPath = env('MANIFEST_PATH')
+  const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'))
+  const map = JSON.parse(readFileSync(env('URL_MAP'), 'utf8'))
+  const rewritten = rewriteManifest(manifest, map)
+  writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n')
+  console.log(`[rewrite] ${rewritten} model URL(s) repointed to US bucket in ${manifestPath}`)
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1]).href) main()
+
+export { rewriteManifest }