ci(core): use s5cmd for UI fixtures upload
What the developer wrote
Authored by Roman Zeyde
ci(core): use s5cmd for UI fixtures upload
Our S3 bucket is at `eu-central-1`.
[no changelog]
What changed, and why it matters
This commit changes how the project uploads automated test screenshots and recordings to Amazon S3. It switches from the standard AWS command-line tool to a faster third-party tool called s5cmd, and updates the AWS region from Ireland (eu-west-1) to Frankfurt (eu-central-1) to match where the S3 bucket actually is. There is no user-facing firmware change and no indication of a security vulnerability.
No security action required. This is a routine CI optimization. As with any tooling change, monitor CI runs for upload failures or permission issues after deployment.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies a GitHub Actions workflow (.github/actions/ui-report/action.yml) and the Nix shell environment (shell.nix). It replaces aws s3 cp calls with s5cmd cp, increases upload concurrency from 50 to 100, removes the --no-overwrite flag, and changes the configured AWS region to eu-central-1. The s5cmd package is added to the development shell. These are CI/infrastructure tooling changes only.
Changed components
.github/actions/ui-report/action.ymlshell.nixInspect captured patch +9 / −7
diff --git a/.github/actions/ui-report/action.yml b/.github/actions/ui-report/action.yml
index b92ecec2..cd296592 100644
--- a/.github/actions/ui-report/action.yml
+++ b/.github/actions/ui-report/action.yml
@@ -18,10 +18,7 @@ runs:
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # aws-actions/configure-aws-credentials@v6.0.0
with:
role-to-assume: arn:aws:iam::538326561891:role/gh_actions_deploy_dev_firmware_data
- aws-region: eu-west-1
- - name: Increase AWS S3 max concurrency for faster uploads
- run: aws configure set default.s3.max_concurrent_requests 50
- shell: sh
+ aws-region: eu-central-1
- run: |
MODELJOB=${{ inputs.model }}-${{ inputs.lang }}-${{ github.job }}
OUTDIR=${{ github.run_id }}
@@ -50,15 +47,19 @@ runs:
shell: sh
- name: Upload test results
run: |
+ # Cache s5cmd package (to be reused by the next calls)
+ nix-shell --run "s5cmd version"
+
+ CMD="s5cmd --log error cp --concurrency 100"
+
# Upload report
du -sh ${{ github.run_id }}
- ls -l ${{ github.run_id }}
- aws s3 cp --no-overwrite --recursive --only-show-errors ${{ github.run_id }} s3://data.trezor.io/dev/firmware/ui_report/${{ github.run_id }} &
+ nix-shell --run "$CMD ${{ github.run_id }}/ s3://data.trezor.io/dev/firmware/ui_report/${{ github.run_id }}/" &
PID1=$!
# Upload test screen recording
du -sh ci/ui_test_records
- aws s3 cp --no-overwrite --recursive --only-show-errors ci/ui_test_records s3://data.trezor.io/dev/firmware/ui_tests &
+ nix-shell --run "$CMD ci/ui_test_records/ s3://data.trezor.io/dev/firmware/ui_tests/" &
PID2=$!
# TODO: generate directory listing / autoindex
diff --git a/shell.nix b/shell.nix
index b0cf3e68..9f21676b 100644
--- a/shell.nix
+++ b/shell.nix
@@ -108,6 +108,7 @@ stdenvNoCC.mkDerivation ({
pyright
python3
(mkBinOnlyWrapper rustNightly)
+ s5cmd
sccache
uv
wget
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.