K2GO-377 chore(rootfs): name the built artifacts k2go_, and sweep the old ones once

The rootfs images carried the iiab-oa_ prefix from the upstream project. They are the product's
own artifacts, so they take its name; the stable pointers keep theirs, since
latest_<tier>_<arch>.meta4/.installed never carried a product prefix. The app is unaffected: it
asks for the pointer and takes the file name and URL from inside the metalink, so it never builds
the artifact name itself.

The publish loop and the retention prune move to k2go_ together — a prune left filtering the old
prefix would let the new artifacts pile up at ~1.7 GB each while still eating the old ones.

A transitional sweep clears the pre-rename artifacts in full instead of ageing them out seven deep,
and is marked for removal before merge: run the workflow from this branch to migrate the bucket,
confirm no iiab-oa_ keys remain, then delete the block so it does not outlive its purpose.

ROOTFS_PUBLIC_BASE comes along from K2GO-90: on main it still defaults to a path-based route that
was never created, so a migration build run without it would republish metalinks pointing at 404.

Author: luisguzman-adfa

.github/workflows/bake-rootfs.yml

@@ -26,9 +26,13 @@ on:
 env:
   BUCKET_NAME: k2go-rootfs
   R2_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
-  # Public base that goes into the .meta4 <url>. Path-based route
-  # k2go-download.appdevforall.org/rootfs/* -> k2go-rootfs.
-  ROOTFS_PUBLIC_BASE: ${{ vars.ROOTFS_PUBLIC_BASE || 'https://k2go-download.appdevforall.org/rootfs' }}
+  # Public base that goes into the .meta4 <url> — where the APK actually downloads the
+  # rootfs FROM, so it has to name the bucket that holds it. The two buckets are separate
+  # and so are their names: k2go-download.appdevforall.org serves the APK repo only.
+  # K2GO-90: this defaulted to k2go-download.appdevforall.org/rootfs, a path-based route that
+  # was never created. The metalinks published with it resolved to 404 — and since
+  # --reset-mirrors leaves a single source, there was nothing to fall back to.
+  ROOTFS_PUBLIC_BASE: ${{ vars.ROOTFS_PUBLIC_BASE || 'https://pub-d64c885cef6c42db8c7925144d73d0ee.r2.dev' }}
   # Key prefix inside the bucket. Empty when the route strips /rootfs/ (keys at root);
   # set to 'rootfs/' if the route keeps the prefix.
   R2_KEY_PREFIX: ${{ vars.ROOTFS_KEY_PREFIX }}
@@ -133,7 +137,7 @@ jobs:
 
           # 1) Big artifacts FIRST (data before any pointer that resolves to them).
           shopt -s nullglob
-          for f in iiab-oa_*.tar.gz; do
+          for f in k2go_*.tar.gz; do
             echo ">> upload artifact $f"
             aws s3 cp "$f" "s3://${BUCKET_NAME}/${PFX}${f}" --endpoint-url "$ENDPOINT"
           done
@@ -157,12 +161,12 @@ jobs:
 
           # 4) Prune: keep only the newest $KEEP batches per (tier,arch); delete older + sidecars.
           #    Only the heavy dated tarballs accumulate (they carry <date>_<sha>); logs and the
-          #    TSV overwrite in place, so they never pile up. The prefix filter matches iiab-oa_*
+          #    TSV overwrite in place, so they never pile up. The prefix filter matches k2go_*
           #    only, so proot-distro-v*/ is never touched.
           for meta in latest_*_"${ARCH}".meta4; do
             base="${meta%.meta4}"; te="${base#latest_}"; tier="${te%_${ARCH}}"
             mapfile -t keys < <(aws s3api list-objects-v2 --bucket "$BUCKET_NAME" \
-              --prefix "${PFX}iiab-oa_" --endpoint-url "$ENDPOINT" \
+              --prefix "${PFX}k2go_" --endpoint-url "$ENDPOINT" \
               --query "sort_by(Contents,&LastModified)[?contains(Key,'_${tier}_') && ends_with(Key,'_${ARCH}.tar.gz')].Key" \
               --output text | tr '\t' '\n' | sed '/^$/d')
             n=${#keys[@]}
@@ -174,4 +178,26 @@ jobs:
                 done
               done
             fi
+
+            # K2GO-377 (TRANSITIONAL — remove before merging). The retention above keeps the
+            # newest $KEEP k2go_ batches; the pre-rename iiab-oa_ artifacts have no pointer left
+            # once this tier republished, so they go in full rather than ageing out $KEEP deep at
+            # ~1.7 GB each. It sits INSIDE this loop on purpose: it only ever touches the tier and
+            # arch this job just republished, so a tier that failed to build keeps the artifact its
+            # metalink still names.
+            #
+            # Removal is gated on evidence, not on this run finishing. Delete the block only when
+            #   aws s3api list-objects-v2 --bucket "$BUCKET_NAME" --prefix "iiab-oa_" \
+            #     --endpoint-url "$ENDPOINT" --query "length(Contents)" --output text
+            # reports None/0 — otherwise the leftovers outlive the only code that would clear them.
+            mapfile -t legacy < <(aws s3api list-objects-v2 --bucket "$BUCKET_NAME" \
+              --prefix "${PFX}iiab-oa_" --endpoint-url "$ENDPOINT" \
+              --query "Contents[?contains(Key,'_${tier}_') && ends_with(Key,'_${ARCH}.tar.gz')].Key" \
+              --output text | tr '\t' '\n' | sed '/^$/d')
+            for key in "${legacy[@]}"; do
+              echo ">> sweep legacy $key (+ sidecars)"
+              for ext in '' .meta4 .sha256 .installed .torrent; do
+                aws s3 rm "s3://${BUCKET_NAME}/${key}${ext}" --endpoint-url "$ENDPOINT" || true
+              done
+            done
           done

tools/rootfs-builder/build-iiab-rootfs.sh

@@ -22,8 +22,8 @@
 # branch (git ls-remote, then the REST API). --iiab-commit overrides everything.
 #
 # Output:
-#   - iiab-oa_<date>_<tier>_<iiab-sha>_<arch>.tar.gz   (top-level = installed-rootfs/iiab/)
-#   - iiab-oa_<...>.tar.gz.meta4 / .torrent            (per-artifact, mkmetalink)
+#   - k2go_<date>_<tier>_<iiab-sha>_<arch>.tar.gz      (top-level = installed-rootfs/iiab/)
+#   - k2go_<...>.tar.gz.meta4 / .torrent               (per-artifact, mkmetalink)
 #   - latest_<tier>_<arch>.meta4   (STABLE pointer the APK requests; a copy of the
 #     per-artifact .meta4. Inside it, <url> mirrors point at the full-named tarball,
 #     so this stable name always resolves to the newest build.)
@@ -744,7 +744,9 @@ fi
 [[ -n "$IIAB_SHA" ]] || die "Could not determine the iiab/iiab commit id. Pass --iiab-commit <sha>."
 log "iiab/iiab id: ${IIAB_SHA}  [source: ${IIAB_SRC}]"
 
-ARTIFACT="iiab-oa_${STAMP}_${TIER_NAME}_${IIAB_SHA}_${ARCH}.tar.gz"
+# K2GO-377: the artifacts carry the product name. The stable pointers do not change —
+# latest_<tier>_<arch>.meta4/.installed never carried a product prefix.
+ARTIFACT="k2go_${STAMP}_${TIER_NAME}_${IIAB_SHA}_${ARCH}.tar.gz"
 META4="latest_${TIER_NAME}_${ARCH}.meta4"
 INSTALLED="latest_${TIER_NAME}_${ARCH}.installed"   # ADFA-5110: stable uncompressed-size sidecar