From 9d61a65df84115ff6a890516d65ea91530df793d Mon Sep 17 00:00:00 2001
From: Trevor Bramwell <tbramwell@linuxfoundation.org>
Date: Thu, 6 Aug 2026 13:17:53 -0700
Subject: [PATCH 1/2] CI: Bump retired artifact actions, guard deploy dispatch

upload/download-artifact v2/v3 are retired and now hard-fail before
any step runs (confirmed on PR #8), so publish.yml has not produced
a new ghcr.io/linuxfoundation/traefik:latest since May 2024. Bump to
current majors, gate the lfx-gateway deploy dispatch to the
aws-lambda-v2.11 ref so test pushes can't trigger prod deploys, and
make the dispatch curl fail loudly instead of silently swallowing a
401. Needed so the awslambda query-param fix (#8) can actually ship.

Signed-off-by: Trevor Bramwell <tbramwell@linuxfoundation.org>
---
 .github/workflows/build.yaml  |  4 ++--
 .github/workflows/publish.yml | 16 ++++++++++------
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index b0c36ebe818..69284f36182 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -26,7 +26,7 @@ jobs:
           tar czvf webui.tar.gz ./webui/static/
 
       - name: Artifact webui
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v7
         with:
           name: webui.tar.gz
           path: webui.tar.gz
@@ -51,7 +51,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Artifact webui
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v8
         with:
           name: webui.tar.gz
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f8327d94c33..76cc2ea4d99 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,14 +6,16 @@ on:
     branches:
       - master
       - aws-lambda-v2.11
+      - ci/fix-publish-workflow
       - v*
+  workflow_dispatch:
 
 jobs:
   build-webui:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Build webui
@@ -21,7 +23,7 @@ jobs:
           make clean-webui generate-webui
           tar czvf webui.tar.gz ./webui/static/
       - name: Artifact webui
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v7
         with:
           name: webui.tar.gz
           path: webui.tar.gz
@@ -39,13 +41,13 @@ jobs:
       - build-webui
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: '1.21'
       - name: Artifact webui
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v8
         with:
           name: webui.tar.gz
       - name: Untar webui
@@ -85,7 +87,7 @@ jobs:
   trigger-deploy:
     name: Trigger New Deployment
     runs-on: ubuntu-latest
-    if: github.repository == 'linuxfoundation/traefik'
+    if: github.repository == 'linuxfoundation/traefik' && github.ref == 'refs/heads/aws-lambda-v2.11'
     needs:
       - publish
     steps:
@@ -96,6 +98,8 @@ jobs:
           event_type=container_published
 
           curl -L \
+            --fail-with-body \
+            -sS \
             -X POST \
             -H "Accept: application/vnd.github+json" \
             -H "Authorization: Bearer ${{ secrets.PERSONAL_ACCESS_TOKEN }}" \

From 624df954f55797d84d0c6025fc3c4d5053429a83 Mon Sep 17 00:00:00 2001
From: Trevor Bramwell <tbramwell@linuxfoundation.org>
Date: Thu, 6 Aug 2026 13:43:22 -0700
Subject: [PATCH 2/2] CI: Drop scratch branch from publish trigger

Push-triggered workflows only evaluate against branches already
known to a prior push; a throwaway branch can't self-register by
adding its own name to on.push.branches in the same commit. Remove
it, verification has to happen against aws-lambda-v2.11 itself.

Signed-off-by: Trevor Bramwell <tbramwell@linuxfoundation.org>
---
 .github/workflows/publish.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 76cc2ea4d99..6f010db58b3 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,7 +6,6 @@ on:
     branches:
       - master
       - aws-lambda-v2.11
-      - ci/fix-publish-workflow
       - v*
   workflow_dispatch: