EFF-474: Purge imgix after uploading graphics

[tashian]

The bug

Graphics changes have not been reaching readers, which is why uploading them by hand in the AWS console became a habit.

The site serves graphics through imgix (smallstep.imgix.net), backed by the CMS images S3 bucket. imgix caches origin objects and does not notice when an object is replaced under the same key — its own docs say to change storage first, then purge. The source is configured Respect origin with a 30-day default TTL, and nothing set a Cache-Control header, so every graphic falls through to 30 days. No imgix purge has ever run.

The fix

A purge step, driven from the same git diff as the upload so the two lists cannot drift.

Verification compares imgix's Last-Modified against the S3 object's own timestamp, not byte size. imgix rewrites SVGs on serve — strips the Illustrator generator comment, rewrites the encoding declaration, reorders attributes — so a correctly purged SVG never matches its origin byte-for-byte. A size check would have warned on all 42 SVGs forever.

Purge returns 200 for "received", not "completed", and imgix guarantees no completion time, so verification is advisory (continue-on-error) and retries in rounds — total wait stays ~50s whether one graphic changed or all 128 did.

Also modernized

The old third-party S3 action is archived-or-stale across the board (jakejarvis/s3-sync-action is archived; shallwefootball/upload-s3-action last saw a commit in June 2024 and is the source of the Node 20 deprecation warnings). AWS publishes no S3 action — the documented pattern is configure-aws-credentials plus the CLI, which is what this does.

• GitHub OIDC instead of the two access keys from August 2023
• Only changed files upload, instead of all 128 on every run
• The role can write only under graphics/* — this bucket is shared with the Strapi CMS
• No s3:DeleteObject: the bucket has no versioning, so deletes are unrecoverable, and the upside was pruning a few unreferenced objects
• workflow_dispatch with dry_run and full_sync inputs

Already provisioned

• Role smallstep-docs-assets-uploader, trust pinned to repo:smallstep/docs:ref:refs/heads/main
• Repo variables AWS_ASSETS_ROLE_ARN, AWS_REGION, AWS_ASSETS_BUCKET
• Repo secret IMGIX_API_KEY

After merge

This PR touches no graphics, so it will not trigger itself. Run workflow_dispatch with dry_run first, then full_sync once to clear the backlog, then confirm entra-id-mappings.png goes live.

Retiring the two 2023 access keys stays for a follow-up, once this is verified green.

Testing

• Changed-file detection verified against the real PRE-168: Update entra id mappings #539 merge and both fallback paths (empty and all-zeros github.event.before) — each yields exactly graphics/entra-id-mappings.png
• shellcheck clean on all four run blocks; YAML parses
• Verify logic confirmed against live imgix: correctly flags entra-id-mappings.png and correctly passes autocert-arch.png

🤖 Generated with Claude Code