ci(repo): add the cli-artifacts S3 bucket and publisher role stack

[avallete]

Summary

Infrastructure for the public-read S3 mirror of slim native artifacts, in the dedicated cli-artifacts-prod AWS account (created in supabase/aws-org-root). The CLI will fall back to this host where registry blob CDNs and GitHub release assets are blocked, for example in agent sandboxes that allow *.amazonaws.com. This PR is infrastructure only; the upload job in the mirror workflow and the CLI-side candidate follow in separate PRs.

infra/cli-artifacts/template.yaml (CloudFormation):

• Bucket supabase-cli-artifacts: anonymous GetObject through the bucket policy, TLS required, no ListBucket, ACL-based public access blocked, SSE-S3, versioning with 30-day noncurrent expiry and abort of stale multipart uploads. Retained on stack delete or replace.
• Role slim-artifacts-publisher: trusts the account's GitHub OIDC provider for exactly repo:supabase/cli:ref:refs/heads/develop and can do nothing but s3:PutObject and s3:AbortMultipartUpload on the bucket's objects.

.github/workflows/cli-artifacts-infra.yml: runs cfn-lint on pull requests that touch this directory or the workflow, and deploys the stack on pushes to develop with the account's github-deploy role, passing the bucket name and trusted subject explicitly. Pull requests never touch AWS, because only develop can assume that role. The deploy job is skipped until the CLI_ARTIFACTS_AWS_ACCOUNT_ID repository variable exists, clears a stack left in ROLLBACK_COMPLETE by a failed first create, and prints failed stack events on error. The workflow file is placed under CLI maintainer ownership in CODEOWNERS.

Object layout, kept identical to the GitHub release asset names so checksum files match without rewriting:

https://supabase-cli-artifacts.s3.us-east-1.amazonaws.com/<service>/<version>/<service>-<version>-<target>.tar.zst
https://supabase-cli-artifacts.s3.us-east-1.amazonaws.com/<service>/<version>/<service>-<version>-<target>.manifest.json
https://supabase-cli-artifacts.s3.us-east-1.amazonaws.com/<service>/<version>/<service>-<version>-<target>.SHA256SUMS

Linked issue

Tracked in Linear (CLI-2451); no GitHub issue.

• The linked issue is open and carries the open-for-contribution label (or I'm a Supabase maintainer).

Checklist

• The PR title follows Conventional Commits (e.g. fix(cli): …).
• Tests added or updated for the change. Not applicable: CloudFormation template and workflow only; the template is linted by cfn-lint in the new workflow.
• From the repository root, pnpm check:all passes; relevant package tests pass for every touched workspace, and pnpm types:check passes for each touched TypeScript workspace (or workspace declaring it). No TypeScript workspace is touched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PeXSyQtKtGuwrdNW7uVKom

[github-actions]

🤖 AI Review

Both independent reviews completed. Their 11 reports merge into 10 unique findings, all confirmed after reading the cited code; the dotted-bucket finding was raised by both reviewers. No critical or major issues were found.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	.github/workflows/cli-artifacts-infra.yml:69	infrastructure	claude	The deployment automation cannot apply a changed TrustedSubject value to an existing stack because it supplies no parameter overrides.
🟡 MINOR	infra/cli-artifacts/template.yaml:86	security	claude	TrustedSubject is unrestricted and evaluated with wildcard-aware StringLike even though the documented value is intended to identify one exact branch.
🟡 MINOR	infra/cli-artifacts/template.yaml:18	infrastructure	claude	The artifact bucket lacks retention policies, so stack deletion or bucket replacement can fail when published objects remain.
🟡 MINOR	infra/cli-artifacts/template.yaml:88	infrastructure	claude	The publisher cannot abort failed multipart uploads because its object policy grants only s3:PutObject.
🟡 MINOR	.github/workflows/cli-artifacts-infra.yml:23	ci	claude	All pull-request lint runs and deployments share one concurrency group, allowing a newly queued run to cancel another pull request's pending check.
🟡 MINOR	infra/cli-artifacts/template.yaml:54	cost	claude	The stack exposes every object directly for anonymous S3 downloads without adding monitoring or mitigation for attacker-driven request and egress costs.
🟡 MINOR	infra/cli-artifacts/template.yaml:11	input-validation	claude+codex	BucketName accepts dotted names that are incompatible with the template's virtual-hosted HTTPS URL and also accepts some S3-invalid dot/hyphen combinations.
🟡 MINOR	.github/CODEOWNERS:6	security	claude	The new account-admin deployment workflow remains ownerless under CODEOWNERS and therefore is not specifically gated on CLI-team review.
⚪ NIT	.github/workflows/cli-artifacts-infra.yml:75	ci	claude	The Show stack outputs multiline shell block omits the explicit strict-mode declaration used by the workflow's other multiline shell blocks.
⚪ NIT	infra/cli-artifacts/README.md:31	documentation	claude	The README incorrectly says linting runs on every pull request even though the workflow is path-filtered.

Findings outside the diff

• 🟡 MINOR .github/CODEOWNERS:6 — The new account-admin deployment workflow remains ownerless under CODEOWNERS and therefore is not specifically gated on CLI-team review.

Stats

Claude findings: 10 · Codex findings: 1 · Confirmed: 10 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.