…ck, remove --acl

Three follow-up corrections to PR #17:

1. Remove `--acl public-read` from `aws s3 cp`.
   The bucket has `disable_confusing_acls = true` (BucketOwnerEnforced), which
   disables ACLs entirely. `BlockPublicAcls` + `IgnorePublicAcls` provide
   additional coverage. The ACL flag is silently ignored. The IAM role
   (`S3_ACCESS_MODE.PUT`) also doesn't grant `PutObjectAcl`. Reads go via
   CloudFront OAC, not public-S3.

2. Replace `softprops/action-gh-release` with GitHub's first-party `gh` CLI.
   `gh release upload` is pre-installed on GitHub-hosted runners, removes a
   third-party (single-maintainer) supply-chain dependency, and behaves
   equivalently with `--clobber`.

3. Add a post-upload CloudFront reachability check (`curl -fI`).
   If the CloudFront path_patterns allowlist doesn't include the key's prefix,
   Mac Bazel builds will silently 403. Failing the workflow here surfaces the
   issue before consumers hit it.

S3 path stays `node-gyp/*` (this PR no longer changes it — see codez PR #390222
which adds `node-gyp/*` to CloudFront's path_patterns in system_packages.tf).

Action pinning: tag-pinned per codez convention (100% of codez workflows use
tags, not SHAs).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ck, remove --acl (#18)

* workflows: swap softprops for gh CLI, add CloudFront reachability check, remove --acl

Three follow-up corrections to PR #17:

1. Remove `--acl public-read` from `aws s3 cp`.
   The bucket has `disable_confusing_acls = true` (BucketOwnerEnforced), which
   disables ACLs entirely. `BlockPublicAcls` + `IgnorePublicAcls` provide
   additional coverage. The ACL flag is silently ignored. The IAM role
   (`S3_ACCESS_MODE.PUT`) also doesn't grant `PutObjectAcl`. Reads go via
   CloudFront OAC, not public-S3.

2. Replace `softprops/action-gh-release` with GitHub's first-party `gh` CLI.
   `gh release upload` is pre-installed on GitHub-hosted runners, removes a
   third-party (single-maintainer) supply-chain dependency, and behaves
   equivalently with `--clobber`.

3. Add a post-upload CloudFront reachability check (`curl -fI`).
   If the CloudFront path_patterns allowlist doesn't include the key's prefix,
   Mac Bazel builds will silently 403. Failing the workflow here surfaces the
   issue before consumers hit it.

S3 path stays `node-gyp/*` (this PR no longer changes it — see codez PR #390222
which adds `node-gyp/*` to CloudFront's path_patterns in system_packages.tf).

Action pinning: tag-pinned per codez convention (100% of codez workflows use
tags, not SHAs).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Update .github/workflows/build-node-packages.yml

Co-authored-by: Eli Skeggs <1348991+skeggse@users.noreply.github.com>

* workflows: hoist matrix values to job-level env, drop expression substitution in run: blocks

Eli's review flagged `${{ matrix.arch }}` in a run: block as an injectable
pattern even though the matrix values are hardcoded and not truly exploitable.
Apply the pattern consistently across the whole workflow:

- Hoist PLATFORM, ARCH, BAZEL_ARCH, REPO to job-level env so each step can
  reference them as shell variables ($ARCH etc.) rather than GitHub Actions
  expressions (${{ matrix.arch }}). Job-level env evaluates matrix context
  since the job is instantiated per matrix combination, so this DRYs up the
  per-step env blocks.
- Rewrite every `run:` block to reference the job-level env vars. No more
  `${{ ... }}` expressions inside shell scripts.
- Secret references (GITHUB_TOKEN) remain step-scoped per least-privilege.
- Minor cleanup: collapse three separate `echo ... >> $GITHUB_ENV` lines into
  a single `{ ...; } >> "$GITHUB_ENV"` block.

Addresses Eli's inline comment on line 114 of the pre-hoist file.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Harshita Gupta <harshita-gupta@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Eli Skeggs <1348991+skeggse@users.noreply.github.com>