[GHA] Upload installer README to S3 when modified

[Copilot]

Upload installer README to AWS S3 when modified

Summary

This PR updates the .github/workflows/installer.yml workflow to automatically upload installer/README.pdf to s3://software.thecombine.app when installer/README.md changes on push to master.

Changes Made

• Added robust git diff check to detect changes to installer/README.md
  • Handles push events using github.event.before
  • Handles pull requests by comparing against base branch
  • Handles edge cases (initial commits, missing refs)
• Added AWS credentials configuration step (conditional on README change and push event)
• Added S3 upload step to upload README.pdf to s3://software.thecombine.app with proper content-type
• Updated harden-runner allowed endpoints to include S3 and STS endpoints
• Set fetch-depth: 2 for minimal history needed to compare changes

Implementation Details

The change detection logic handles multiple scenarios:

- name: Detect changes to installer README
  id: changed-files
  run: |
    # For pushes, use the before commit from the event; fallback to HEAD~1
    # For PRs, compare against the base branch
    if [ "${{ github.event_name }}" = "pull_request" ]; then
      COMPARE_REF="origin/${{ github.base_ref }}"
    else
      COMPARE_REF="${{ github.event.before }}"
      if [ -z "$COMPARE_REF" ] || [ "$COMPARE_REF" = "0000000000000000000000000000000000000000" ]; then
        COMPARE_REF="HEAD~1"
      fi
    fi
    if git diff --name-only "$COMPARE_REF" HEAD 2>/dev/null | grep -q "^installer/README.md$"; then
      echo "changed=true" >> $GITHUB_OUTPUT
    else
      echo "changed=false" >> $GITHUB_OUTPUT
    fi

The upload steps only run when:

1. The event is a push (not a pull request)
2. The installer/README.md file has been modified

Security Summary

No security vulnerabilities detected by CodeQL analysis.

Fixes #4025

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

---

This change is 

[imnasnainaec]

@copilot

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.58%. Comparing base (f63122e) to head (cc714a1).
⚠️ Report is 33 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4028   +/-   ##
=======================================
  Coverage   74.58%   74.58%           
=======================================
  Files         293      293           
  Lines       10817    10817           
  Branches     1353     1353           
=======================================
  Hits         8068     8068           
  Misses       2354     2354           
  Partials      395      395           

Flag	Coverage Δ
backend	85.45% <ø> (ø)
frontend	66.23% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[imnasnainaec]

@imnasnainaec reviewed 2 of 2 files at r2, all commit messages.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on @copilot)

[Copilot]

Pull Request Overview

This PR adds automatic S3 upload functionality to the installer workflow to upload the installer README PDF to s3://software.thecombine.app when installer/README.md is modified on push to master. It also includes minor formatting improvements to the README text.

Key Changes

• Added git-based file change detection to identify modifications to installer/README.md
• Integrated conditional AWS credential configuration and S3 upload steps into the existing make_readme job
• Updated harden-runner allowed endpoints to include S3 and STS services for AWS access

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
.github/workflows/installer.yml	Added file change detection step, AWS credentials configuration, and S3 upload logic with fetch-depth 2 for git diff support; updated harden-runner endpoints
installer/README.md	Minor formatting improvements: rewrapped text for the Skype note and added a comma in the "Connecting to The Combine" section

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jasonleenaylor]

.github/workflows/installer.yml line 96 at r4 (raw file):

          fetch-depth: 2
      - name: Detect changes to installer README
        id: changed-files

an id of changed-readme adds clarity to the later usage.

[imnasnainaec]

@imnasnainaec reviewed 1 of 1 files at r5, all commit messages.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on @copilot)

[jasonleenaylor]

@jasonleenaylor reviewed 1 of 2 files at r2, 1 of 1 files at r5, all commit messages.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on @copilot)