ci: delete release-legacy.yml, move upload-to-s3.sh into .circleci/ [IDE-2483]

[rrama]

Final milestone (4 of 4) of IDE-2483 — migrating S3 publishing off static AWS
keys onto CircleCI OIDC. Stacked on #468.

What this PR does (safe to merge from a code-review standpoint)

• Deletes .github/workflows/release-legacy.yml — the GitHub Actions fallback
  kept while the CircleCI stable-release pipeline was unproven. Its function
  is fully replaced by the CircleCI publish-stable job (added in ci: add publish-stable job with CircleCI OIDC, rename release.yml to legacy fallback [IDE-2483] #468).
• Moves .github/upload-to-s3.sh to .circleci/upload-to-s3.sh — nothing
  under .github/ uses it anymore once the legacy workflow is gone.
• Updates the three .circleci/config.yml references to the script's new path
  (build-sign's persist_to_workspace, publish-preview, publish-stable).
• Deletes the "CircleCI unproven, use release-legacy.yml as fallback" migration
  note from RELEASE.md — this PR is that migration.

circleci config validate passes.

Why this is do-not-merge

Merging now would delete the still-actively-used GitHub Actions fallback
before its CircleCI replacement is proven end-to-end. Per the ticket's own
"verify before deactivate, deactivate before delete" ordering, this PR stays
gated until:

Blocker before merge:

1. One real stable release is cut successfully end-to-end through the new
   CircleCI stable-release pipeline (tag, GitHub release with asset, and
   s3://snyk-assets/eclipse/stable/ all confirmed).

(circleci-infra PR #66 formalizes the already-existing
snyk-eclipse-plugin-github-release CircleCI context in Terraform — it
doesn't gate this merge, since the context already works per #468.)

The diff is reviewable now regardless — opening it ready-for-review means
merge is one click the moment the gate lifts, matching #468's own convention.

Post-merge decommissioning runbook (execute in order — do NOT skip steps; each gates the next)

Prerequisite (already gates this PR's merge): at least one real stable
release has been cut successfully through the new CircleCI stable-release
pipeline.

• 1. Merge this PR (deletes release-legacy.yml, moves the S3 upload
  script into .circleci/).
• 2. AWS Console, account 198361731867 → IAM → Users → find the user
  that owns the access key currently populating the GitHub secret
  AWS_ACCESS_KEY_ID. Note the user's name and the access key's ID. Verify
  the key hasn't already been deactivated by someone else.
• 3. In the same IAM Users page, deactivate the access key
  (Security credentials tab → Access keys → three-dot menu → Deactivate).
  Do NOT delete yet — deactivation is reversible; deletion is not.
• 4. Wait ≥1 week OR one more natural stable release cycle, whichever
  comes first. During that window, cut at least one real stable release
  through CircleCI. Confirm it succeeds end-to-end: tag appears, GitHub
  release appears with the ZIP asset, s3://snyk-assets/eclipse/stable/
  has the fresh artifact. This is the "publishing confirmed still
  working" AC step.
  - Rollback if step 4 fails: re-activate the access key (reverse of
  step 3). Investigate why the CircleCI OIDC path failed. Do not
  proceed to step 5 until step 4 has been re-run and passed.
• 5. IAM console: delete the access key.
• 6. IAM console: check the IAM user's permissions and other attached
  policies. If it exists solely to hold this access key for this repo's
  publishing, delete the IAM user too. If it also holds other policies
  or roles used elsewhere, leave the user in place — flag it in the
  ticket comment at step 11.
• 7. GitHub repo settings → Secrets and variables → Actions → delete
  AWS_ACCESS_KEY_ID.
• 8. GitHub repo settings → Secrets and variables → Actions → delete
  AWS_SECRET_ACCESS_KEY.
• 9. GitHub repo settings → Secrets and variables → Actions → delete
  AWS_S3_BUCKET_NAME. Nothing reads it after this PR merges —
  readme-sync.yml (the only other workflow left) only uses GITHUB_TOKEN.
• 10. GitHub repo settings → Secrets and variables → Actions → delete
  KEYSTORE, KEYSTORE_SHA, KEYSTORE_PASS. These are only read by
  release-legacy.yml, which no longer exists after this PR merges.
  CircleCI's build-sign uses same-named variables but sources them from
  the snyk-eclipse-plugin-signing CircleCI context, not from GitHub
  secrets.
• 11. Post a comment on IDE-2483 listing exactly which steps were
  executed and when (dates + IAM key ID + IAM user name if deleted).
  Transition IDE-2483 to Done. Notify #ide Slack channel that the
  decommissioning is complete.

Re-check (after step 11) — run in a fresh clone of main

git grep -n -E 'AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY'
git grep -n 'release-legacy\.yml'
git grep -n 'release\.yml'
git grep -n '\.github/upload-to-s3\.sh'
ls .github/upload-to-s3.sh 2>/dev/null
ls .github/workflows/release-legacy.yml 2>/dev/null

Every command must return zero hits / not exist.

PR stack — merge order

flowchart LR
    main(["main"])
    PR1["#460 build-sign\nCircleCI signing"]
    PR2["#462 publish-preview\nCircleCI OIDC publish"]
    PR3["#463 stable-release scaffold\nworkflow + build-sign-stable"]
    PR4["#468 publish-stable\nOIDC publish"]
    PR5["remove-legacy-release-workflow ← YOU ARE HERE\nDO NOT MERGE"]
    main --> PR1 --> PR2 --> PR3 --> PR4 --> PR5
    style PR5 fill:#ffd700,color:#000

Loading

Depends on: #468

Test plan

• circleci config validate passes
• git grep sweep for release-legacy.yml, AWS_ACCESS_KEY_ID,
  AWS_SECRET_ACCESS_KEY, old .github/upload-to-s3.sh path — zero hits
  repo-wide
• Executable bit preserved on the moved script (mode 100755)
• Real stable release cut through CircleCI (external merge-gate item, not
  verifiable by this PR alone)

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[rrama]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• ci: delete release-legacy.yml, move upload-to-s3.sh into .circleci/ [IDE-2483] #465 👈 (View in Graphite)
• ci: add publish-stable job with CircleCI OIDC, rename release.yml to legacy fallback [IDE-2483] #468
• ci: add stable-release workflow scaffold on CircleCI OIDC [IDE-2483] #463
• ci: move publish-preview job to CircleCI [IDE-2483] #462
• ci: add build-sign job to CircleCI CICD workflow [IDE-2483] #460
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[nick-y-snyk]

The code looks right. The script keeps mode 100755, SCRIPT_DIR/../update-site/... still resolves from .circleci/, and all three path references are updated. Merge stays gated on a real stable release, as the description says.

One gap in the runbook. Steps 7 to 9 don't delete the AWS_S3_BUCKET_NAME GitHub secret. After this PR nothing reads it (readme-sync.yml only uses GITHUB_TOKEN), so it should go with the others.

Nits:

• Blocker 1 waits on circleci-infra#66, but #468 says the snyk-eclipse-plugin-github-release context already exists. #66 only brings it under Terraform, so it doesn't gate this merge.
• The re-check commands exclude :!.local/, but the repo has no .local/ directory. It looks like it came from a local setup and can be dropped.

[rrama]

One gap in the runbook. Steps 7 to 9 don't delete the AWS_S3_BUCKET_NAME GitHub secret. After this PR nothing reads it (readme-sync.yml only uses GITHUB_TOKEN), so it should go with the others.

Added.

Blocker 1 waits on circleci-infra#66, but #468 says the snyk-eclipse-plugin-github-release context already exists. #66 only brings it under Terraform, so it doesn't gate this merge.

Forgot to update the description, done now.

The re-check commands exclude :!.local/, but the repo has no .local/ directory. It looks like it came from a local setup and can be dropped.

My local AI being silly, removed.

[nick-y-snyk]

Code looks good. Merge stays gated on a real stable release through CircleCI, as the label says.