fix(ci): build MinIO from pinned release assets

[wesbillman]

Summary

Unblocks the main CI integration jobs that fail before tests while pulling MinIO from Quay (release candidate failure). Both image repositories return unauthorized; the official GitHub Release binaries remain downloadable and match their published SHA-256 checksums.

• Build a CI-only AMD64 image from the same MinIO RELEASE.2025-09-07T16-13-09Z and mc RELEASE.2025-08-13T08-35-41Z binaries, each pinned by checksum, on a digest-pinned Alpine base.
• Layer a small Compose override onto the existing services. Each of the three isolated integration jobs builds its own image before starting services. Preserve existing health checks, credentials, bucket setup and test selection.
• Cover the new source paths and per-job provisioning/order in existing CI regression contracts. No registry publication, backend replacement, skipped tests, or deployment-default changes.

Related: #7599 previously switched the images to Quay; no open duplicate repair found in MinIO/Quay/image-pull searches. Repairs CI blocking #7867.

Validation

At 6a203eb837f021091f170b0bbdd9b17e01ed9abf:

• All 14 real pinned dorny/paths-filter regression cases passed.
• Required-context isolation contract and actionlint for both changed workflows passed.
• Commit/push hooks passed without bypass.

Before commit, on the identical Dockerfile/Compose content:

• Downloaded the two official AMD64 binaries and independently verified published SHA-256 checksums; Docker build also verifies hard-coded checksums.
• Built the AMD64 image and ran it under local Docker emulation in an isolated stack derived from the merged service definitions (only resource names/ports isolated).
• Existing health check passed; initializer exited 0; object upload/read/compare/delete passed; bucket remained private and anonymous GET returned 403. Removed temporary containers, network and volume.
• Removing the relay-e2e build step caused the added wiring contract to fail.
• Independent review found a missing script-mediated consumer; fixed it, added the regression, and received a clean re-review.

Broad application suites/full just ci were not rerun locally for this CI-only repair. Hosted CI remains the merge gate; this is not a release-readiness certification.

Scope and release follow-up

After this lands on main, regenerate the existing 0.5.25 candidate with just release-desktop 0.5.25 from clean current main, then review its new ledger/head and fresh checks. Do not append this fix to the frozen version-only candidate. Regeneration also includes changes that have since landed on main, including #7559.

Development/deployment MinIO defaults and the separate mesh-lifecycle.yml workflow still use upstream images. They are intentionally not repaired here. This is an AMD64 main-CI workaround, not a replacement deployment image or complete MinIO distribution solution.

Originating conversation: buzz://message?channel=3428ec3f-a58b-429b-afbc-dc6a77918ce8&id=84bdffac6b355515d2d9e597b0adec6aa626b20ab820f0984458862a8a6f8ab7

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 4544ba1713d8d7f5959d7d63886ff3927357e1ac...6a203eb837f021091f170b0bbdd9b17e01ed9abf.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 6a203eb837f021091f170b0bbdd9b17e01ed9abf to authorize a new review.
Any previous review applies only to its recorded range.

[jedwards27]

:bot: Jude’s code review agent

APPROVE at exact head 6a203eb837f021091f170b0bbdd9b17e01ed9abf.

No unresolved author-actionable defect was found across the integrated systems, supply-chain, Compose, CI-selection, and product/adversarial review.

Evidence:

• .github/ci/minio/Dockerfile binds the CI image to a digest-pinned Alpine base and checksum-pinned, versioned AMD64 MinIO and mc release assets. Independent downloads matched both declared SHA-256 values and identified as x86-64 ELF executables.
• docker-compose.ci.yml uses one local image for minio and minio-init, fixes the platform to linux/amd64, and prevents registry fallback with pull_policy: never. docker compose config preserved the base command, health check, credentials, network, volume, ports, initializer, and private-bucket setup.
• Each isolated consumer selects the override and builds before startup: Desktop E2E Integration shards, Backend Integration, and Relay E2E. Relay E2E continues through real media upload/read-auth behavior rather than stopping at container health.
• The required-context isolation contract passed at this clean exact head; mutation checks from both independent lanes demonstrated that removing a per-job build step makes the contract fail. git diff --check was clean. Exact-head Detect Changed Paths, DCO, security, Desktop Release Candidate, Rust lint, and cross-compile checks observed so far passed.

Confidence gaps — not author rework:

• Reviewer environments had no local Docker daemon, so they validated the fully merged Compose model but did not independently build/start the image. Author action: none. Verification owner: exact-head hosted CI, specifically Desktop E2E Integration, Backend Integration (relay e2e), and Relay E2E before merge.
• The local paths-filter fixture requires the pinned external action bundle and was not configured locally. Author action: none. Verification owner: the exact-head Detect Changed Paths gate, which passed.
• apk add --no-cache ca-certificates curl is repository-current rather than byte-pinned. Alpine signatures constrain it, and the executable payloads are checksum-bound; this is acceptable for the stated disposable CI-only image. Author action: none. Verification owner: CI; revisit only if full-image reproducibility becomes policy.

Any new head invalidates this approval.

[wpfleger96]

🤖 Automated review of 6a203eb8 against base 4544ba17. I think main has already superseded this. It no longer merges cleanly, and I don't think resolving the conflicts is the right way forward.

#7869 and #7870 landed the same fix in a different shape. .github/ci/minio/Dockerfile on main pins the same MinIO/mc releases with identical SHA-256 checksums on the same digest-pinned Alpine base. Main publishes the image once to ghcr.io/block/buzz-minio:latest through the path-filtered minio-image.yml, and every consumer pulls it (docker-compose.ci.yml uses pull_policy: always). All three relay jobs already set COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml, and #7870 also covers mesh-lifecycle.yml and the Helm quickstart values.

This branch conflicts with main in Dockerfile, docker-compose.ci.yml, ci.yml and ci-selection.test.mjs. If the conflicts were resolved toward this branch, CI would go back to per-job local builds (image: buzz-ci-minio:local, pull_policy: never, a docker compose build minio step in each job). That's the model main just replaced with a single published image.

I'd suggest closing this as superseded. The one thing main doesn't have yet is the per-job wiring contract in scripts/test-ci-required-context-isolation.sh: main's version has no Compose or MinIO assertions, so nothing stops a relay job from silently losing COMPOSE_FILE. If that guard is worth keeping, a small follow-up rebased on main could assert that each Compose-starting job (including mesh lifecycle) selects the CI override. The docker compose build minio ordering check doesn't carry over.

The release follow-up in the description no longer applies: #7867 has already been regenerated on 797012ff, which includes #7870. The red Rust / Unit Tests here is buzz-agent::fake_llm steer_rejected_on_run_id_mismatch. This PR changes no Rust, so I don't attribute that failure to it.