Skip to content

fix(ci): consume the published MinIO image - #7870

Merged
tlongwell-block merged 2 commits into
mainfrom
codex/use-published-ci-minio
Sep 24, 2026
Merged

fix(ci): consume the published MinIO image#7870
tlongwell-block merged 2 commits into
mainfrom
codex/use-published-ci-minio

Conversation

@tlongwell-block

@tlongwell-block tlongwell-block commented Sep 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Switch every CI job that starts MinIO to the public ghcr.io/block/buzz-minio:latest image published by #7869. Integration jobs pull the image; image builds stay in the separate, path-filtered publisher workflow.

  • Apply the CI Compose override to both desktop integration shards, backend integration, relay E2E, and mesh lifecycle, including script-mediated Compose calls. Both the server and bucket initializer use the Buzz image.
  • Override both MinIO images in Helm's quickstart CI values, covering the server, bucket initializer, and relay's wait-for-bucket init container in the gated kind installation.
  • Select integration and mesh checks when either Compose file changes, with regression coverage using the real pinned dorny/paths-filter action.

Publication verified

#7869 is merged, and the first main-branch publication succeeded. An anonymous pull using an empty Docker configuration returned the publisher's digest: sha256:b8470bbeafbf57b20c86cf63804682b714bdcfdbb517f3770247e321e623f48f. This PR is rebased onto main and ready for consumer integration checks.

Validation

  • Ran the repository's MinIO smoke script against the actual published AMD64 image: healthy startup, bucket initialization, object upload/read/delete, and rejection of anonymous reads all passed. Used the rendered CI Compose services with isolated local ports and resource names.
  • Verified mc runs and writes its configuration as Helm's non-root UID/GID 65532 with dropped capabilities and no privilege escalation.
  • Helm 3.16.4 lint and quickstart rendering passed; all three rendered MinIO container references use the Buzz image.
  • All 14 CI selection cases and the required-context isolation check passed. Mesh workflow passes actionlint; shared workflows pass with shellcheck disabled for pre-existing findings.
  • Fresh repository-wide review traced workflow and script consumers and found no remaining CI image omissions. Full application integration checks and a real kind installation have not been run locally.

@tlongwell-block tlongwell-block mentioned this pull request Sep 24, 2026
Merged
wesbillman
wesbillman previously approved these changes Sep 24, 2026
View reviewed changes
tlongwell-block added a commit that referenced this pull request Sep 24, 2026
@tlongwell-block
fix(ci): bootstrap the reusable MinIO image in GHCR (#7869)
99c2acf 
Upstream MinIO image pulls are blocking CI (#7867). Add a separate
publisher for `ghcr.io/block/buzz-minio:latest`, so the reusable image
can be bootstrapped before CI adopts it in #7870.

- Build the checksummed official MinIO/mc release binaries from #7868 on
a digest-pinned Alpine base.
- Build only when image/workflow/Compose inputs change or on manual
dispatch. PRs build and smoke-test; only `block/buzz` main can publish.
- Run the real Compose healthcheck and initializer, object
upload/read/delete, and anonymous-access denial before publishing
`latest` plus a unique `sha-<commit>-run-<id>-<attempt>` tag.
- Manual dispatch disables Docker's layer cache to refresh Alpine
packages. Normal image builds retain caching; each maintenance rebuild
keeps its own tag.

### Rollout

This PR contains only the publisher and opt-in Compose override. **It
does not switch ordinary CI consumers**, so its checks do not require
the unpublished image. This is a separate PR from adoption, as required
by Buzz's squash-only merge rules.

1. Merge this PR; its main-branch workflow builds, tests, and publishes
the image.
2. Make the `buzz-minio` GHCR package public and verify an anonymous
pull of `ghcr.io/block/buzz-minio:latest`. New GHCR packages default to
private.
3. Rebase draft #7870 onto current main, retarget it to main, run its
integration checks, and merge it to switch all MinIO-backed CI jobs to
the published image.

### Validation

- Updated hosted [MinIO image build and smoke
test](https://github.com/block/buzz/actions/runs/36018177877) passed at
`700ab6d5346b37a64c9defde0016dc65c98aa790`; publication correctly
skipped on the PR.
- Hosted [ordinary
CI](https://github.com/block/buzz/actions/runs/36018178123) passed at
the same head. Its actual Git comparison detected only the five
publisher files, all application path filters were false, and the
MinIO-dependent integration checks were correctly skipped. Synced
current main before this run to eliminate an earlier stale-base
comparison that included unrelated ACP changes.
- Actual five changed paths were passed through the repo's pinned
`dorny/paths-filter`: all application domains were false. All 12
existing path-selection cases and the required-context isolation
contract also passed.
- Publisher actionlint, smoke-script shellcheck, and commit/push hooks
passed.
- Fresh local rebuild of `700ab6d5346b37a64c9defde0016dc65c98aa790`
passed with `docker buildx build --no-cache --platform linux/amd64
--load`. Logs confirm new Alpine index fetches and package installation
rather than a cached install layer. The committed smoke script passed
under local AMD64 emulation using the current merged Compose services
with isolated resource names and no published ports: healthcheck,
initializer/private bucket, object upload/read/delete, and anonymous
HTTP 403. Temporary containers, network, and volume were removed. Both
pinned binary checksums match the official release SHA-256 files.
- Full `just ci` was previously attempted: workspace formatting/Clippy,
desktop checks, and Tauri formatting passed; the run was stopped during
Tauri Clippy. No full local application-suite pass is claimed; hosted
application suites correctly skip this publisher-only change.

---------

Signed-off-by: Tyler Longwell <tlongwell@squareup.com>
Base automatically changed from codex/publish-ci-minio-ghcr to main September 24, 2026 15:36
@tlongwell-block
tlongwell-block dismissed wesbillman’s stale review September 24, 2026 15:36

The base branch was changed.

@tlongwell-block
ci: pull the published MinIO latest image in integration jobs
b859ae0 
Signed-off-by: Tyler Longwell <tlongwell@squareup.com>
@tlongwell-block
ci: use the published MinIO image in Helm integration
daff8ec 
Signed-off-by: Tyler Longwell <tlongwell@squareup.com>
@tlongwell-block
tlongwell-block force-pushed the codex/use-published-ci-minio branch from c36fe3b to daff8ec Compare September 24, 2026 15:46
@tlongwell-block
tlongwell-block marked this pull request as ready for review September 24, 2026 15:46
@tlongwell-block
tlongwell-block requested a review from a team as a code owner September 24, 2026 15:46
@github-actions

github-actions Bot commented Sep 24, 2026

Copy link
Copy Markdown

🔐 Codex Security Review

Status: review required for the current range.

The current range is 99c2acf90cfbb1cb2d3a8bd900c0ec1642e20540...daff8ec26c67d5732524e9742965ad408f310eba.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review daff8ec26c67d5732524e9742965ad408f310eba to authorize a new review.
Any previous review applies only to its recorded range.

@tlongwell-block
tlongwell-block enabled auto-merge (squash) September 24, 2026 15:54
@tlongwell-block
tlongwell-block merged commit 797012f into main Sep 24, 2026
89 of 90 checks passed
@tlongwell-block
tlongwell-block deleted the codex/use-published-ci-minio branch September 24, 2026 16:28
wpfleger96 pushed a commit that referenced this pull request Sep 24, 2026
Duncan
Merge remote-tracking branch 'origin/main' into wpfleger/desktop-admi…
0b4246c 
…n-surface

* origin/main:
  fix(ci): consume the published MinIO image (#7870)
  fix(mobile): converge sidebar managers on relay head with resume re-read (#7806)
  fix(ci): bootstrap the reusable MinIO image in GHCR (#7869)
  Discover alternate Buzz ACP commands (#6948)
  fix(hooks): surface nextest failures and stale pnpm deps in pre-push (#7850)
  feat(acp): run one prepared task from a file or stdin (#7851)
  Fix mobile heart and warning emoji with native font fallback (#7842)
  chore(mesh): upgrade MeshLLM to 0.76.2 (#7559)
  feat(agents): humanize uncurated Databricks model ids with a label grammar (#7844)
  fix: route databricks claude fqns to anthropic messages (#7829)
  feat(relay): add opt-in newest-first thread windows (#7823)
  refactor: move agent Git bootstrap into ACP harness (#7819)
  Use worker snapshots for relay storage metrics (#7845)
  fix(hooks): strip repo-local git env from pre-push test lanes (#7841)
  fix(mobile-infra): render push grant lifetimes as decimal in chart 0.3.2 (#7820)

Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
wpfleger96 pushed a commit that referenced this pull request Sep 24, 2026
Duncan
Merge remote-tracking branch 'origin/main' into hayt/nip-fi-http-enfo…
88f3be7 
…rcement

* origin/main:
  fix(ci): consume the published MinIO image (#7870)
  fix(mobile): converge sidebar managers on relay head with resume re-read (#7806)
  fix(ci): bootstrap the reusable MinIO image in GHCR (#7869)
  Discover alternate Buzz ACP commands (#6948)
  fix(hooks): surface nextest failures and stale pnpm deps in pre-push (#7850)
  feat(acp): run one prepared task from a file or stdin (#7851)
  Fix mobile heart and warning emoji with native font fallback (#7842)
  chore(mesh): upgrade MeshLLM to 0.76.2 (#7559)
  feat(agents): humanize uncurated Databricks model ids with a label grammar (#7844)

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

# Conflicts:
#	Cargo.lock
#	crates/buzz-relay/Cargo.toml
@TheSentinel454 TheSentinel454 mentioned this pull request Sep 24, 2026
Merged
@wpfleger96 wpfleger96 mentioned this pull request Sep 24, 2026
Closed
wpfleger96 pushed a commit that referenced this pull request Sep 24, 2026
Hayt
Merge remote-tracking branch 'origin/main' into hayt/admin-delete-thr…
dd75fd7 
…ead-counters

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

* origin/main:
  chore(release): release Buzz Desktop version 0.5.25 (#7867)
  fix(ci): consume the published MinIO image (#7870)
  fix(mobile): converge sidebar managers on relay head with resume re-read (#7806)
  fix(ci): bootstrap the reusable MinIO image in GHCR (#7869)
  Discover alternate Buzz ACP commands (#6948)
  fix(hooks): surface nextest failures and stale pnpm deps in pre-push (#7850)
  feat(acp): run one prepared task from a file or stdin (#7851)
  Fix mobile heart and warning emoji with native font fallback (#7842)
  chore(mesh): upgrade MeshLLM to 0.76.2 (#7559)

Signed-off-by: Hayt <211b96e6a2b7f45fd4047988976c7bbbeeda0c15f3ae7b32eec20834b5a55118@buzz.block.builderlab.xyz>
wpfleger96 pushed a commit that referenced this pull request Sep 24, 2026
Hayt
Merge remote-tracking branch 'origin/main' into wpfleger/deterministi…
8c5dfa9 
…c-agent-commit-identity

* origin/main:
  fix(mobile): keep retired sections manager out of successor cache (#7873)
  Select one feature flag provider at compile time (#7677)
  chore(release): release Buzz Desktop version 0.5.25 (#7867)
  fix(ci): consume the published MinIO image (#7870)
  fix(mobile): converge sidebar managers on relay head with resume re-read (#7806)
  fix(ci): bootstrap the reusable MinIO image in GHCR (#7869)
  Discover alternate Buzz ACP commands (#6948)
  fix(hooks): surface nextest failures and stale pnpm deps in pre-push (#7850)
  feat(acp): run one prepared task from a file or stdin (#7851)
  Fix mobile heart and warning emoji with native font fallback (#7842)
  chore(mesh): upgrade MeshLLM to 0.76.2 (#7559)
  feat(agents): humanize uncurated Databricks model ids with a label grammar (#7844)

Signed-off-by: Hayt <211b96e6a2b7f45fd4047988976c7bbbeeda0c15f3ae7b32eec20834b5a55118@buzz.block.builderlab.xyz>

# Conflicts:
#	Cargo.lock
TheSentinel454 added a commit that referenced this pull request Sep 24, 2026
@TheSentinel454
Merge remote-tracking branch 'origin/main' into tornquist/osc-lock-fo…
a6a3032 
…undation-local

* origin/main: (50 commits)
  feat(desktop): relay admin console for the /api/admin/v1 operator surface (#4768)
  fix(mobile): keep retired sections manager out of successor cache (#7873)
  Select one feature flag provider at compile time (#7677)
  chore(release): release Buzz Desktop version 0.5.25 (#7867)
  fix(ci): consume the published MinIO image (#7870)
  fix(mobile): converge sidebar managers on relay head with resume re-read (#7806)
  fix(ci): bootstrap the reusable MinIO image in GHCR (#7869)
  Discover alternate Buzz ACP commands (#6948)
  fix(hooks): surface nextest failures and stale pnpm deps in pre-push (#7850)
  feat(acp): run one prepared task from a file or stdin (#7851)
  Fix mobile heart and warning emoji with native font fallback (#7842)
  chore(mesh): upgrade MeshLLM to 0.76.2 (#7559)
  feat(agents): humanize uncurated Databricks model ids with a label grammar (#7844)
  fix: route databricks claude fqns to anthropic messages (#7829)
  feat(relay): add opt-in newest-first thread windows (#7823)
  refactor: move agent Git bootstrap into ACP harness (#7819)
  Use worker snapshots for relay storage metrics (#7845)
  fix(hooks): strip repo-local git env from pre-push test lanes (#7841)
  fix(mobile-infra): render push grant lifetimes as decimal in chart 0.3.2 (#7820)
  fix(agent): preserve Databricks Opus UC reasoning and tool continuation (#7840)
  ...
Signed-off-by: tornquist <tornquist@squareup.com>
TheSentinel454 added a commit that referenced this pull request Sep 24, 2026
@TheSentinel454
Merge commit 'a6a3032e446e6e66e8e41a229ef655ea79f36202' into tornquis…
9e72828 
…t/osc-event-write-chokepoint

* commit 'a6a3032e446e6e66e8e41a229ef655ea79f36202': (50 commits)
  feat(desktop): relay admin console for the /api/admin/v1 operator surface (#4768)
  fix(mobile): keep retired sections manager out of successor cache (#7873)
  Select one feature flag provider at compile time (#7677)
  chore(release): release Buzz Desktop version 0.5.25 (#7867)
  fix(ci): consume the published MinIO image (#7870)
  fix(mobile): converge sidebar managers on relay head with resume re-read (#7806)
  fix(ci): bootstrap the reusable MinIO image in GHCR (#7869)
  Discover alternate Buzz ACP commands (#6948)
  fix(hooks): surface nextest failures and stale pnpm deps in pre-push (#7850)
  feat(acp): run one prepared task from a file or stdin (#7851)
  Fix mobile heart and warning emoji with native font fallback (#7842)
  chore(mesh): upgrade MeshLLM to 0.76.2 (#7559)
  feat(agents): humanize uncurated Databricks model ids with a label grammar (#7844)
  fix: route databricks claude fqns to anthropic messages (#7829)
  feat(relay): add opt-in newest-first thread windows (#7823)
  refactor: move agent Git bootstrap into ACP harness (#7819)
  Use worker snapshots for relay storage metrics (#7845)
  fix(hooks): strip repo-local git env from pre-push test lanes (#7841)
  fix(mobile-infra): render push grant lifetimes as decimal in chart 0.3.2 (#7820)
  fix(agent): preserve Databricks Opus UC reasoning and tool continuation (#7840)
  ...

Signed-off-by: tornquist <tornquist@squareup.com>

# Conflicts:
#	crates/buzz-db/src/store/event.rs
brow added a commit that referenced this pull request Sep 25, 2026
@brow
Merge remote-tracking branch 'origin/main' into fix-ci-docs-path-sele…
5237da7 
…ction

* origin/main: (21 commits)
  docs(vision): add /buzz/v1 read endpoints to the protocol contract (#7879)
  🤖 fix(justfile): point just staging at the current staging relay (#7881)
  fix(relay-admin): make thread deletions atomic and fence expired action leases under row lock (#7853)
  feat(desktop): relay admin console for the /api/admin/v1 operator surface (#4768)
  fix(mobile): keep retired sections manager out of successor cache (#7873)
  Select one feature flag provider at compile time (#7677)
  chore(release): release Buzz Desktop version 0.5.25 (#7867)
  fix(ci): consume the published MinIO image (#7870)
  fix(mobile): converge sidebar managers on relay head with resume re-read (#7806)
  fix(ci): bootstrap the reusable MinIO image in GHCR (#7869)
  Discover alternate Buzz ACP commands (#6948)
  fix(hooks): surface nextest failures and stale pnpm deps in pre-push (#7850)
  feat(acp): run one prepared task from a file or stdin (#7851)
  Fix mobile heart and warning emoji with native font fallback (#7842)
  chore(mesh): upgrade MeshLLM to 0.76.2 (#7559)
  feat(agents): humanize uncurated Databricks model ids with a label grammar (#7844)
  fix: route databricks claude fqns to anthropic messages (#7829)
  feat(relay): add opt-in newest-first thread windows (#7823)
  refactor: move agent Git bootstrap into ACP harness (#7819)
  Use worker snapshots for relay storage metrics (#7845)
  ...

Signed-off-by: Tom Brow <tomb@block.xyz>
@github-actions github-actions Bot mentioned this pull request Sep 25, 2026
Open
This was referenced Sep 25, 2026
Draft
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wesbillman wesbillman wesbillman approved these changes
@wpfleger96 wpfleger96 wpfleger96 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@tlongwell-block @wesbillman @wpfleger96