From 797012ff01a6d499959b45ed2e56f7927c6a4d6b Mon Sep 17 00:00:00 2001 From: Tyler <109685178+tlongwell-block@users.noreply.github.com> Date: Thu, 24 Sep 2026 12:28:17 -0400 Subject: [PATCH] fix(ci): consume the published MinIO image (#7870) Switch every CI job that starts MinIO to the public `ghcr.io/block/buzz-minio:latest` image published by #7869. Integration jobs pull the image; image builds stay in the separate, path-filtered publisher workflow. - Apply the CI Compose override to both desktop integration shards, backend integration, relay E2E, and mesh lifecycle, including script-mediated Compose calls. Both the server and bucket initializer use the Buzz image. - Override both MinIO images in Helm's quickstart CI values, covering the server, bucket initializer, and relay's wait-for-bucket init container in the gated kind installation. - Select integration and mesh checks when either Compose file changes, with regression coverage using the real pinned `dorny/paths-filter` action. ### Publication verified #7869 is merged, and [the first main-branch publication](https://github.com/block/buzz/actions/runs/36021389137/job/107706874954) succeeded. An anonymous pull using an empty Docker configuration returned the publisher's digest: `sha256:b8470bbeafbf57b20c86cf63804682b714bdcfdbb517f3770247e321e623f48f`. This PR is rebased onto main and ready for consumer integration checks. ### Validation - Ran the repository's MinIO smoke script against the actual published AMD64 image: healthy startup, bucket initialization, object upload/read/delete, and rejection of anonymous reads all passed. Used the rendered CI Compose services with isolated local ports and resource names. - Verified `mc` runs and writes its configuration as Helm's non-root UID/GID 65532 with dropped capabilities and no privilege escalation. - Helm 3.16.4 lint and quickstart rendering passed; all three rendered MinIO container references use the Buzz image. - All 14 CI selection cases and the required-context isolation check passed. Mesh workflow passes actionlint; shared workflows pass with shellcheck disabled for pre-existing findings. - Fresh repository-wide review traced workflow and script consumers and found no remaining CI image omissions. Full application integration checks and a real kind installation have not been run locally. --------- Signed-off-by: Tyler Longwell --- .github/workflows/_ci-relay.yml | 6 ++++++ .github/workflows/ci.yml | 2 ++ .github/workflows/mesh-lifecycle.yml | 6 ++++++ deploy/charts/buzz/ci/quickstart-values.yaml | 2 ++ scripts/ci-selection.test.mjs | 2 ++ 5 files changed, 18 insertions(+) diff --git a/.github/workflows/_ci-relay.yml b/.github/workflows/_ci-relay.yml index 3d7bc6e35c..b616b8e7f3 100644 --- a/.github/workflows/_ci-relay.yml +++ b/.github/workflows/_ci-relay.yml @@ -207,6 +207,8 @@ jobs: --archive-file target/ci/postgres-tests.tar.zst desktop-e2e-integration-shard: + env: + COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml name: Desktop E2E Integration (${{ matrix.shard }}/2) runs-on: ubuntu-latest timeout-minutes: 20 @@ -400,6 +402,8 @@ jobs: echo "Desktop E2E Integration shards passed" backend-integration: + env: + COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml name: Backend Integration (relay e2e) runs-on: ubuntu-latest timeout-minutes: 20 @@ -562,6 +566,8 @@ jobs: if-no-files-found: ignore relay-e2e: + env: + COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml name: Relay E2E runs-on: ubuntu-latest timeout-minutes: 20 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7b93f32f1a..94336011cb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -55,6 +55,8 @@ jobs: - 'deny.toml' - '.github/workflows/ci.yml' - '.github/workflows/_ci-*.yml' + - 'docker-compose.yml' + - 'docker-compose.ci.yml' - 'scripts/run-tests.sh' - 'scripts/model-capabilities.json' - 'scripts/normative-corpus.json' diff --git a/.github/workflows/mesh-lifecycle.yml b/.github/workflows/mesh-lifecycle.yml index 97cfe1a962..0666e98c32 100644 --- a/.github/workflows/mesh-lifecycle.yml +++ b/.github/workflows/mesh-lifecycle.yml @@ -22,6 +22,8 @@ on: - 'scripts/ci-mesh-lifecycle-smoke.sh' - 'scripts/start-relay-for-tests.sh' - '.github/workflows/mesh-lifecycle.yml' + - 'docker-compose.yml' + - 'docker-compose.ci.yml' pull_request: paths: - 'crates/buzz-mesh-smoke/**' @@ -34,6 +36,8 @@ on: - 'scripts/ci-mesh-lifecycle-smoke.sh' - 'scripts/start-relay-for-tests.sh' - '.github/workflows/mesh-lifecycle.yml' + - 'docker-compose.yml' + - 'docker-compose.ci.yml' workflow_dispatch: concurrency: @@ -45,6 +49,8 @@ env: jobs: lifecycle-smoke: + env: + COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml name: Relay-Driven Mesh Lifecycle Smoke runs-on: ubuntu-24.04 timeout-minutes: 45 diff --git a/deploy/charts/buzz/ci/quickstart-values.yaml b/deploy/charts/buzz/ci/quickstart-values.yaml index 4dcf6bcd21..1a7f4d5838 100644 --- a/deploy/charts/buzz/ci/quickstart-values.yaml +++ b/deploy/charts/buzz/ci/quickstart-values.yaml @@ -9,6 +9,8 @@ redis: enabled: true minio: enabled: true + image: ghcr.io/block/buzz-minio:latest + mcImage: ghcr.io/block/buzz-minio:latest relayUrl: wss://buzz.test.local ownerPubkey: "0000000000000000000000000000000000000000000000000000000000000001" relay: diff --git a/scripts/ci-selection.test.mjs b/scripts/ci-selection.test.mjs index 5c2ddfa3de..2099bf1899 100644 --- a/scripts/ci-selection.test.mjs +++ b/scripts/ci-selection.test.mjs @@ -113,6 +113,8 @@ const scenarios = [ ["relay", ["crates/buzz-relay/src/main.rs"], ["rust"]], ["migration", ["migrations/123.sql"], ["rust"]], ["shared workflow", [".github/workflows/ci.yml"], ["rust", "mobile"]], + ["integration services", ["docker-compose.yml"], ["rust"]], + ["CI integration images", ["docker-compose.ci.yml"], ["rust"]], [ "mixed mobile and relay", ["mobile/lib/main.dart", "crates/buzz-core/src/lib.rs"],