mirror of
https://github.com/block/buzz.git
synced 2026-10-27 04:30:52 +00:00
99c2acf90c
Upstream MinIO image pulls are blocking CI (#7867). Add a separate publisher for `ghcr.io/block/buzz-minio:latest`, so the reusable image can be bootstrapped before CI adopts it in #7870. - Build the checksummed official MinIO/mc release binaries from #7868 on a digest-pinned Alpine base. - Build only when image/workflow/Compose inputs change or on manual dispatch. PRs build and smoke-test; only `block/buzz` main can publish. - Run the real Compose healthcheck and initializer, object upload/read/delete, and anonymous-access denial before publishing `latest` plus a unique `sha-<commit>-run-<id>-<attempt>` tag. - Manual dispatch disables Docker's layer cache to refresh Alpine packages. Normal image builds retain caching; each maintenance rebuild keeps its own tag. ### Rollout This PR contains only the publisher and opt-in Compose override. **It does not switch ordinary CI consumers**, so its checks do not require the unpublished image. This is a separate PR from adoption, as required by Buzz's squash-only merge rules. 1. Merge this PR; its main-branch workflow builds, tests, and publishes the image. 2. Make the `buzz-minio` GHCR package public and verify an anonymous pull of `ghcr.io/block/buzz-minio:latest`. New GHCR packages default to private. 3. Rebase draft #7870 onto current main, retarget it to main, run its integration checks, and merge it to switch all MinIO-backed CI jobs to the published image. ### Validation - Updated hosted [MinIO image build and smoke test](https://github.com/block/buzz/actions/runs/36018177877) passed at `700ab6d5346b37a64c9defde0016dc65c98aa790`; publication correctly skipped on the PR. - Hosted [ordinary CI](https://github.com/block/buzz/actions/runs/36018178123) passed at the same head. Its actual Git comparison detected only the five publisher files, all application path filters were false, and the MinIO-dependent integration checks were correctly skipped. Synced current main before this run to eliminate an earlier stale-base comparison that included unrelated ACP changes. - Actual five changed paths were passed through the repo's pinned `dorny/paths-filter`: all application domains were false. All 12 existing path-selection cases and the required-context isolation contract also passed. - Publisher actionlint, smoke-script shellcheck, and commit/push hooks passed. - Fresh local rebuild of `700ab6d5346b37a64c9defde0016dc65c98aa790` passed with `docker buildx build --no-cache --platform linux/amd64 --load`. Logs confirm new Alpine index fetches and package installation rather than a cached install layer. The committed smoke script passed under local AMD64 emulation using the current merged Compose services with isolated resource names and no published ports: healthcheck, initializer/private bucket, object upload/read/delete, and anonymous HTTP 403. Temporary containers, network, and volume were removed. Both pinned binary checksums match the official release SHA-256 files. - Full `just ci` was previously attempted: workspace formatting/Clippy, desktop checks, and Tauri formatting passed; the run was stopped during Tauri Clippy. No full local application-suite pass is claimed; hosted application suites correctly skip this publisher-only change. --------- Signed-off-by: Tyler Longwell <tlongwell@squareup.com>
28 lines
1.1 KiB
Bash
28 lines
1.1 KiB
Bash
#!/usr/bin/env bash
|
|
# Run on a disposable Docker host with the CI Compose files and a built image.
|
|
set -euo pipefail
|
|
: "${MINIO_CI_IMAGE:?Set MINIO_CI_IMAGE to the locally built image}"
|
|
: "${COMPOSE_FILE:?Select docker-compose.yml and docker-compose.ci.yml}"
|
|
|
|
# Exercise the real healthcheck and initializer without pulling over the image
|
|
# under test. No application services or tests need a MinIO build step.
|
|
docker compose up -d --wait --wait-timeout 90 --pull never minio
|
|
docker compose run --rm --no-deps --pull never minio-init
|
|
docker compose exec -T minio sh -eu -c '
|
|
minio --version
|
|
mc --version
|
|
mc alias set local http://localhost:9000 buzz_dev buzz_dev_secret
|
|
printf "buzz-minio-smoke\n" > /tmp/expected
|
|
mc cp /tmp/expected local/buzz-media/smoke-test
|
|
mc cat local/buzz-media/smoke-test > /tmp/actual
|
|
cmp /tmp/expected /tmp/actual
|
|
status=$(curl --silent --show-error --output /dev/null --write-out "%{http_code}" \
|
|
http://localhost:9000/buzz-media/smoke-test)
|
|
test "$status" = 403
|
|
mc rm local/buzz-media/smoke-test
|
|
if mc stat local/buzz-media/smoke-test; then
|
|
echo "Deleted object is still present" >&2
|
|
exit 1
|
|
fi
|
|
'
|