99c2acf90c
Upstream MinIO image pulls are blocking CI (#7867). Add a separate publisher for `ghcr.io/block/buzz-minio:latest`, so the reusable image can be bootstrapped before CI adopts it in #7870. - Build the checksummed official MinIO/mc release binaries from #7868 on a digest-pinned Alpine base. - Build only when image/workflow/Compose inputs change or on manual dispatch. PRs build and smoke-test; only `block/buzz` main can publish. - Run the real Compose healthcheck and initializer, object upload/read/delete, and anonymous-access denial before publishing `latest` plus a unique `sha-<commit>-run-<id>-<attempt>` tag. - Manual dispatch disables Docker's layer cache to refresh Alpine packages. Normal image builds retain caching; each maintenance rebuild keeps its own tag. ### Rollout This PR contains only the publisher and opt-in Compose override. **It does not switch ordinary CI consumers**, so its checks do not require the unpublished image. This is a separate PR from adoption, as required by Buzz's squash-only merge rules. 1. Merge this PR; its main-branch workflow builds, tests, and publishes the image. 2. Make the `buzz-minio` GHCR package public and verify an anonymous pull of `ghcr.io/block/buzz-minio:latest`. New GHCR packages default to private. 3. Rebase draft #7870 onto current main, retarget it to main, run its integration checks, and merge it to switch all MinIO-backed CI jobs to the published image. ### Validation - Updated hosted [MinIO image build and smoke test](https://github.com/block/buzz/actions/runs/36018177877) passed at `700ab6d5346b37a64c9defde0016dc65c98aa790`; publication correctly skipped on the PR. - Hosted [ordinary CI](https://github.com/block/buzz/actions/runs/36018178123) passed at the same head. Its actual Git comparison detected only the five publisher files, all application path filters were false, and the MinIO-dependent integration checks were correctly skipped. Synced current main before this run to eliminate an earlier stale-base comparison that included unrelated ACP changes. - Actual five changed paths were passed through the repo's pinned `dorny/paths-filter`: all application domains were false. All 12 existing path-selection cases and the required-context isolation contract also passed. - Publisher actionlint, smoke-script shellcheck, and commit/push hooks passed. - Fresh local rebuild of `700ab6d5346b37a64c9defde0016dc65c98aa790` passed with `docker buildx build --no-cache --platform linux/amd64 --load`. Logs confirm new Alpine index fetches and package installation rather than a cached install layer. The committed smoke script passed under local AMD64 emulation using the current merged Compose services with isolated resource names and no published ports: healthcheck, initializer/private bucket, object upload/read/delete, and anonymous HTTP 403. Temporary containers, network, and volume were removed. Both pinned binary checksums match the official release SHA-256 files. - Full `just ci` was previously attempted: workspace formatting/Clippy, desktop checks, and Tauri formatting passed; the run was stopped during Tauri Clippy. No full local application-suite pass is claimed; hosted application suites correctly skip this publisher-only change. --------- Signed-off-by: Tyler Longwell <tlongwell@squareup.com>
Buzz CI MinIO
ghcr.io/block/buzz-minio:latest contains MinIO and mc for the disposable
Linux AMD64 CI runners. docker-compose.ci.yml selects it for both services;
development and deployment defaults stay in docker-compose.yml.
The MinIO image workflow builds only when its inputs change, or on a manual
dispatch. Pull requests build and smoke-test without publishing. On main, a
successful smoke test publishes the same image as
sha-<full commit>-run-<run id>-<attempt> and latest. The run-specific tag
preserves each build, including package refreshes from the same source commit.
Once consumers adopt the override, ordinary CI only pulls it; there is no build
fallback or dependency on the publisher. latest deliberately floats, and
Compose always pulls it. Docker's pull output records the resolved digest.
The Dockerfile uses the same upstream releases as the development services,
with checksummed official GitHub release binaries and a digest-pinned Alpine
base. MinIO and mc are AGPL-3.0; their corresponding source is available at
the MinIO release
and mc release.
First publication
The image must exist and be publicly pullable before the CI switch can pass. Use two separate PRs: Buzz only permits squash merges, so two commits in one PR cannot stage this rollout.
- Merge the publisher-only PR containing
.github/ci/minio/,.github/workflows/minio-image.yml, and the opt-indocker-compose.ci.yml. Ordinary CI does not select the override yet, so it does not need this image to validate the publisher PR. The merge triggers the first publication. - After publication succeeds, an org/package admin must make buzz-minio
public in its GitHub package settings (new GHCR packages default to private,
even for public repositories). Verify an anonymous pull of
ghcr.io/block/buzz-minio:latest. - Rebase the separate consumer PR onto
main, run its integration checks, and merge it. That PR selects the override in relay and mesh lifecycle CI.
Subsequent publications preserve package visibility.
Updating or rebuilding
Update the release URLs/checksums or base digest in the Dockerfile and open a
PR. Merging triggers publication. To rebuild the existing recipe (for example,
to pick up Alpine package updates), dispatch MinIO image from main.
Manual dispatch disables Docker's layer cache so the package installation
runs again. Other refs can build and test but cannot publish latest.
To reproduce a CI run with a recorded version, set MINIO_CI_IMAGE to
the published run-specific tag or digest while using
COMPOSE_FILE=docker-compose.yml:docker-compose.ci.yml.