Repository navigation
fix(deploy): replace archived MinIO with SeaweedFS in compose and e2e - #180
Open
cubeorgdev[bot] wants to merge 2 commits into
Open
cubeorgdev[bot] wants to merge 2 commits into
cubeorgdev[bot] wants to merge 2 commits into
Conversation
MinIO CE is archived and quay.io/minio/* now rejects anonymous pulls, which breaks every stack that boots it. Run SeaweedFS (`weed mini`) as the local S3 store and use the AWS CLI image to create buckets, seed native fixtures, and apply the package bucket policy. Both images are pinned by digest. Services are renamed to s3/s3-init, credentials become neutral blue-local values, deploy/docker-compose.yml reads BLUE_S3_ACCESS_KEY / BLUE_S3_SECRET_KEY, and the e2e-slim harness uses E2E_SLIM_S3_URL. The Helm evaluation store is left for a follow-up. Fixes #179 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
This pull request was created from a Blocks session. View in dashboard | View on desktop
|
Contributor
Author
|
Test from the |
New advisories fail Security gates on main and on every PR. - Cargo: rustls 0.23.46, rustls-webpki 0.103.16, webpki-roots 1.0.11, ctutils 0.4.8, tokio 1.54.1 (RUSTSEC-2026-0346..0349, 0381, 0382, 0385, 0386). - Dashboard: next 16.4.5, sharp 0.35.5, source-map-js 1.2.2 (trivy), and shadcn 4.23 plus in-range transitive updates (npm audit). - better-auth stays on 1.7.2. 1.7.7+ drops the issuer-scoped account model the dashboard schema relies on, so that upgrade needs its own migration. Its three advisories need the Magic Link plugin, the OAuth Proxy plugin, or the Drizzle adapter, none of which Blue uses, so they get time-boxed exceptions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
Test from the |
tomi-stipancik
marked this pull request as ready for review
November 9, 2026 21:11
Contributor
Author
|
Test from the |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #179
The MinIO images on
quay.io/minio/*now return 401 to anonymous pulls, which breaks nightlyEnd-to-endon main. The same images are also used by e2e-slim, the native overlay, and the local Compose stack.What changed
chrislusf/seaweedfs:4.53runningweed mini(Apache-2.0), with S3 on:9000.amazon/aws-cli:2.39.6replacesmc. It runsmbonly ifhead-bucketfails, so reruns don't fail. For the native overlay it also doescpandput-bucket-policy. Both images are pinned by digest.minio/minio-init→s3/s3-init, and the credentials become neutralblue-localvalues.deploy/docker-compose.yml: the credentials are nowBLUE_S3_ACCESS_KEY/BLUE_S3_SECRET_KEY(the defaults still work, so.envstays optional), the data volume iss3-data, and the admin UI is on:9001behind a login with the same credentials.E2E_SLIM_MINIO_URL→E2E_SLIM_S3_URL. The fixtures now point athttp://s3:9000. Docs fornextare updated; the versioned docs are untouched.Spike
I ran
weed4.53 locally with the sameaws-sdk-s3versions asblob.rs:x-amz-meta-sha256: works, and tampered metadata gets 403HeadObjectreturns the metadata; presigned GET andHeadBucketworkGetObjectpolicy onhealth.txtonly (other keys get 403) works and survives a restartI couldn't boot the stacks with Docker locally; I only checked them with
docker compose config. The e2e workflows still need dispatching on this branch.Security gates (second commit)
New advisories fail Security gates on main as well, so they're fixed here to unblock this PR:
cargo denyadvisories pass locally.next build, and the 36 unit tests pass.account.issuer NOT NULLschema depends on, so it needs a separate migration PR. Its three advisories need Magic Link, OAuth Proxy, or the Drizzle adapter, none of which we use, so they have exceptions that expire on 2026-12-05.Follow-ups: the better-auth 1.7.x upgrade and account-schema migration; the Helm
minio.deployStandaloneevaluation store (it needs a values-API rename).🤖 Generated with Claude Code