homelab/stack
1
0
Fork 0
Code Issues 22 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

fix(infra,ci): mc base image moved to quay.io (docker.io/minio/mc is gone); failure-issue step bootstraps uv
All checks were successful
CI / lint (push) Successful in 47s
Details
CI / notebooks-smoke (push) Successful in 1m33s
Details
Deploy / notebooks (push) Has been skipped
Details
Deploy / zotero (push) Has been skipped
Details
Deploy / docs (push) Has been skipped
Details
Deploy / api (push) Has been skipped
Details
Deploy / llm (push) Has been skipped
Details
Deploy / mc (push) Successful in 18s
Details
Infra CI / notebooks (push) Successful in 1m12s
Details
Infra CI / zotero (push) Successful in 23s
Details
Infra CI / docs (push) Successful in 1m37s
Details
Infra CI / api (push) Successful in 1m6s
Details
Infra CI / llm (push) Successful in 47s
Details
Infra CI / mc (push) Successful in 14s
Details
Deploy / report (push) Successful in 14s
Details
CI / test (push) Successful in 17m50s
Details

Browse Source 
Infra CI's mc job has failed on every push since docker.io/minio/mc
started returning 'pull access denied, repository does not exist' — and
nobody heard, because the generated File-failure-issue step ran
`uv run` in a job that never installs uv ("uv: command not found",
swallowed by the trailing || true). Pin quay.io/minio/mc to a release
tag; the filer installs uv when it is missing.
This commit is contained in:
kert
2026-09-11 17:53:42 -04:00
parent 6bff63b499
commit bc3bab8a42
11 changed files with 109 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.gitea/workflows/ci.yml
View File

@@ -66,6 +66,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "CI" --job "test" \
@@ -108,6 +113,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "CI" --job "notebooks-smoke" \

30
.gitea/workflows/deploy.yml
View File

@@ -50,6 +50,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "Deploy" --job "notebooks" \
@@ -98,6 +103,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "Deploy" --job "zotero" \
@@ -146,6 +156,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "Deploy" --job "docs" \
@@ -195,6 +210,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "Deploy" --job "api" \
@@ -244,6 +264,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "Deploy" --job "llm" \
@@ -286,6 +311,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "Deploy" --job "mc" \

5
.gitea/workflows/harden.yml
View File

@@ -117,6 +117,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "Harden" --job "build-scan-report" \

30
.gitea/workflows/infra-ci.yml
View File

@@ -64,6 +64,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "Infra CI" --job "notebooks" \
@@ -92,6 +97,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "Infra CI" --job "zotero" \
@@ -120,6 +130,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "Infra CI" --job "docs" \
@@ -148,6 +163,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "Infra CI" --job "api" \
@@ -176,6 +196,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "Infra CI" --job "llm" \
@@ -204,6 +229,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "Infra CI" --job "mc" \

5
.gitea/workflows/llm-golden.yml
View File

@@ -54,6 +54,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "LLM Golden" --job "llm-golden" \

5
.gitea/workflows/notebooks-integration.yml
View File

@@ -49,6 +49,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "Notebooks Integration" --job "notebooks-integration" \

5
.gitea/workflows/rebuild-all.yml
View File

@@ -115,6 +115,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "Rebuild All" --job "build-scan-report" \

5
.gitea/workflows/release.yml
View File

@@ -34,6 +34,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "Release" --job "release" \

5
.gitea/workflows/zotero-sync.yml
View File

@@ -51,6 +51,11 @@ jobs:
env:
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \
--workflow "Zotero Sync" --job "zotero-sync" \

5
dev/scripts/backends/gitea.py
View File

@@ -109,6 +109,11 @@ def _failure_step(workflow_name: str, job_name: str) -> str:
env:
GITEA_TOKEN: ${{{{ secrets.DEPLOY_TOKEN }}}}
run: |
# Jobs that never install uv (image builds, infra checks) still
# need it here — otherwise the filer dies with "uv: command not
# found" and the failure is never filed.
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
uv sync --no-dev --quiet 2>/dev/null || true
uv run python -m api.diag.ci \\
--workflow "{workflow_name}" --job "{job_name}" \\

5
infra/images/mc.Dockerfile
View File

@@ -1,7 +1,10 @@
# syntax=docker/dockerfile:1
# MinIO Client (mc) sidecar — least-privilege admin helper for RustFS.
# The image moved off Docker Hub (docker.io/minio/mc now 404s — pull access
# denied) to quay.io; pinned to a release tag so a base-image change is a
# reviewed diff, not a silent CI break.
# Runs as non-root, read-only filesystem, no capabilities.
FROM minio/mc:latest AS mc
FROM quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z AS mc
FROM alpine:3
RUN addgroup -g 10002 -S mc && adduser -u 10002 -S mc -G mc