[Bug] Default MinIO image can no longer be pulled anonymously, breaking E2E and Helm smoke tests #922

Activity

1. FenjuFu

   added

   bugSomething isn't workingSomething isn't working

   on Oct 5, 2026
2. github-actions

   added

   triage/core交由 core maintainer 结合 AI 协同处理 / Issue should be handled by a core maintainer with AI support.交由 core maintainer 结合 AI 协同处理 / Issue should be handled by a core maintainer with AI support.

   priority/p1高优先级 / High priority triage bucket.高优先级 / High priority triage bucket.

   effort/l大改动或高风险改动，需要 maintainer 负责 / Large or risky change requiring maintainer ownership.大改动或高风险改动，需要 maintainer 负责 / Large or risky change requiring maintainer ownership.

   risk/high涉及安全、鉴权、迁移或公共契约 / Touches security, auth, migrations, or public contracts.涉及安全、鉴权、迁移或公共契约 / Touches security, auth, migrations, or public contracts.

   on Oct 5, 2026
3. github-actions commented on Oct 5, 2026

   

   github-actionsbot

   on Oct 5, 2026 – with GitHub Actions

   Contributor

   More actions

   Issue Triage

   • Route: triage/core
   • Priority: priority/p1 (4.0/5)
   • Effort: effort/l (5/5)
   • Confidence: 5/5
   • Risk: high
   • Analysis Mode: rules-only

   Why

   • Touches core SkillHub workflows (publish, namespace, auth).
   • Contains urgency signals (fails, production).

   High-Risk Signals

   • Mentions sensitive areas (auth, token, credential).

   Maintainer Brief

   Summary: The default MinIO image used by the local/dev stack and CI can no longer be pulled anonymously, so PR E2E Tests → E2E (Real Services) fails for every PR before any test runs. docker-compose.yml defaults to ${MINIO_IMAGE:-quay.io/minio/minio:latest}. Anonymous pulls from quay.io/minio/minio now return 401 unauthorized. Docker Hub's minio/minio returns 401 for every tag I tried too (latest, RELEASE.2025-09-07T16-13-09Z, RELEASE.2025-04-22T22-12-26Z), while library/redis:7-alpine pulls fine with the same token flow. So this looks like upstream gating the community images, not a runner flake. The same problem affects: - charts/skillhub/tests/install-upgrade-smoke.sh, which pins quay.io/minio/minio@sha256:14cea493…. That digest also returns 401 anonymously, so the Helm install/upgrade smoke test in pr-helm-chart.yml will fail the same way. - deploy/runtime-mirror-images.txt (quay.io/minio/minio:latest minio:latest). This is harmless while the mirror target already exists, because the script skips existing images, but it can no longer be re-mirrored from that source. The runtime/release stack does not depend on MinIO, so production deployments are not affected.
   Why core:

   • Touches a higher-risk area where automated fixes should not be trusted without maintainer review.
   • Likely spans multiple modules or a public compatibility surface.
   • Mentions sensitive areas (auth, token, credential).
     Reproduction or operator path:
   • 1. Run make dev-all on a clean machine (no cached MinIO image), or look at any recent E2E (Real Services) run, e.g. fix(web): bump undici override to ^7.29.1 #919: run 37119717963, both attempts.
   • 2. The compose pull fails:
   • minio Error unauthorized: access to the requested resource is not authorized
   • Error response from daemon: unauthorized: access to the requested resource is not authorized
   • make[1]: *** [Makefile:33: dev] Error 1
     Suspected areas:
   • Skill installation flow and registry/lockfile integration
   • Authentication, session, and identity integration
     Risks to watch:
   • Mentions sensitive areas (auth, token, credential).
     Validation checklist:
   • Replay the exact reproduction steps from the issue and confirm the reported failure disappears.
   • Confirm the final behavior matches the issue's expected outcome: make dev-all, the E2E workflow and the Helm smoke test can pull an S3-compatible object store image without registry credentials.

   Next Action

   • Hand the issue to a core maintainer and use a local programming agent for reproduction, scoping, and validation.

   ---

   问题分流结果

   • 路由: triage/core
   • 优先级: priority/p1 (4.0/5)
   • 修复投入: effort/l (5/5)
   • 信息完整度: 5/5
   • 风险: 高
   • 分析模式: rules-only

   原因

   • 涉及 SkillHub 核心流程（publish, namespace, auth）
   • 包含紧急信号（fails, production）

   高风险信号

   • 提到敏感区域（auth, token, credential）

   维护者交接摘要

   概要: The default MinIO image used by the local/dev stack and CI can no longer be pulled anonymously, so PR E2E Tests → E2E (Real Services) fails for every PR before any test runs. docker-compose.yml defaults to ${MINIO_IMAGE:-quay.io/minio/minio:latest}. Anonymous pulls from quay.io/minio/minio now return 401 unauthorized. Docker Hub's minio/minio returns 401 for every tag I tried too (latest, RELEASE.2025-09-07T16-13-09Z, RELEASE.2025-04-22T22-12-26Z), while library/redis:7-alpine pulls fine with the same token flow. So this looks like upstream gating the community images, not a runner flake. The same problem affects: - charts/skillhub/tests/install-upgrade-smoke.sh, which pins quay.io/minio/minio@sha256:14cea493…. That digest also returns 401 anonymously, so the Helm install/upgrade smoke test in pr-helm-chart.yml will fail the same way. - deploy/runtime-mirror-images.txt (quay.io/minio/minio:latest minio:latest). This is harmless while the mirror target already exists, because the script skips existing images, but it can no longer be re-mirrored from that source. The runtime/release stack does not depend on MinIO, so production deployments are not affected.
   为何进入 core:

   • 触及高风险区域，未经 maintainer 审查不应直接信任自动修复
   • 大概率跨多个模块或公共兼容面
   • 提到敏感区域（auth, token, credential）
     复现路径或操作路径:
   • 1. Run make dev-all on a clean machine (no cached MinIO image), or look at any recent E2E (Real Services) run, e.g. fix(web): bump undici override to ^7.29.1 #919: run 37119717963, both attempts.
   • 2. The compose pull fails:
   • minio Error unauthorized: access to the requested resource is not authorized
   • Error response from daemon: unauthorized: access to the requested resource is not authorized
   • make[1]: *** [Makefile:33: dev] Error 1
     怀疑影响区域:
   • 技能安装流程与 registry/lockfile 集成
   • 认证、会话与身份集成
     重点风险:
   • 提到敏感区域（auth, token, credential）
     验证清单:
   • 按 issue 中的复现步骤逐条回放，确认报告的问题已消失
   • 确认最终行为符合 issue 期望

   下一步

   • 交给 core maintainer，并结合本地编程Agent协助完成复现、收敛范围与验证闭环
4. X77seven commented on Oct 8, 2026

   

   X77seven

   on Oct 8, 2026

   Contributor

   More actions

   /claim
5. XiaoSeS

   closed this as completedin #925on Oct 8, 2026