Skip to content

fix(ci): pull MinIO from Chainguard and stop test mocks leaking - #407

Merged
setkyar merged 2 commits into
mainfrom
fix/ci-minio-image-and-test-mocks
Oct 5, 2026
Merged

setkyar merged 2 commits into
mainfrom
fix/ci-minio-image-and-test-mocks

Conversation

@setkyar

@setkyar setkyar commented Sep 26, 2026

Copy link
Copy Markdown
Contributor

Summary

CI is red on every PR right now for two unrelated reasons. Neither comes from a code change on main.

Integration jobs (ts-integration, go-integration)

  • MinIO's own images (quay.io/minio/minio, docker.io/minio/minio, and the mc images) now answer anonymous pulls with unauthorized.
  • CI and docker-compose.yml now use Chainguard's public MinIO build (cgr.dev/chainguard/minio). It is the same server and includes mc.
  • CI pins the image by digest and creates the bucket with docker exec minio-ci mc …, so no separate client image is needed.
  • In compose, minio-init uses the same image, and minio runs as 0:0: the image defaults to a non-root user that cannot open data volumes created by the old root-run image.

ts-unit

  • notification-ssr-regression.test.ts and ProtectedRoute.test.tsx replaced react-i18next, react-router, and the workspace/auth contexts with partial stubs. Bun's mock.module keeps a stub for every file that runs later in the same process.
  • When the SSR test runs early, as it does on current runners, later files fail on missing exports (initReactI18next, useHasRole, Navigate).
  • Each stub now spreads the real module and overrides only what its test needs.

Testing

  • Ran the CI MinIO steps locally with the pinned digest: server live, whatsapp-media bucket created.
  • Ran compose minio + minio-init in an isolated project: healthcheck passes, and the bucket is created and set to private. MinIO starts on both a fresh volume and a root-owned one like existing local installs have.
  • Ran the SSR test followed by each failing file (i18n, useRemoteHistory, MessageReply, ProtectedRoute): each fails on main and passes on this branch.
  • Full web suite passes (718/718), tsc -p apps/web is clean, and biome lint apps/web is clean.

MinIO's own images on quay.io and Docker Hub now answer anonymous pulls
with "unauthorized", so both integration jobs fail before a test runs
and `docker compose up` cannot start local storage. Switch CI and the
compose file to Chainguard's public MinIO build, which is the same
server and ships with mc. CI pins the digest and creates the bucket
with the server container's own mc, so no separate client image is
needed. Compose runs it as root because the image defaults to a
non-root user that cannot open volumes created by the old image.

The web unit job failed for an unrelated reason. Two tests replaced
react-i18next, react-router, and the workspace/auth contexts with
partial stubs, and bun's mock.module keeps those stubs for every file
that runs later in the process. On today's runners the notification SSR
test runs early, so later files lost exports such as initReactI18next
and useHasRole. Each stub now spreads the real module and overrides only
what the test needs.
@setkyar
setkyar merged commit a7043d5 into main Oct 5, 2026
9 checks passed
@setkyar
setkyar deleted the fix/ci-minio-image-and-test-mocks branch October 5, 2026 15:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant