Build the CI MinIO container from the GHCR mirror (PP-5244)

[dbernstein]

Description

Switches docker/Dockerfile.minio.ci from quay.io/minio/minio:latest, which no longer permits
anonymous pulls, to the Palace mirror:

-FROM quay.io/minio/minio:latest AS minio
+# MinIO withdrew anonymous public access to its own image from both Docker Hub and quay.io, so
+# this pulls from the Palace mirror of the upstream release instead. The mirror is an unmodified
+# MinIO build, published from the ci-scripts repo:
+# https://github.com/ThePalaceProject/ci-scripts/blob/main/images/minio/Dockerfile
+# The tag is pinned deliberately; the mirror publishes no `latest`.
+FROM ghcr.io/thepalaceproject/palace-ci-minio:RELEASE.2025-09-07T16-13-09Z AS minio

That is the whole change: one FROM line, plus a comment recording why it points somewhere
unusual. The mirror is an unmodified MinIO build, so the credentials, ports and command below the
FROM are untouched.

The mirror is published and public: ghcr.io/thepalaceproject/palace-ci-minio is live at digest
sha256:0e8998d7ba6f742bac3c6ad22f354979b987d5d31c0a95b9b0dcad9d73e32751 with linux/amd64 and
linux/arm64, and an anonymous (unauthenticated) manifest request returns 200.

It is published from ci-scripts rather than from
here, because the image is shared by three repos and belongs to none of them in particular.
Companion one-line changes: ThePalaceProject/library-registry#1066 and
ThePalaceProject/virtual-library-card#1016. The three are independent and can merge in any order.

Motivation and Context

JIRA

All tox-docker CI jobs currently fail on main while building the MinIO test container:

docker.errors.BuildError: unauthorized: access to the requested resource is not authorized

MinIO has withdrawn anonymous public access to its server image from Docker Hub (~13 Sept, worked
around in #3728 by moving to quay.io) and now from quay.io as well.
Ten checks fail on main: Tests (Py 3.12 / 3.13 / 3.14), OpenSearch 2.19, OpenSearch 3.5, Unit
tests (amd64 / arm64), Integration test (amd64 / arm64) and the Backwards compatibility test. Lint,
mypy, CodeQL, the Migration test and the Docker build are unaffected because they do not use
tox-docker. Local tox fails identically, so developers cannot run the suites either.

Pinning an older tag does not help — the whole upstream repository is gated, not just :latest —
and neither does a local Docker cache, because tox_docker passes pull=True on every build.

Full background, registry probes and the retirement plan are in ThePalaceProject/ci-scripts#2.

How Has This Been Tested?

This PR's own CI is the acceptance test, and it passes. All ten checks listed above are green
against the published mirror, including the Backwards compatibility test and both Integration and
Unit test jobs on amd64 and arm64.

Locally, tox -e py312-docker -- -m minio was run against the real
ghcr.io/thepalaceproject/palace-ci-minio reference with the image first cleared from the local
Docker cache, so the pull genuinely came from GHCR:

py312-docker: docker> build .../docker/Dockerfile.minio.ci target 'minio'
py312-docker: docker> run '2827512c875a' (from 'minio-circ')
py312-docker: commands[0]> pytest -m minio --no-cov -q
14 passed in 16.48s

Before the mirror was published, the same chain was exercised by pushing the image to a throwaway
registry:2 on localhost and temporarily pointing this FROM line at it — tox_docker passes
pull=True on every build, so a local-only tag is rejected and a real registry is required either
way. That run also gave 14 passed.

Checklist

• I have updated the documentation accordingly.
• All new and existing tests passed.

🤖 Generated with Claude Code

[claude]

Claude finished @dbernstein's task in 56s —— View job

---

Summary

I found nothing to change. The PR swaps the unpullable quay.io/minio/minio:latest base for the pinned GHCR mirror (ghcr.io/thepalaceproject/palace-ci-minio:RELEASE.2025-09-07T16-13-09Z) and adds a comment explaining why the tag is pinned. docker/Dockerfile.minio.ci is used in two places. One is tox's [docker:minio-circ] in tox.ini. The other is the minio service in docker-compose.yml, which docker/ci/test_backwards_compatibility.sh uses. Both pick up the new image with no other edits. Nothing else in the repo refers to quay.io or minio/minio. Dependabot doesn't watch the Docker ecosystem, so it won't try to bump the pinned tag. The Greptile "not safe to merge" finding is about src/palace/manager/sqlalchemy/model/work.py (classification repair), and it also mentions SAML, a migration and dependency changes. None of those are in this diff: git diff origin/main...HEAD touches only docker/Dockerfile.minio.ci. Greptile seems to have reviewed a different diff, so its finding doesn't apply to this PR. The tox-docker Test workflow for this commit was still running when I checked, so CI hasn't yet confirmed the fix.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

Summary

The PR switches the CI MinIO image from quay.io to the Palace GHCR mirror at a pinned release tag. There have been no changes since the previous review.

_{Reviews (3) · Last reviewed commit: "Build the CI MinIO container from the GH..."}

[greptile-apps]

Comments Outside Diff

These findings sit on lines the diff does not cover, so they could not be posted inline. Each one leaves this list once its file changes.

•  Incorrect nonfiction status persists src/palace/manager/sqlalchemy/model/work.py:1413 ▶

  When the repair reclassifies a BISAC subject that was wrongly marked nonfiction, that subject may now provide no fiction-status evidence. If it was the Work’s only such evidence, these lines pass the Work’s old False value back as the classifier default. The subject stops voting nonfiction, but the Work remains incorrectly marked nonfiction, and its genres are filtered using that incorrect status.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.71%. Comparing base (baa5125) to head (374f27c).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3767      +/-   ##
==========================================
- Coverage   93.72%   93.71%   -0.01%     
==========================================
  Files         510      510              
  Lines       46510    46510              
  Branches     6313     6313              
==========================================
- Hits        43590    43589       -1     
- Misses       1886     1887       +1     
  Partials     1034     1034              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[dbernstein]

Comments Outside Diff

These findings sit on lines the diff does not cover, so they could not be posted inline. Each one leaves this list once its file changes.

•  Incorrect nonfiction status persists src/palace/manager/sqlalchemy/model/work.py:1413 ▶
  When the repair reclassifies a BISAC subject that was wrongly marked nonfiction, that subject may now provide no fiction-status evidence. If it was the Work’s only such evidence, these lines pass the Work’s old False value back as the classifier default. The subject stops voting nonfiction, but the Work remains incorrectly marked nonfiction, and its genres are filtered using that incorrect status.

This shouldn't be here. I'm talking to Claude about how it might have popped up. Regardless it has nothing to do with this PR.