Skip to content

fix(deploy): replace archived MinIO with SeaweedFS in compose and e2e #180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cubeorgdev wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix(deploy): replace archived MinIO with SeaweedFS in compose and e2e #180

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e81acb8
fix(deploy): replace archived MinIO with SeaweedFS in compose and e2e
tomislav-blocks Nov 9, 2026
2c6031b
fix(deps): patch advisories failing the security gates
tomislav-blocks Nov 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/security-exceptions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,30 @@
"rationale": "This is the fingerprint of a deliberately public deterministic JWT signing key used only by the hermetic e2e-slim fixture.",
"compensating_control": "The key is confined to test fixtures, is not referenced by deployment manifests, and production startup requires externally supplied secrets.",
"expires": "2026-12-05"
},
{
"scanner": "npm-audit",
"owner": "platform-security",
"expires": "2026-12-05",
"identifier": "GHSA-965c-763c-88jm",
"rationale": "better-auth 1.7.7+ removes the issuer-scoped account model that the dashboard's account schema (account.issuer NOT NULL, unique issuer+accountId) and genericOAuth accountIssuer depend on, so the upgrade needs its own auth schema migration. The advisory needs the Magic Link plugin, which the dashboard never enables.",
"compensating_control": "lib/auth.ts registers only admin, jwt, organization, oauth-provider, device authorization, genericOAuth and nextCookies; with no Magic Link endpoint, OAuth state cannot be redeemed as a sign-in token. Tracked for removal by the better-auth 1.7.x upgrade."
},
{
"scanner": "npm-audit",
"owner": "platform-security",
"expires": "2026-12-05",
"identifier": "GHSA-r4xp-prcw-77qf",
"rationale": "Same blocked better-auth 1.7.7+ upgrade. The advisory needs the OAuth Proxy plugin with cookie-backed sign-in state, and the dashboard uses neither.",
"compensating_control": "The OAuth Proxy plugin is not registered and sign-in state uses the default database strategy, so no proxy endpoint decrypts attacker-supplied profiles. Tracked for removal by the better-auth 1.7.x upgrade."
},
{
"scanner": "npm-audit",
"owner": "platform-security",
"expires": "2026-12-05",
"identifier": "GHSA-44jh-23m7-hpcf",
"rationale": "Same blocked better-auth 1.7.7+ upgrade. The advisory affects the Drizzle adapter with database-backed rate limits; the dashboard uses the built-in pg/Kysely adapter, which is already fixed in 1.7.0.",
"compensating_control": "No Drizzle adapter is configured and rate-limit records use Better Auth's default storage rather than the PostgreSQL rate-limit table. Tracked for removal by the better-auth 1.7.x upgrade."
}
]
}
4 changes: 2 additions & 2 deletions .github/workflows/e2e-slim.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: End-to-end (slim)

# Slim e2e in two disjoint jobs (selection via nextest profiles, see
# tests/e2e-slim/.config/nextest.toml):
# * e2e-slim-governance — secret-free governance-only path (Postgres + MinIO +
# * e2e-slim-governance — secret-free governance-only path (Postgres + S3 store +
# JWKS sidecar + control-api), bootstrap/config/session-upload tests.
# * e2e-slim-gateway — secret-gated real-inference path (adds LiteLLM fed by
# OpenRouter + inference-proxy), per-agent certification tests only.
Expand Down Expand Up @@ -68,7 +68,7 @@ jobs:

e2e-slim-governance:
# Draft PRs skip Tier A -- it loads the production image and boots
# Postgres + MinIO + a JWKS sidecar + control-api, then walks the whole
# Postgres + S3 store + a JWKS sidecar + control-api, then walks the whole
# blessed-CLI-version matrix. Marking the PR ready for review fires
# `ready_for_review` (see the trigger above) and runs it.
if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
Expand Down
36 changes: 18 additions & 18 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,8 +96,8 @@ Once the services are healthy:
| Dashboard | <http://127.0.0.1:3000> |
| Control API | <http://127.0.0.1:8080> |
| PostgreSQL | `127.0.0.1:5433` |
| MinIO API | <http://127.0.0.1:9000> |
| MinIO console | <http://127.0.0.1:9001> |
| S3 API (SeaweedFS) | <http://127.0.0.1:9000> |
| SeaweedFS admin UI | <http://127.0.0.1:9001> |

The optional inference proxy (<http://127.0.0.1:8081>) starts only with the
`gateway` Compose profile.
Expand Down
Loading
Loading