Repository navigation
Build Images fails on main: Quay returns 401 for the apps-pack-* repositories #85
Description
Summary
Since #84 moved image builds onto the org reusable workflow (nebari-dev/.github pack-build-image.yaml), every push to main fails the Build Images workflow. The workflow pushes to GHCR and Quay in one step. GHCR succeeds, but Quay rejects all five images with 401 Unauthorized:
quay.io/nebari/apps-pack-operatorquay.io/nebari/apps-pack-apiquay.io/nebari/apps-pack-uiquay.io/nebari/apps-pack-mcpquay.io/nebari/apps-pack-proxy
The repositories don't exist on Quay, and the org's Quay robot account can't create them on push. First failing run: https://github.com/nebari-dev/apps-pack/actions/runs/39264549201 (aca8ce6).
Impact
ghcr.io/nebari-dev/apps-pack/<image>:sha-<short>images are still published, so deployments that pull from GHCR work.- Signing runs after the push, so images built since ci: build, sign and release through the org reusable workflows; scan images #84 are unsigned.
- The Build Images check stays red on
main, and a chart-bump release throughpack-release.yamlwill hit the same wall when it mirrors to Quay.
Fix
- A Quay org admin for
nebaricreates the five repositories above. - They give the org robot account used by
pack-build-image.yamlwrite access to each one. - Re-run the failed Build Images workflow on
mainand confirm the images are signed on both registries.
Alternative: if Quay isn't wanted for this pack, set the reusable workflow's input to skip Quay, if it has one, or revert #84's build-image.yaml change.
Activity
jbouder commentedon Oct 19, 2026
A lead for the fix:
pack-release.yaml(at the pinneda6c757c) saysnebari-dev/helm-repository'srelease-helm-charts.ymlruns an ensure-quay-repos step with aQUAY_API_TOKENscoped to that repo.pack-build-image.yamlhas no equivalent for image repositories, so they have to be created by hand, or the same ensure step has to be added to the image workflow upstream innebari-dev/.github.jbouder commentedon Oct 22, 2026
Still failing on
8fbc0dd(#168): https://github.com/nebari-dev/apps-pack/actions/runs/39708219707. All five publish jobs get the same Quay401, includingquay.io/nebari/apps-pack-apps-authz, which wasn't in the original list. The body is updated to list five repositories.The authz image is still needed after #168. The sidecar no longer enforces groups, but Apps that can idle and image Apps still run it in passthrough mode. GHCR publishing still works:
ghcr.io/nebari-dev/apps-pack/apps-*:sha-8fbc0ddexists for all five images on amd64 and arm64.jbouder commentedon Oct 22, 2026
Since #169 (
6338bd9) the images drop the doubledapps-, so the five Quay repositories to create are:quay.io/nebari/apps-pack-operatorquay.io/nebari/apps-pack-authzquay.io/nebari/apps-pack-apiquay.io/nebari/apps-pack-uiquay.io/nebari/apps-pack-mcpThese match the other packs on the shared workflow (
llm-serving-pack-operator, …). The body is updated. The oldapps-pack-apps-*names were never created and are no longer needed.[-]Build Images fails on main: Quay returns 401 for the apps-pack-apps-* repositories[/-][+]Build Images fails on main: Quay returns 401 for the apps-pack-* repositories[/+]jbouder commentedon Oct 22, 2026
The authz sidecar is being renamed to proxy in #174 (it no longer checks tokens or groups since #168), so the fifth repository to create is
quay.io/nebari/apps-pack-proxy, notapps-pack-authz. The body is updated. The other four names are unchanged.Please create the repositories before the 0.2.0 release PR merges: the release builds and pins the images on the same push.
refactor!: rename the authz sidecar to proxy (#174)
viniciusdc commentedon Oct 22, 2026
@jbouder repos have been created and bot account was given "write" access on quay over those new repos.
jbouder commentedon Oct 26, 2026
Works now as expected