feat(selfhost): add n8n workflows and MinIO object storage compose profiles (#1219)

[andriypolanski]

Closes #1219

Summary

• Adds two optional self-host Docker Compose profiles from #1219: --profile workflows (n8n automation at :5678) and --profile storage (MinIO S3 API :9000 + console :9001).
• Ships bundled n8n workflow templates under n8n/workflows/ (Slack review notify, daily gate summary, issue auto-triage) for import at http://localhost:5678/workflows/import.
• Documents n8n/MinIO/Litestream→MinIO env vars in .env.example. No src/** changes — review engine has zero dependency on either service.

Maintainer context (JSONbored, Jul 14, 2026)

PR #1234 references this issue but implements an unrelated feature (POST /v1/orb/ingest, an Orb telemetry collector endpoint) — likely a mislink. No n8n or MinIO docker-compose profiles exist in the repo yet; this issue's scope remains fully open.

This PR implements the open scope; it does not touch Orb ingest.

Change

• docker-compose.yml
  • New n8n service (profiles: ["workflows"]) with basic auth, persistent n8n-data volume, and a runtime fail-closed entrypoint when N8N_PASSWORD is unset.
  • New minio service (profiles: ["storage"]) with S3 API + console ports and minio-data volume.
  • Profile header comments + examples updated.
  • Uses soft env defaults (:-) instead of hard :? so default docker compose up stays green when profiles are inactive — same pattern as BROWSERLESS_TOKEN, REES_SHARED_SECRET, and GRAFANA_ADMIN_PASSWORD. Password/credential checks fail closed at container start when the profile is active.
  • MinIO healthcheck omitted: minio/minio:latest is scratch/distroless (no shell/mc), same constraint as Loki in this file.
• n8n/workflows/ — review-slack-notify.json, gate-daily-summary.json, issue-auto-triage.json
• .env.example — n8n, MinIO, and Litestream→MinIO wiring docs
• test/unit/selfhost-compose-workflows-storage.test.ts — structural regression guard (profiles, ports, env posture, templates, .env.example docs)

Closes #1219

---

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• Focused change: compose + env docs + workflow templates + structural tests only.
• No src/** changes (Codecov patch scope clean).
• Linked issue: Closes selfhost(workflows): n8n orchestration + MinIO object storage — automation and artifact persistence #1219.

Validation

• git diff --check
• npm run actionlint (not run — no workflow changes)
• npm run typecheck (not run — no src/** changes)
• npm run test:coverage (not run — no src/** changes)
• npm run test:workers (not run)
• npm run build:mcp / npm run test:mcp-pack (not run)
• npm run ui:openapi:check (not run)
• npm run ui:lint / npm run ui:typecheck / npm run ui:build (not run)
• npm audit --audit-level=moderate
• npm run test -- --run test/unit/selfhost-compose-workflows-storage.test.ts — 10 passing

Run full npm run test:ci before push (required gate).

Safety

• No secrets, wallet details, hotkeys, trust scores, or private rankings exposed.
• Optional services only — zero impact on default stack when profiles inactive.
• No API/OpenAPI/MCP/runtime behavior change.
• No changelog edit.

UI Evidence

No visible UI change. Compose profiles, env documentation, workflow templates, and structural tests only — no screenshots required.

Operator notes

# n8n only (set N8N_PASSWORD in .env first):
docker compose --profile workflows up -d

# MinIO only (set MINIO_ROOT_USER + MINIO_ROOT_PASSWORD in .env first):
docker compose --profile storage up -d

# Both:
docker compose --profile workflows --profile storage up -d

# Point Litestream at local MinIO (with --profile storage + --profile litestream):
# LITESTREAM_ENDPOINT=http://minio:9000
# LITESTREAM_ACCESS_KEY_ID=<MINIO_ROOT_USER>
# LITESTREAM_SECRET_ACCESS_KEY=<MINIO_ROOT_PASSWORD>

[superagent-security]

Superagent found 2 security concern(s).

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-14 19:56:16 UTC}

7 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): .github/workflows/selfhost.yml (matched .github/workflows/**).

Review summary
This PR adds two optional, off-by-default Docker Compose profiles (n8n workflow automation and MinIO object storage) plus bundled n8n workflow JSON templates, .env.example documentation, and a structural (non-shell-out) unit test validating the compose YAML shape. It correctly follows the repo's existing soft-default env-var convention (`:-` instead of `:?`) to avoid breaking default `docker compose up`, fails closed at container start for n8n via a runtime password check, and pins both images to explicit tags rather than `:latest`. No `src/**` files are touched, so the review engine itself is unaffected, and the change closes the linked #1219 scope cleanly without touching the unrelated Orb ingest work mentioned in the description.

Nits — 6 non-blocking

• docker-compose.yml's new n8n `entrypoint` override drops the image's default CMD args instead of forwarding them (no `exec /docker-entrypoint.sh "$@​"`); this happens to be safe today only because n8n's own entrypoint script falls back to `exec n8n` when given zero args — worth an explicit comment or `"$@​"` forward so the behavior isn't accidentally relying on upstream-image internals.
• The new selfhost.yml CI step (`docker compose --profile workflows --profile storage config --quiet`) only validates YAML syntax/merge, not an actual container boot, so the fail-closed entrypoint check and MinIO's credential-required startup are never exercised end-to-end in CI.
• `.env.example` documents `MINIO_BUCKET=gittensory` (test/unit/selfhost-compose-workflows-storage.test.ts doesn't assert on it either), but no service in docker-compose.yml reads or auto-creates this bucket — either wire it up or drop the unused var to avoid confusing self-hosters.
• The bundled `gate-daily-summary.json` template posts to a hardcoded `https:​//example.com/webhook` placeholder by default; that's fine for a template but worth a one-line README/comment pointing at `n8n/workflows/` so users know to edit it before import.
• The added 'Free disk before visual-review image build' CI step (`docker image prune -f`, `docker builder prune`) is unrelated to the n8n/MinIO feature itself — reasonable as a side-effect of extra image weight in this PR, but consider splitting disk-space CI maintenance from a feature PR next time for a cleaner diff.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#1219
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 153 registered-repo PR(s), 97 merged, 25 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	andriypolanski; Gittensor profile; 153 PR(s), 25 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.
Improvement	⚠️ ℹ️ Insufficient signal	risk: clean · value: insufficient-signal — Nothing measurable for the structural-improvement analyzers on this PR (e.g. no code files changed).

Review context

• Author: andriypolanski
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 153 PR(s), 25 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.07%. Comparing base (c4f662a) to head (c981fb2).
⚠️ Report is 12 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5777   +/-   ##
=======================================
  Coverage   95.07%   95.07%           
=======================================
  Files         582      582           
  Lines       46221    46221           
  Branches    14823    14823           
=======================================
  Hits        43945    43945           
  Misses       1516     1516           
  Partials      760      760           

Flag	Coverage Δ
shard-1	43.94% <ø> (ø)
shard-2	35.76% <ø> (ø)
shard-3	32.24% <ø> (ø)
shard-4	32.93% <ø> (ø)
shard-5	31.73% <ø> (ø)
shard-6	44.64% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.