[Bug] when storage.provider is s3, The ensureBucketExists method always failing.

[flyer5200]

Summary

When using Alibaba Cloud OSS or Tencent Cloud COS, the head method is used to check if the bucket exists, but the ensureBucketExists method always throws a 403 exception, even though my ak/sk permissions are sufficient.

java error statck:

Caused by: software.amazon.awssdk.services.s3.model.S3Exception: null (Service: S3, Status Code: 403, Request ID: 69CFD7853748B7323033EA64)
at software.amazon.awssdk.protocols.xml.internal.unmarshall.AwsXmlPredicatedResponseHandler.handleErrorResponse(AwsXmlPredicatedResponseHandler.java:156) ~[aws-xml-protocol-2.20.26.jar:na]
at software.amazon.awssdk.protocols.xml.internal.unmarshall.AwsXmlPredicatedResponseHandler.handleResponse(AwsXmlPredicatedResponseHandler.java:108) ~[aws-xml-protocol-2.20.26.jar:na]
at software.amazon.awssdk.protocols.xml.internal.unmarshall.AwsXmlPredicatedResponseHandler.handle(AwsXmlPredicatedResponseHandler.java:85) ~[aws-xml-protocol-2.20.26.jar:na]
at software.amazon.awssdk.protocols.xml.internal.unmarshall.AwsXmlPredicatedResponseHandler.handle(AwsXmlPredicatedResponseHandler.java:43) ~[aws-xml-protocol-2.20.26.jar:na]
at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler$Crc32ValidationResponseHandler.handle(AwsSyncClientHandler.java:95) ~[aws-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.handler.BaseClientHandler.lambda$successTransformationResponseHandler$7(BaseClientHandler.java:270) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.stages.HandleResponseStage.execute(HandleResponseStage.java:40) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.stages.HandleResponseStage.execute(HandleResponseStage.java:30) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptTimeoutTrackingStage.execute(ApiCallAttemptTimeoutTrackingStage.java:73) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptTimeoutTrackingStage.execute(ApiCallAttemptTimeoutTrackingStage.java:42) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.stages.TimeoutExceptionHandlingStage.execute(TimeoutExceptionHandlingStage.java:78) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.stages.TimeoutExceptionHandlingStage.execute(TimeoutExceptionHandlingStage.java:40) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptMetricCollectionStage.execute(ApiCallAttemptMetricCollectionStage.java:50) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptMetricCollectionStage.execute(ApiCallAttemptMetricCollectionStage.java:36) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage.execute(RetryableStage.java:81) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage.execute(RetryableStage.java:36) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.StreamManagingStage.execute(StreamManagingStage.java:56) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.StreamManagingStage.execute(StreamManagingStage.java:36) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.executeWithTimer(ApiCallTimeoutTrackingStage.java:80) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.execute(ApiCallTimeoutTrackingStage.java:60) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.execute(ApiCallTimeoutTrackingStage.java:42) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallMetricCollectionStage.execute(ApiCallMetricCollectionStage.java:48) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallMetricCollectionStage.execute(ApiCallMetricCollectionStage.java:31) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.stages.ExecutionFailureExceptionReportingStage.execute(ExecutionFailureExceptionReportingStage.java:37) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.pipeline.stages.ExecutionFailureExceptionReportingStage.execute(ExecutionFailureExceptionReportingStage.java:26) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.http.AmazonSyncHttpClient$RequestExecutionBuilderImpl.execute(AmazonSyncHttpClient.java:193) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.invoke(BaseSyncClientHandler.java:103) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.doExecute(BaseSyncClientHandler.java:171) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.lambda$execute$1(BaseSyncClientHandler.java:82) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.measureApiCallSuccess(BaseSyncClientHandler.java:179) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.execute(BaseSyncClientHandler.java:76) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.core.client.handler.SdkSyncClientHandler.execute(SdkSyncClientHandler.java:45) ~[sdk-core-2.20.26.jar:na]
at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.execute(AwsSyncClientHandler.java:56) ~[aws-core-2.20.26.jar:na]
at software.amazon.awssdk.services.s3.DefaultS3Client.headBucket(DefaultS3Client.java:5249) ~[s3-2.20.26.jar:na]
at com.iflytek.skillhub.storage.S3StorageService.ensureBucketExists(S3StorageService.java:72) ~[classes/:na]
at com.iflytek.skillhub.storage.S3StorageService.init(S3StorageService.java:67) ~[classes/:na]
at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104) ~[na:na]
at java.base/java.lang.reflect.Method.invoke(Method.java:565) ~[na:na]
at org.springframework.beans.factory.annotation.InitDestroyAnnotationBeanPostProcessor$LifecycleMethod.invoke(InitDestroyAnnotationBeanPostProcessor.java:457) ~[spring-beans-6.1.4.jar:6.1.4]
at org.springframework.beans.factory.annotation.InitDestroyAnnotationBeanPostProcessor$LifecycleMetadata.invokeInitMethods(InitDestroyAnnotationBeanPostProcessor.java:401) ~[spring-beans-6.1.4.jar:6.1.4]
at org.springframework.beans.factory.annotation.InitDestroyAnnotationBeanPostProcessor.postProcessBeforeInitialization(InitDestroyAnnotationBeanPostProcessor.java:219) ~[spring-beans-6.1.4.jar:6.1.4]
... 49 common frames omitted

Steps To Reproduce

setting application-local.yml，use profile：local startup app.

SKILLHUB_STORAGE_PROVIDER: s3
SKILLHUB_STORAGE_S3_ENDPOINT: 'https://oss-cn-hangzhou.aliyuncs.com'
SKILLHUB_STORAGE_S3_BUCKET: 'mybucket'
SKILLHUB_STORAGE_S3_ACCESS_KEY: 'my_access_key'
SKILLHUB_STORAGE_S3_SECRET_KEY: 'my_secret_key'
SKILLHUB_STORAGE_S3_REGION: 'cn-hangzhou'

Expected Behavior

When using Alibaba Cloud OSS or Tencent Cloud COS, The ensureBucketExists method should execute normally.

Perhaps the software.amazon.awssdk uses some non-standard S3 protocol headers, which cloud vendors' object storage products cannot fully support.

Environment

No response

API Contract Impact

No response

Logs Or Screenshots

No response

[Tutututu2020]

The current code uses headBucket in S3StorageService.init() -> ensureBucketExists(). But this call might throw a 403 error when accessing Alibaba Cloud OSS via its S3-compatible interface. It's better to switch to listObjectsV2(maxKeys=1) for checking accessibility—this way, the compatibility will be more reliable.

[wowo-zZ]

Issue Triage

• Route: triage/core
• Priority: priority/p1 (4.1/5)
• Effort: effort/l (5/5)
• Confidence: 5/5
• Risk: high
• Analysis Mode: llm-shadow

Why

• Touches core SkillHub workflows (api, cli).
• Contains urgency signals (failure, cannot).

LLM Assist

• Provider: openai-compatible
• Model: astron-code-latest
• Mode: shadow
• Status: fresh assessment
• Summary: When using S3-compatible storage (Alibaba Cloud OSS, Tencent Cloud COS), the ensureBucketExists method using headBucket API throws 403 error due to protocol incompatibility. Suggested fix is to use listObjectsV2 instead.

High-Risk Signals

• Mentions sensitive areas (permission, secret, sdk).

Maintainer Brief

Summary: When using S3-compatible storage (Alibaba Cloud OSS, Tencent Cloud COS), the ensureBucketExists method using headBucket API throws 403 error due to protocol incompatibility. Suggested fix is to use listObjectsV2 instead.
Why core:

• Touches a higher-risk area where automated fixes should not be trusted without maintainer review.
• Likely spans multiple modules or a public compatibility surface.
• Mentions sensitive areas (permission, secret, sdk).
  Reproduction or operator path:
• setting application-local.yml，use profile：local startup app.
• SKILLHUB_STORAGE_PROVIDER: s3
• SKILLHUB_STORAGE_S3_ENDPOINT: 'https://oss-cn-hangzhou.aliyuncs.com'
• SKILLHUB_STORAGE_S3_BUCKET: 'mybucket'
• SKILLHUB_STORAGE_S3_ACCESS_KEY: 'my_access_key'
  Suspected areas:
• Local skill sync flow and publish diff detection
• Authentication, session, and identity integration
• Public API contract, generated SDKs, and compatibility surface
  Risks to watch:
• Mentions sensitive areas (permission, secret, sdk).
  Validation checklist:
• Replay the exact reproduction steps from the issue and confirm the reported failure disappears.
• Confirm the final behavior matches the issue's expected outcome: When using Alibaba Cloud OSS or Tencent Cloud COS, The ensureBucketExists method should execute normally. Perhaps the software.amazon.awssdk uses some non-standard S3 protocol headers, which cloud vendors' object storage products cannot fully support.
• Check for downstream API/SDK/CLI compatibility expectations before shipping.

Next Action

• Hand the issue to a core maintainer and use a local programming agent for reproduction, scoping, and validation.

---

问题分流结果

• 路由: triage/core
• 优先级: priority/p1 (4.1/5)
• 修复投入: effort/l (5/5)
• 信息完整度: 5/5
• 风险: 高
• 分析模式: llm-shadow

原因

• 涉及 SkillHub 核心流程（api, cli）
• 包含紧急信号（failure, cannot）

AI 辅助

• 服务商: openai-compatible
• 模型: astron-code-latest
• 模式: shadow
• 状态: 新鲜评估
• 摘要: 使用阿里云 OSS 或腾讯云 COS 等 S3 兼容存储时，ensureBucketExists 方法因 headBucket API 兼容性问题导致 403 错误。建议改用 listObjectsV2 检查存储桶可访问性。

高风险信号

• 提到敏感区域（permission, secret, sdk）

维护者交接摘要

概要: 使用阿里云 OSS 或腾讯云 COS 等 S3 兼容存储时，ensureBucketExists 方法因 headBucket API 兼容性问题导致 403 错误。建议改用 listObjectsV2 检查存储桶可访问性。
为何进入 core:

• 触及高风险区域，未经 maintainer 审查不应直接信任自动修复
• 大概率跨多个模块或公共兼容面
• 提到敏感区域（permission, secret, sdk）
  复现路径或操作路径:
• setting application-local.yml，use profile：local startup app.
• SKILLHUB_STORAGE_PROVIDER: s3
• SKILLHUB_STORAGE_S3_ENDPOINT: 'https://oss-cn-hangzhou.aliyuncs.com'
• SKILLHUB_STORAGE_S3_BUCKET: 'mybucket'
• SKILLHUB_STORAGE_S3_ACCESS_KEY: 'my_access_key'
  怀疑影响区域:
• 本地技能同步流程与发布 diff 检测
• 认证、会话与身份集成
• 公开 API 契约、生成 SDK 与兼容性表面
  重点风险:
• 提到敏感区域（permission, secret, sdk）
  验证清单:
• 按 issue 中的复现步骤逐条回放，确认报告的问题已消失
• 确认最终行为符合 issue 期望
• 发布前检查下游 API/SDK/CLI 的兼容性预期

下一步

• 交给 core maintainer，并结合本地编程Agent协助完成复现、收敛范围与验证闭环