Summary

The Harbor registry adapter for organization-level mirroring relies exclusively on the HTTP Link: next response header to paginate through repository listings. If this header is absent — regardless of whether more pages exist — discovery stops after the first page, silently returning at most page_size (default 100) repositories.

Affected File

• util/orgmirror/harbor_adapter.py:120–126

Bug Details

The pagination loop in HarborAdapter.list_repositories() has the following logic:

# Check Link header for rel="next" (Harbor API v2.0 spec)
has_next = "next" in response.links

if not has_next:
    break

page += 1

The only exit conditions are:

1. The response body is empty (if not data: break)
2. The Link: next header is absent

This means that if the Link: next header is missing for any reason — such as:

• A reverse proxy, load balancer, or API gateway stripping response headers
• Certain Harbor configurations or intermediate caching layers
• A Harbor version with non-standard Link header formatting that the requests library fails to parse
• Network infrastructure between the Quay worker and Harbor that modifies headers

...the discovery loop exits after the first page only, returning at most 100 repositories even when thousands exist.

Impact

This is a silent data loss bug: no error is raised, no warning is logged, and Quay reports the discovery as successful. The organization mirror then only syncs the first 100 repositories.

Example scenario: A Harbor project contains 10,000 repositories. Discovery returns 100 repos (one page). has_next is False because the header is absent. The loop exits. Quay proceeds to sync only those 100 repos, with no indication that 9,900 repos were missed.

Reproduction Conditions

• Source registry type: Harbor (API v2.0)
• Harbor project with more than page_size (default: 100) repositories
• Any infrastructure or configuration that strips or alters the Link response header

Expected Behavior

All repositories in the Harbor project should be discovered and queued for sync, regardless of whether the Link: next header is present in the response.

Actual Behavior

Discovery silently stops after the first page (100 repositories by default) if the Link: next header is absent, even when more repositories exist.

Additional Context

• The X-Total-Count response header is returned by Harbor API v2.0 and contains the total number of repositories, but is not currently used by the adapter.
• Standard REST API pagination best practices include fallback stop conditions based on the number of items returned per page, independent of headers.
• This issue is masked because no exception is raised and the discovery operation completes with a SUCCESS status.