Summary

Organization-level mirror from quay.io discovery returns 0 repositories when source registry credentials are provided, even though the source namespace contains public repositories. Removing the credentials allows discovery to work correctly.

This also happens when the source Organization contains public repo and private repo

Steps to Reproduce

1. Deploy Quay 3.17.0 with organization mirroring enabled (FEATURE_ORG_MIRROR: true)
2. Create an organization (e.g. org1) with a robot account
3. Configure organization mirroring:

• Source Registry Type: Quay
• Source Registry URL: https://quay.io
• Source Namespace: seanorg (has 1 public repo: testrepo)
• Provide source registry credentials (username/password)
• Trigger sync (Sync Now or wait for scheduled sync)
• Check the Logs tab or mirror worker logs

Actual Results

Discovery completes with 0 repos discovered:

Organization mirror sync started - Starting repository discovery for organization 'org1'
Organization mirror sync completed successfully - Discovery completed: 0 repos discovered, 0 new

No repositories are mirrored.

Expected Results

Discovery should find the public repository (testrepo) in the seanorg namespace regardless of whether source credentials are provided.

Test Environment

• Quay 3.17.0 quay.io/redhat-user-workloads/quay-eng-tenant/stable-3-17-v4-20@sha256:6ea9f4f897940f15124aeb3075d625e1b1c91f5986d37950989949eb722f773e
• Reproduced on two separate OCP dev clusters with fresh Quay deployments
• Source: quay.io/seanorg (1 public repo)

How Reproducible

Always (100%)

Additional Info

Workaround: Remove source registry credentials from the org mirror configuration when mirroring public repositories. 

Related: PROJQUAY-10675 (the fix for that issue likely introduced this regression)