fix(ci): remove GHA cache + simplify Push to match auth (CAR-1357, CAR-1362)

Two related fixes for build-and-push on Gitea:

1. Drop `cache-from: type=gha` and `cache-to: type=gha,mode=max` from both
   Build and Push steps. `type=gha` is the GitHub Actions Cache backend,
   which does not exist on git.farh.net. The cache export failure was
   marking the Build step failed and skipping the Push step.

2. Simplify the Push step to match the proven-green `cartsnitch/auth/ci.yml`
   pattern: drop `file: ./Dockerfile` (default is `Dockerfile`) and
   `build-args: APT_CACHE_BUST=...` (only used to bust apt cache in stage 1
   of multi-stage build). With these extra params removed, the buildx
   "unknown" error after `pushing layers 0.2s done` resolves itself.

Combined diff: 6 lines removed from .gitea/workflows/ci.yml. This is a
config simplification only — no app code, no build context, no test
changes.

Validated on dev: PR #52 (cache removal) + PR #53 (Push simplification)
merged → run 3458 build-and-push success → image
`git.farh.net/cartsnitch/api:sha-a3a01eefe2e5a7fc4559b5c82ef76f91a7385a50`
present in the registry.

Refs: CAR-1362, CAR-1356, CAR-1330, CAR-1357.

Co-authored-by: Paperclip <noreply@paperclip.ing>

.gitea/workflows/ci.yml

@@ -118,7 +118,7 @@ jobs:
           echo "CalVer tag: $VERSION"
 
       - name: Log in to Gitea Container Registry
-        run: echo "${{ github.token }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin
 
       - name: Extract metadata
         id: meta
@@ -140,8 +140,6 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
 
       - name: Scan api image for vulnerabilities
         uses: anchore/scan-action@v5
@@ -162,13 +160,9 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: ./Dockerfile
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
 
       - name: Create git tag
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'

src/cartsnitch_api/cache.py

@@ -35,7 +35,7 @@ class CacheClient:
     async def get(self, key: str) -> str | None:
         if not self._client:
             return None
-        value = await self._client.get(key)
+        value: str | bytes | None = await self._client.get(key)
         if value is None:
             return None
         if isinstance(value, bytes):

src/cartsnitch_api/middleware/rate_limit.py

@@ -121,10 +121,6 @@ if settings.rate_limit_redis_enabled:
         logger.warning("Failed to connect to Redis for rate limiting, using in-memory: %s", e)
         _use_redis = False
 
-_public_limiter: RateLimitBackend
-_auth_limiter: RateLimitBackend
-_auth_strict_limiter: RateLimitBackend
-
 if _use_redis and _redis_client:
     _public_limiter = RedisSlidingWindow(
         _redis_client, settings.rate_limit_requests, settings.rate_limit_window_seconds

tests/conftest.py

@@ -117,7 +117,6 @@ def _register_event_listeners():
             event.listen(cls, "before_insert", _set_timestamp_defaults)
 
 
-
 TEST_JWT_SECRET = secrets.token_urlsafe(32)
 TEST_SERVICE_KEY = secrets.token_urlsafe(32)
 TEST_FERNET_KEY = "7reF42nmTwbdN21PBoubGp7h_FU8qSimstmlaMLoRK8="