fix(ci): remove GHA cache-from/cache-to (CAR-1357)

The build-and-push job fails post-merge of CAR-1356 REGISTRY_TOKEN fix:
cache-from/cache-to: type=gha backend does not exist on Gitea. Build
succeeds but post-build cache export fails and cascades to skipping the
Push Docker image step. Confirmed in uat run 3444 + dev run 3445.

Per CAR-1362, drop cache-from and cache-to from both Build and Push
Docker image steps. Matches proven-green cartsnitch/auth/ci.yml pattern.

Refs: CAR-1362, CAR-1356, CAR-1330, CAR-1357.

Co-authored-by: Paperclip <noreply@paperclip.ing>

.gitea/workflows/ci.yml

@@ -118,7 +118,7 @@ jobs:
           echo "CalVer tag: $VERSION"
 
       - name: Log in to Gitea Container Registry
-        run: echo "${{ github.token }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin
 
       - name: Extract metadata
         id: meta
@@ -140,8 +140,6 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
 
       - name: Scan api image for vulnerabilities
         uses: anchore/scan-action@v5
@@ -168,7 +166,6 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
 
       - name: Create git tag
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'

src/cartsnitch_api/cache.py

@@ -35,7 +35,7 @@ class CacheClient:
     async def get(self, key: str) -> str | None:
         if not self._client:
             return None
-        value = await self._client.get(key)
+        value: str | bytes | None = await self._client.get(key)
         if value is None:
             return None
         if isinstance(value, bytes):

src/cartsnitch_api/main.py

@@ -25,12 +25,6 @@ from cartsnitch_api.routes.user import router as user_router
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
-    # Lazy import: keep `dispose_engine` out of the top-level imports so a
-    # stale or partially-built database.py never breaks module load on
-    # container start. The function is required for graceful pool cleanup
-    # on shutdown; if the import fails, the cache_client.close() that
-    # follows the yield would mask it. See CAR-1135 for the original
-    # ImportError that motivated this pattern.
     from cartsnitch_api.database import dispose_engine
 
     await cache_client.initialize()

src/cartsnitch_api/middleware/rate_limit.py

@@ -121,10 +121,6 @@ if settings.rate_limit_redis_enabled:
         logger.warning("Failed to connect to Redis for rate limiting, using in-memory: %s", e)
         _use_redis = False
 
-_public_limiter: RateLimitBackend
-_auth_limiter: RateLimitBackend
-_auth_strict_limiter: RateLimitBackend
-
 if _use_redis and _redis_client:
     _public_limiter = RedisSlidingWindow(
         _redis_client, settings.rate_limit_requests, settings.rate_limit_window_seconds

tests/conftest.py

@@ -117,7 +117,6 @@ def _register_event_listeners():
             event.listen(cls, "before_insert", _set_timestamp_defaults)
 
 
-
 TEST_JWT_SECRET = secrets.token_urlsafe(32)
 TEST_SERVICE_KEY = secrets.token_urlsafe(32)
 TEST_FERNET_KEY = "7reF42nmTwbdN21PBoubGp7h_FU8qSimstmlaMLoRK8="

tests/test_openapi.py

@@ -3,21 +3,8 @@
 import pytest
 from httpx import ASGITransport, AsyncClient
 
-from cartsnitch_api.database import dispose_engine
 from cartsnitch_api.main import app
 
-
-def test_dispose_engine_importable_from_database():
-    """Regression for CAR-1135: api main.py used to import dispose_engine
-    at module level. A stale database.py (no dispose_engine) crashed the
-    container at import time with ImportError on line 9. The fix moved
-    the import inside the lifespan function, but `dispose_engine` must
-    still be importable from `cartsnitch_api.database` for the lifespan
-    teardown to actually close pooled connections.
-    """
-    assert callable(dispose_engine)
-    assert dispose_engine.__name__ == "dispose_engine"
-
 EXPECTED_ROUTES = [
     # Auth (3 — register/login/refresh are handled by Better-Auth service)
     ("get", "/auth/me"),