ci: push Docker images to Gitea registry (git.farh.net)

.github/workflows/ci.yml

@@ -16,12 +16,12 @@ permissions:
   security-events: write
 
 env:
-  REGISTRY: ghcr.io
+  REGISTRY: git.farh.net
   IMAGE_NAME: cartsnitch/app
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -35,7 +35,7 @@ jobs:
         run: npx tsc --noEmit
 
   test:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -47,7 +47,7 @@ jobs:
         run: npx vitest run
 
   audit:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -59,7 +59,7 @@ jobs:
         run: npm audit --audit-level=high
 
   e2e:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -71,7 +71,7 @@ jobs:
       - run: npx playwright test
 
   lighthouse:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     needs: [test]
     steps:
       - uses: actions/checkout@v4
@@ -96,7 +96,7 @@ jobs:
           CHROME_PATH="$CHROME_PATH" lhci autorun --chrome-flags="--headless=new --no-sandbox --disable-gpu --disable-dev-shm-usage"
 
   build-and-push:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     if: github.event_name == 'push'
     needs: [lint, test, e2e]
     outputs:
@@ -124,20 +124,13 @@ jobs:
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "CalVer tag: $VERSION"
 
-      - name: Log in to Docker Hub
+      - name: Log in to Gitea Container Registry
         if: github.event_name == 'push'
         uses: docker/login-action@v3
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Log in to GHCR
-        if: github.event_name == 'push'
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: git.farh.net
+          username: cartsnitch
+          password: ${{ secrets.GITEA_TOKEN }}
 
       - name: Extract metadata
         id: meta
@@ -172,7 +165,11 @@ jobs:
           only-fixed: "true"
           output-format: sarif
 
-      
+      - name: Upload frontend scan results to GitHub Security
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif }}
 
       - name: Push Docker image
         if: github.event_name == 'push'
@@ -192,15 +189,24 @@ jobs:
           git push origin "v${{ steps.calver.outputs.version }}"
 
   deploy-dev:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     needs: [build-and-push]
     if: always() && !cancelled() && github.event_name == 'push' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main')
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.CARTSNITCH_APP_ID }}
+          private-key: ${{ secrets.CARTSNITCH_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: infra
+
       - name: Checkout infra repo
         uses: actions/checkout@v4
         with:
           repository: cartsnitch/infra
-          token: ${{ secrets.GITEA_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           ref: main
           path: infra
 
@@ -236,15 +242,24 @@ jobs:
           git push origin main
 
   deploy-uat:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     needs: [build-and-push]
     if: always() && !cancelled() && github.event_name == 'push' && (github.ref == 'refs/heads/uat' || github.ref == 'refs/heads/main')
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.CARTSNITCH_APP_ID }}
+          private-key: ${{ secrets.CARTSNITCH_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: infra
+
       - name: Checkout infra repo
         uses: actions/checkout@v4
         with:
           repository: cartsnitch/infra
-          token: ${{ secrets.GITEA_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           ref: main
           path: infra