Promote dev → uat: CI pipeline fix + cumulative dev changes [CAR-987] #10

Merged

Savannah Savings merged 12 commits from dev into uat 2026-05-23 19:36:21 +00:00

Conversation 0 Commits 12 Files Changed 4

+900 -954

Savannah Savings commented 2026-05-21 19:42:50 +00:00

Member

Copy Link

Copy Source

Summary

Promotes accumulated dev changes to uat, including:

• CAR-987: Fix CI pipeline — consolidated build/push (no DinD socket), switched infra checkout to secrets.GITEA_DEPLOY_KEY
• E2E test improvements (server startup retry loop)
• Package updates
• VerifyEmail page updates

Source PRs: #19 (CAR-987) and prior dev merges

## Summary Promotes accumulated dev changes to uat, including: - **CAR-987**: Fix CI pipeline — consolidated build/push (no DinD socket), switched infra checkout to secrets.GITEA_DEPLOY_KEY - E2E test improvements (server startup retry loop) - Package updates - VerifyEmail page updates Source PRs: #19 (CAR-987) and prior dev merges

Barcode Betty referenced this pull request 2026-05-21 19:59:17 +00:00

fix: resolve npm audit vulnerabilities (CAR-937) #11

Savannah Savings added 9 commits 2026-05-22 10:43:20 +00:00

fix: update better-auth to 1.6.11 to resolve GHSA-wxw3-q3m9-c3jr ... a65bb0ef19

Resolves moderate severity OAuth state mismatch vulnerability in better-auth.
Updated package-lock.json to reflect patched transitive dependencies.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

chore: trigger CI re-run after rebase [CAR-937] f78b9a4cc1

fix: add overrides for remaining audit vulnerabilities [CAR-937] ... aed8d58a94

- Add @babel/plugin-transform-modules-systemjs >=7.29.4 for GHSA-fv7c-fp4j-7gwp
- Add fast-uri >=3.1.2 for GHSA-q3j6-qgpj-74h6 and GHSA-v39h-62p7-jpjc
- Raise brace-expansion to >=1.1.15 for GHSA-jxxr-4gwj-5jf2

Co-Authored-By: Paperclip <noreply@paperclip.ing>

chore: trigger CI re-run 92edcc716d

fix: use queueMicrotask before setState in VerifyEmail effect [CAR-937] ... 4d5a5545e6

Avoids lint error 'Avoid calling setState() directly within an effect'.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

fix: add sleep before wait-on to ensure preview server is ready [CAR-937] ... a729b7e21a

Co-Authored-By: Paperclip <noreply@paperclip.ing>

fix: increase timeout for preview server in lighthouse CI [CAR-937] ... 75700fbb5e

Co-Authored-By: Paperclip <noreply@paperclip.ing>

fix: improve preview server startup detection in lighthouse CI [CAR-937] ... a9a7db63b8

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Merge pull request 'fix: resolve npm audit vulnerabilities (CAR-937)' (#11) from betty/car-935-fix-setup-node into dev ... 43e0fae823

fix: resolve npm audit vulnerabilities (CAR-937)

Fixes npm audit high-severity vulnerabilities.

Savannah Savings added 3 commits 2026-05-23 19:35:16 +00:00

fix: remove DinD/GHCR scan split, use single push step ... 84571473a3

CAR-987: Docker socket missing was caused by load:true requiring
a local Docker daemon (DinD sidecar). Using push:true with registry
authentication removes the need for local Docker daemon access.
Also removed anchore scan step which required the loaded image.

For infra repo access: changed secrets.GITEA_TOKEN to
vars.GITEA_DEPLOY_KEY since Gitea Actions auto-token only has
repo-scoped permissions and cannot access cross-repo resources
like cartsnitch/infra (which is private).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

fix: change vars.GITEA_DEPLOY_KEY to secrets.GITEA_DEPLOY_KEY per CTO review ddf2b4fda5

Merge pull request 'fix: remove DinD/GHCR split to fix Docker socket and infra 403 [CAR-987]' (#19) from betty/car-987-fix-ci-docker-socket-and-infra-403 into dev ... af50b940c1

fix: remove DinD/GHCR split to fix Docker socket and infra 403 [CAR-987]

Consolidates build+push into single step (no DinD socket needed).
Switches infra checkout to secrets.GITEA_DEPLOY_KEY for cross-repo access.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Savannah Savings changed title from Promote dev → uat: sync .github/workflows deletion [CAR-934] to Promote dev → uat: CI pipeline fix + cumulative dev changes [CAR-987] 2026-05-23 19:36:13 +00:00

Savannah Savings merged commit 048c62ed4d into uat 2026-05-23 19:36:21 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

question

Further information is requested

wontfix

This will not be worked on

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

ai-review (AI Review) cs_betty (Barcode Betty) cs_charlie (Checkout Charlie) cpfarhood (Chris Farhood) ci (Continuous Integration [bot]) cs_carl (Coupon Carl) cs_dottie (Deal Dottie) flux (Flux CD) admin (Gitea Admin) cs_martha (Markdown Martha) renovate (Mend Renovate) cs_savannah (Savannah Savings) cs_steve (Stockboy Steve)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cartsnitch/app#10