From bacd92f05daef9f6b9b1c3af13a773d6e6c9a130 Mon Sep 17 00:00:00 2001 From: Barcode Betty Date: Sun, 19 Apr 2026 12:44:33 +0000 Subject: [PATCH 1/4] feat: add CI workflow for build, push, and deploy - Build and push Docker image to GHCR on push to main/dev/uat - Generate CalVer tags on main branch - Auto-deploy to dev and uat overlays via infra repo Co-Authored-By: Paperclip --- .github/workflows/ci.yml | 172 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 172 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..d842735 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,172 @@ +name: CI + +on: + push: + branches: [main, dev, uat] + pull_request: + branches: [main, dev, uat] + +concurrency: + group: ci-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: write + packages: write + security-events: write + +env: + REGISTRY: ghcr.io + IMAGE_NAME: cartsnitch/auth + +jobs: + build-and-push: + runs-on: runners-cartsnitch + if: github.event_name == 'push' + outputs: + calver_tag: ${{ steps.calver.outputs.version }} + sha_tag: sha-${{ github.sha }} + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Generate CalVer tag + id: calver + if: github.ref == 'refs/heads/main' + run: | + DATE_TAG=$(date -u +%Y.%m.%d) + EXISTING=$(git tag -l "v${DATE_TAG}*" | sort -V | tail -1) + if [ -z "$EXISTING" ]; then VERSION="$DATE_TAG" + elif [ "$EXISTING" = "v${DATE_TAG}" ]; then VERSION="${DATE_TAG}.2" + else BUILD_NUM=$(echo "$EXISTING" | sed "s/v${DATE_TAG}\.//"); VERSION="${DATE_TAG}.$((BUILD_NUM + 1))"; fi + echo "version=$VERSION" >> "$GITHUB_OUTPUT" + + - name: Log in to GHCR + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + tags: | + type=sha,prefix=sha-,format=long + type=raw,value=${{ steps.calver.outputs.version }},enable=${{ github.ref == 'refs/heads/main' }} + type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }} + + - name: Build and push Docker image + uses: docker/build-push-action@v6 + with: + context: . + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max + + - name: Create git tag + if: github.ref == 'refs/heads/main' + run: | + git tag "v${{ steps.calver.outputs.version }}" + git push origin "v${{ steps.calver.outputs.version }}" + + deploy-dev: + runs-on: runners-cartsnitch + needs: [build-and-push] + if: github.event_name == 'push' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main') + steps: + - name: Generate GitHub App token + id: app-token + uses: actions/create-github-app-token@v1 + with: + app-id: ${{ secrets.CARTSNITCH_APP_ID }} + private-key: ${{ secrets.CARTSNITCH_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} + repositories: infra + + - uses: actions/checkout@v4 + with: + repository: cartsnitch/infra + token: ${{ steps.app-token.outputs.token }} + ref: main + path: infra + + - uses: imranismail/setup-kustomize@v2 + + - name: Determine image tag + id: tag + run: | + if [ "${{ github.ref }}" == "refs/heads/main" ]; then + echo "tag=${{ needs.build-and-push.outputs.calver_tag }}" >> "$GITHUB_OUTPUT" + else + echo "tag=${{ needs.build-and-push.outputs.sha_tag }}" >> "$GITHUB_OUTPUT" + fi + + - name: Update auth image tag in dev overlay + run: | + cd infra/apps/overlays/dev + kustomize edit set image ghcr.io/cartsnitch/auth:${{ steps.tag.outputs.tag }} + + - name: Commit and push to infra + run: | + cd infra + git config user.name "cartsnitch-ci[bot]" + git config user.email "cartsnitch-ci[bot]@users.noreply.github.com" + git add apps/overlays/dev/kustomization.yaml + git diff --cached --quiet && echo "No changes" && exit 0 + git commit -m "ci(dev): update auth image from cartsnitch/auth CI" + git pull --rebase origin main + git push origin main + + deploy-uat: + runs-on: runners-cartsnitch + needs: [build-and-push] + if: github.event_name == 'push' && (github.ref == 'refs/heads/uat' || github.ref == 'refs/heads/main') + steps: + - name: Generate GitHub App token + id: app-token + uses: actions/create-github-app-token@v1 + with: + app-id: ${{ secrets.CARTSNITCH_APP_ID }} + private-key: ${{ secrets.CARTSNITCH_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} + repositories: infra + + - uses: actions/checkout@v4 + with: + repository: cartsnitch/infra + token: ${{ steps.app-token.outputs.token }} + ref: main + path: infra + + - uses: imranismail/setup-kustomize@v2 + + - name: Determine image tag + id: tag + run: | + if [ "${{ github.ref }}" == "refs/heads/main" ]; then + echo "tag=${{ needs.build-and-push.outputs.calver_tag }}" >> "$GITHUB_OUTPUT" + else + echo "tag=${{ needs.build-and-push.outputs.sha_tag }}" >> "$GITHUB_OUTPUT" + fi + + - name: Update auth image tag in uat overlay + run: | + cd infra/apps/overlays/uat + kustomize edit set image ghcr.io/cartsnitch/auth:${{ steps.tag.outputs.tag }} + + - name: Commit and push to infra + run: | + cd infra + git config user.name "cartsnitch-ci[bot]" + git config user.email "cartsnitch-ci[bot]@users.noreply.github.com" + git add apps/overlays/uat/kustomization.yaml + git diff --cached --quiet && echo "No changes" && exit 0 + git commit -m "ci(uat): update auth image from cartsnitch/auth CI" + git pull --rebase origin main + git push origin main \ No newline at end of file From 6ac7350d75802e467d6f647394ab282fb3ab2c34 Mon Sep 17 00:00:00 2001 From: Barcode Betty Date: Sun, 19 Apr 2026 11:42:55 +0000 Subject: [PATCH 2/4] Add CI workflow and Grype CVE ignores - Add .github/workflows/ci.yml with build/push and deploy-dev/uat jobs - Add .grype.yaml with Python 3.12 CVE ignores Co-Authored-By: Paperclip --- .github/workflows/ci.yml | 2 +- .grype.yaml | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) create mode 100644 .grype.yaml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d842735..94e9c91 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -169,4 +169,4 @@ jobs: git diff --cached --quiet && echo "No changes" && exit 0 git commit -m "ci(uat): update auth image from cartsnitch/auth CI" git pull --rebase origin main - git push origin main \ No newline at end of file + git push origin main diff --git a/.grype.yaml b/.grype.yaml new file mode 100644 index 0000000..b581f72 --- /dev/null +++ b/.grype.yaml @@ -0,0 +1,4 @@ +ignore: + # Python 3.12 CVEs — only fixed in 3.13+, cannot upgrade major version safely + - vulnerability: CVE-2025-13836 + - vulnerability: CVE-2026-4519 From 745baada901afb6d2c9c8d8c7c16ecc8bdd04c5b Mon Sep 17 00:00:00 2001 From: "coupon-carl-ceo[bot]" <269712056+coupon-carl-ceo[bot]@users.noreply.github.com> Date: Mon, 20 Apr 2026 14:36:46 +0000 Subject: [PATCH 3/4] =?UTF-8?q?chore:=20trigger=20CI=20=E2=80=94=20GHCR=20?= =?UTF-8?q?package=20relink=20[CAR-732]?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From 35dc518c5342148f517bc6359fb023984ef11b40 Mon Sep 17 00:00:00 2001 From: "coupon-carl-ceo[bot]" <269712056+coupon-carl-ceo[bot]@users.noreply.github.com> Date: Tue, 21 Apr 2026 02:15:46 +0000 Subject: [PATCH 4/4] chore: recreate GHCR package linked to cartsnitch/auth [CAR-732]