113 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Barcode Betty	d5ec25e91b	Merge pull request 'ci(auth): add Grype scan + defu/kysely CVE bumps (CAR-1446) [uat→main]' (#55) from uat into main ... ci(auth): add Grype scan + defu/kysely CVE bumps (CAR-1446) [uat→main] v2026.06.23.3	2026-06-23 04:14:02 +00:00
Barcode Betty	9c15e29aa9	Merge pull request 'ci(auth): add Grype scan step; document provenance/sbom OCI limitation (CAR-1446)' (#53) from dev into uat ... ci(auth): promote CAR-1446 Grype scan + dep fix to uat (PR #53) Merges dev→uat: adds Grype supply-chain scan between Build and Push, documents OCI referrers limitation with HTTP 404 proof, and patches three HIGH transitive CVEs in better-auth deps (defu, kysely) via npm overrides. QA APPROVED (cs_charlie, review 4846). Security reviewed (Stockboy Steve). Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-23 03:55:28 +00:00
Barcode Betty	92015fc5e9	fix(deps): regenerate lockfile with defu 6.1.7, kysely 0.28.17 (CAR-1446) ... Applied npm overrides from previous commit. Grype scan now passes at --fail-on high with only MEDIUM-severity remaining CVEs in uuid (GHSA-w5hq-g745-h8pq, major bump to v11 required, not a blocking risk) and better-auth (GHSA-wxw3-q3m9-c3jr, updating to 1.6.2 separately). Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-23 03:43:04 +00:00
Barcode Betty	6722b0e796	fix(deps): add npm overrides to pin patched versions of defu, kysely, picomatch (CAR-1446) ... Grype found 3 HIGH-severity CVEs in transitive npm deps that npm audit missed (different advisory DB): - GHSA-737v-mqg7-c878: defu 6.1.4 → 6.1.5+ - GHSA-pv5w-4p9q-p3v2: kysely 0.28.14 → 0.28.17 - GHSA-c2c7-rcm5-vvqj: picomatch 4.0.3 → 4.0.4 All three are transitive deps of better-auth. Adding npm overrides forces the patched versions. Grype scan passes at --fail-on high after these overrides are applied. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-23 03:42:45 +00:00
Barcode Betty	88952a4651	ci(auth): update CAR-1446 comment with empirical OCI referrers proof	2026-06-23 02:50:37 +00:00
Barcode Betty	9ec0a7b56c	Merge pull request 'ci(auth): add Grype scan step; document provenance/sbom OCI referrer limitation (CAR-1446)' (#52) from betty/car-1446-sbom-provenance-scan into dev ... ci(auth): add Grype scan step; document provenance/sbom OCI referrer limitation (CAR-1446) Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-23 02:41:17 +00:00
Barcode Betty	30fa99a717	ci(auth): add Grype scan step; document provenance/sbom OCI referrer limitation (CAR-1446) ... - Insert anchore/scan-action@v5 step between Build and Push - severity-cutoff: high, only-fixed: true (matches monorepo pattern) - Add inline comment on provenance:false/sbom:false explaining OCI distribution spec >=1.1 limitation on git.farh.net registry Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-23 02:39:55 +00:00
Barcode Betty	0f375815f2	Merge pull request 'fix(ci): broaden graceful-exit on infra PR auto-merge (CAR-1438) [uat→main]' (#49) from uat into main ... fix(ci): broaden graceful-exit on infra PR auto-merge (CAR-1438) [uat→main] All Phase 3 gates passed: - UAT regression: PASS (CAR-1442, Deal Dottie) - Security review: PASS (CAR-1443, Stockboy Steve) - CEO code review: APPROVED (Carl, review #4830) v2026.06.23.2	2026-06-23 01:37:29 +00:00
Barcode Betty	f99dc97528	Merge pull request 'fix(ci): promote revert deploy PR base dev/uat → main to uat (CAR-1431)' (#51) from dev into uat ... fix(ci): promote revert deploy PR base to uat (CAR-1431) Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-23 01:11:16 +00:00
Barcode Betty	35b3b8406e	Merge pull request 'fix(ci): revert deploy PR base dev/uat → main (CAR-1431)' (#50) from barcode-betty/car-1428-revert-deploy-base into dev ... fix(ci): revert deploy PR base dev/uat → main (CAR-1431) Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-23 01:10:47 +00:00
Barcode Betty	88da9ee771	fix(ci): revert deploy PR base dev/uat → main (CAR-1431) ... Deploy-dev and deploy-uat jobs were opening image-tag-bump PRs against dev/uat branches per CAR-1371. Flux reconciles all overlays from infra main, so those PRs were never picked up. Revert --arg base back to main. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-23 01:07:17 +00:00
Barcode Betty	ba7bcef05e	Merge pull request 'fix(ci): broaden graceful-exit on infra PR auto-merge (CAR-1438) [dev→uat]' (#48) from dev into uat ... fix(ci): broaden graceful-exit on infra PR auto-merge (CAR-1438) [dev→uat] QA PASS Charlie review #4825. Promotes CAR-1436+CAR-1438 fixes to UAT.	2026-06-23 00:52:23 +00:00
Barcode Betty	1af633a619	Merge pull request 'fix(ci): broaden graceful-exit on infra PR auto-merge (CAR-1438)' (#46) from car-1438-graceful-exit-fix into dev ... fix(ci): broaden graceful-exit on infra PR auto-merge (CAR-1438) Any non-merged outcome after successful PR creation is now treated as the GitOps approval gate (exit 0). Only empty PR_NUM hard-fails.	2026-06-23 00:47:23 +00:00
Barcode Betty	9600de923c	Merge pull request 'fix(ci): apply jq title fix to uat (CAR-1436 resolved)' (#47) from car-1436-uat-merge-resolved into uat ... fix(ci): apply CAR-1436 jq title fix to uat (via 3-way resolution)	2026-06-23 00:42:32 +00:00
Barcode Betty	011264a87b	fix(ci): resolve dev→uat merge conflict, apply jq title fix (CAR-1436)	2026-06-23 00:42:02 +00:00
Barcode Betty	7ff805c3a5	fix(ci): broaden graceful-exit on infra PR auto-merge (CAR-1438)	2026-06-23 00:38:36 +00:00
Barcode Betty	3a6190a805	Merge pull request 'Promote uat→main: CAR-994 Docker login fix + CAR-1423 REGISTRY_TOKEN fix' (#43) from uat into main ... Merge uat into main: CAR-994 Docker login fix + CAR-1423 two-stage build + CAR-1270 CI_GITEA_TOKEN fix v2026.06.23	2026-06-23 00:19:02 +00:00
Barcode Betty	a2d18c18d8	Merge remote-tracking branch 'origin/main' into uat-fresh	2026-06-23 00:16:40 +00:00
Barcode Betty	b5151db0ac	fix: resolve ci.yml merge conflict (CAR-994+CAR-1423+CAR-1270)	2026-06-23 00:14:25 +00:00
Barcode Betty	28d38a298c	Merge pull request 'fix(ci): use shell var for jq --arg title in deploy steps (CAR-1436)' (#44) from car-1436-fix-deploy-jq-title into dev ... fix(ci): use shell var for jq --arg title in deploy steps (CAR-1436)	2026-06-22 23:56:59 +00:00
Barcode Betty	80a2ea54be	fix: use shell var for jq --arg title in deploy-dev/deploy-uat (CAR-1436)	2026-06-22 23:56:09 +00:00
Barcode Betty	5cd46571f2	Merge pull request 'ci(CAR-1423): promote two-stage load->push fix to uat' (#42) from dev into uat ... ci(CAR-1423): promote two-stage load->push fix to uat (#42)	2026-06-22 23:40:03 +00:00
Barcode Betty	9c4f9b95a9	Merge pull request 'ci(CAR-1423): two-stage load->push to fix auth manifest push (unknown)' (#41) from betty/car-1423-two-stage-build into dev ... ci(CAR-1423): two-stage load->push to fix auth manifest push (#41)	2026-06-22 23:26:26 +00:00
Barcode Betty	e22010a907	ci(CAR-1423): two-stage load->push to fix auth manifest push (unknown)	2026-06-22 23:25:50 +00:00
Barcode Betty	5cdb4c63b8	Merge pull request 'ci(CAR-1423): disable provenance/sbom attestations on auth build-push' (#40) from betty/car-1423-disable-provenance into dev ... ci(CAR-1423): disable provenance/sbom attestations on auth build-push (#40)	2026-06-22 22:25:35 +00:00
Barcode Betty	4819d9c7ac	ci(CAR-1423): disable provenance/sbom attestations on auth build-push	2026-06-22 22:24:15 +00:00
Barcode Betty	1233d80c8f	Merge pull request 'ci(CAR-1373): apply dev's deploy-job restoration to uat (dev → uat promotion, 3-way resolved)' (#38) from car-1373-uat-merge-resolved into uat	2026-06-12 02:09:22 +00:00
Barcode Betty	89fb02cdea	ci(CAR-1373): apply dev's deploy-job restoration to uat (resolve 3-way) ... The dev→uat 3-way merge of ci.yml conflicts on: - CalVer logic (dev is the multi-line readable form) - ref: main vs parameterized expression (dev wins, per CAR-1374) - PR body base/head: dev wins (per CAR-1371 + acceptance criteria) - CAR-1216 comment: dev added, uat didn't have it Resolution: take dev's version of ci.yml (the corrected form per CAR-1373). cc @cpfarhood	2026-06-10 22:47:36 +00:00
Barcode Betty	76254d0dbb	Merge pull request 'ci(CAR-1373): re-add deploy-dev/deploy-uat with PR-based base=dev/uat' (#36) from betty/car-1373-add-pr-deploy-jobs into dev	2026-06-10 22:44:40 +00:00
Barcode Betty	c4536afa5f	ci(CAR-1373): re-add deploy-dev/deploy-uat with PR-based base=dev/uat ... Add deploy-dev and deploy-uat jobs to cartsnitch/auth:dev. These were removed in CAR-1041 because the previous direct-push implementation was invalid. Re-add them in the post-CAR-1371+1374 frontend pattern: - base=dev / base=uat (was base=main in main, direct-push in uat) - parameterized ref matches PR base (CAR-1374 sibling) - head=cartsnitch:${BRANCH} (cross-repo PR head, matches frontend) - never-fail on merge outcome (CAR-1216) - request cs_savannah review per GitOps gate cc @cpfarhood	2026-06-10 22:43:33 +00:00
Savannah Savings	72f2568b68	Merge pull request 'fix(ci): use CI_GITEA_TOKEN for cross-repo infra access in deploy jobs (CAR-1270)' (#35) from betty/car-1270-ci-gitea-token-main into main v2026.06.05.2 v2026.06.07	2026-06-05 05:12:45 +00:00
Savannah Savings	8a49fc57f1	Merge pull request 'fix(ci): use CI_GITEA_TOKEN for cross-repo infra access in deploy jobs (CAR-1270)' (#34) from betty/car-1270-ci-gitea-token-uat into uat	2026-06-05 05:12:38 +00:00
Barcode Betty	a0be839632	fix(ci): use CI_GITEA_TOKEN for cross-repo infra access in deploy jobs (CAR-1270) ... Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-05 00:53:43 +00:00
Barcode Betty	d5c5d2b6ba	fix(ci): use CI_GITEA_TOKEN for cross-repo infra access in deploy jobs (CAR-1270) ... Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-05 00:53:13 +00:00
Barcode Betty	3198b21683	revert: undo CAR-1270 direct commit (will land via PR instead) ... Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-05 00:52:22 +00:00
Barcode Betty	ca1a732033	fix(ci): use CI_GITEA_TOKEN for cross-repo infra access in deploy jobs (CAR-1270) ... Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-05 00:51:07 +00:00
Savannah Savings	0977a7c3b3	Merge pull request 'ci(auth): migrate deploy-dev/deploy-uat to PR-bump + fix registry token (CAR-1263)' (#33) from cs_betty/car-1263-auth-pr-bump-main into main v2026.06.05	2026-06-05 00:34:48 +00:00
Savannah Savings	eb436e2c31	Merge pull request 'ci(auth): migrate deploy-dev/deploy-uat to PR-bump mechanism (CAR-1263)' (#32) from cs_betty/car-1263-auth-pr-bump-uat into uat	2026-06-05 00:34:47 +00:00
Barcode Betty	21fba7a842	ci(auth): migrate deploy-dev/deploy-uat to PR-bump + fix registry token (CAR-1263) ... Migrates auth .gitea/workflows/ci.yml deploy-dev and deploy-uat jobs from direct 'git push origin main' to cartsnitch/infra to the CAR-1195 PR-bump pattern. Brings auth in line with cartsnitch/cartsnitch and stops the red deploy-dev/deploy-uat jobs on main pushes. Also fixes the registry-login password to use REGISTRY_TOKEN (CAR-1009 standard) instead of GITEA_TOKEN — uat already had this fix (CAR-1237); main was lagging. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-05 00:23:07 +00:00
Barcode Betty	70398efeea	ci(auth): migrate deploy-dev/deploy-uat to PR-bump mechanism (CAR-1263) ... Migrates auth .gitea/workflows/ci.yml deploy-dev and deploy-uat jobs from direct 'git push origin main' to cartsnitch/infra to the CAR-1195 PR-bump pattern (open + (attempt) auto-merge an infra PR; never hard-fail on approval gate, per CAR-1216). Brings auth in line with cartsnitch/cartsnitch and stops the red deploy-uat job on every uat push. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-05 00:23:05 +00:00
Savannah Savings	806843b9c7	Merge pull request 'ci(uat): runner-native Docker build + fix deploy infra token (CAR-1237)' (#30) from betty/car-1237-fix-uat-ci into uat ... ci(uat): runner-native Docker build + fix deploy infra token (CAR-1237) Reviewed and merged by Savannah (CTO). Byte-identical to proven main except the spec-mandated REGISTRY_TOKEN registry-login (CAR-1009 standard). Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-04 20:41:13 +00:00
Barcode Betty	91ab376f38	ci(uat): runner-native Docker build + fix deploy infra token (CAR-1237) ... - Change A: replace build-and-push with runner-native Docker (no DinD service container) - Change B: deploy-dev/deploy-uat use secrets.GITEA_TOKEN for infra checkout Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-04 20:33:08 +00:00
Savannah Savings	3496653d33	Merge dev into uat: use direct docker login for Gitea registry (CAR-994)	2026-06-04 18:52:32 +00:00
Barcode Betty	02b732e24c	chore(ci): re-trigger auth UAT build after act-runner DinD fix (CAR-973) ... Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-04 11:46:31 +00:00
Barcode Betty	b4420b3f87	fix(ci): use direct docker login for Gitea registry (CAR-994) ... docker/login-action@v3 exits 1 against git.farh.net. Replace with a direct docker login shell command using secrets.REGISTRY_TOKEN via --password-stdin. cc @cpfarhood	2026-06-02 14:16:15 +00:00
Flea Flicker	1099037db1	fix(ci): use REGISTRY_TOKEN for cross-repo infra checkout ... Replaces CI_GITEA_TOKEN (which lacks cross-repo access) with REGISTRY_TOKEN for checkout of cartsnitch/infra in deploy-uat/deploy-dev jobs. Fixes CAR-1147	2026-06-02 10:07:31 +00:00
Flea Flicker	8c37c764e9	fix(ci): add DinD service to enable image builds (CAR-1042)	2026-05-30 08:56:47 +00:00
Savannah Savings	6c71a2a1f8	Merge pull request 'ci(CAR-1041): remove invalid deploy-dev/deploy-uat jobs' (#28) from betty/remove-deploy-jobs into dev	2026-05-28 19:56:05 +00:00
Flea Flicker	e308b15255	ci(CAR-1041): remove invalid deploy-dev/deploy-uat jobs ... Remove deploy-dev and deploy-uat CI jobs. CartSnitch uses Flux GitOps — CI builds images, Flux deploys. These Actions-based deployment jobs were added incorrectly in CAR-987. Co-Authored-By: Barcode Betty <betty@cartsnitch>	2026-05-28 19:47:39 +00:00
Flea Flicker	6f392bbbed	test(ci): trigger CI after DinD fix (CAR-1042)	2026-05-25 23:15:07 +00:00