ci: switch image registry from ghcr.io to git.farh.net

- Update REGISTRY env var to git.farh.net
- Use GITEA_TOKEN instead of GITHUB_TOKEN for docker login
- Use rename form for kustomize image updates (ghcr.io=git.farh.net/...)
- Remove GHA cache lines (not available on Gitea runners)

Refs: CAR-959

.gitea/CI_TRIGGER.md

@@ -1 +0,0 @@
-# CI trigger 20260525231507 - post-DinD verification (CAR-1042)

.github/workflows/ci.yml

@@ -21,15 +21,8 @@ env:
 
 jobs:
   build-and-push:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     if: github.event_name == 'push'
-    services:
-      docker:
-        image: docker:dind
-        privileged: true
-    env:
-      DOCKER_HOST: tcp://docker:2375
-      DOCKER_TLS_CERTDIR: ""
     outputs:
       calver_tag: ${{ steps.calver.outputs.version }}
       sha_tag: sha-${{ github.sha }}
@@ -50,7 +43,11 @@ jobs:
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Log in to Gitea Container Registry
-        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login ${{ env.REGISTRY }} -u ${{ github.actor }} --password-stdin
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITEA_TOKEN }}
 
       - name: Extract metadata
         id: meta
@@ -77,14 +74,23 @@ jobs:
           git push origin "v${{ steps.calver.outputs.version }}"
 
   deploy-dev:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     needs: [build-and-push]
     if: github.event_name == 'push' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main')
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.CARTSNITCH_APP_ID }}
+          private-key: ${{ secrets.CARTSNITCH_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: infra
+
       - uses: actions/checkout@v4
         with:
           repository: cartsnitch/infra
-          token: ${{ secrets.REGISTRY_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           ref: main
           path: infra
 
@@ -116,14 +122,23 @@ jobs:
           git push origin main
 
   deploy-uat:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     needs: [build-and-push]
     if: github.event_name == 'push' && (github.ref == 'refs/heads/uat' || github.ref == 'refs/heads/main')
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.CARTSNITCH_APP_ID }}
+          private-key: ${{ secrets.CARTSNITCH_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: infra
+
       - uses: actions/checkout@v4
         with:
           repository: cartsnitch/infra
-          token: ${{ secrets.REGISTRY_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           ref: main
           path: infra
 

src/auth.ts

@@ -115,11 +115,9 @@ export const auth = betterAuth({
   trustedOrigins: [
     "http://localhost:3000",
     "http://localhost:5173",
+    "https://cartsnitch.com",
     "https://cartsnitch.farh.net",
     "https://cartsnitch.dev.farh.net",
     "https://cartsnitch.uat.farh.net",
-    "https://cartsnitch.com",
-    "https://dev.cartsnitch.com",
-    "https://uat.cartsnitch.com",
   ],
 });