Merge pull request 'Promote uat→main: CAR-994 Docker login fix + CAR-1423 REGISTRY_TOKEN fix' (#43 ) from uat into main

Merge uat into main: CAR-994 Docker login fix + CAR-1423 two-stage build + CAR-1270 CI_GITEA_TOKEN fix
Merge remote-tracking branch 'origin/main' into uat-fresh
2026-06-23 00:19:02 +00:00 · 2026-06-23 00:16:40 +00:00 · 2026-06-23 00:14:25 +00:00 · 2026-06-05 05:12:45 +00:00 · 2026-06-05 00:53:43 +00:00 · 2026-06-05 00:34:48 +00:00
1 changed files with 14 additions and 14 deletions
@@ -93,7 +93,7 @@ jobs:
        with:
          repository: cartsnitch/infra
          token: ${{ secrets.CI_GITEA_TOKEN }}
-          ref: ${{ github.ref == 'refs/heads/main' && 'main' || (github.ref == 'refs/heads/uat' && 'uat' || 'dev') }}
+          ref: main
          path: infra

      - name: Install kustomize
@@ -142,8 +142,8 @@ jobs:
            echo "::notice::Refusing to push directly to protected branch — falling back to contents API"
            exit 0
          fi
-          PR_BODY=$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base dev --arg title ("ci(dev): update auth image (" + env.GITHUB_SHA[:12] + ")") --arg body "Bumps apps/overlays/dev/kustomization.yaml auth newTag to \`${{ steps.tag.outputs.tag }}\` from cartsnitch/auth CI build $GITHUB_SHA." \
-            '{head: $head, base: $base, title: $title, body: $body}')
+          PR_BODY=$(jq -n --arg head "$BRANCH" --arg body "Bumps apps/overlays/dev/kustomization.yaml auth newTag to \`${{ steps.tag.outputs.tag }}\` from cartsnitch/auth CI build $GITHUB_SHA." \
+            '{head: $head, base: "main", title: ("ci(dev): update auth image (" + env.GITHUB_SHA[:12] + ")"), body: $body}')
          PR_JSON=$(curl -sS -X POST \
            -H "Authorization: token ${CI_GITEA_TOKEN}" \
            -H "Content-Type: application/json" \
@@ -163,11 +163,6 @@ jobs:
          if [ "${REVIEW_HTTP}" -lt 200 ] || [ "${REVIEW_HTTP}" -ge 300 ]; then
            echo "::notice::Failed to request reviewers for cartsnitch/infra PR #${PR_NUM} (HTTP ${REVIEW_HTTP}); continuing"
          fi
-          # CAR-1216: the in-job merge attempt is a best-effort fast-path only.
-          # `cartsnitch/infra` main requires a human approving review; the CI bot
-          # cannot self-approve. Treat any non-merged outcome (approvals pending,
-          # checks pending, any other Gitea message) as the GitOps approval gate
-          # — the PR is already opened and cs_savannah is requested as reviewer.
          MERGE_RESP=$(curl -sS -X POST \
            -H "Authorization: token ${CI_GITEA_TOKEN}" \
            -H "Content-Type: application/json" \
@@ -175,8 +170,11 @@ jobs:
            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/merge")
          MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false')
          if [ "$MERGED" = "true" ]; then
-            echo "PR #${PR_NUM} merged into cartsnitch/infra dev"
+            echo "PR #${PR_NUM} merged into cartsnitch/infra main"
          elif echo "$MERGE_RESP" | grep -qi 'does not have enough approvals'; then
+            # GitOps approval gate: PR is correctly opened and surfaces in
+            # CTO queue via the reviewers request above. Treat as success
+            # so the job does not hard-fail on approvals.
            echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure"
            exit 0
          else
@@ -194,7 +192,7 @@ jobs:
        with:
          repository: cartsnitch/infra
          token: ${{ secrets.CI_GITEA_TOKEN }}
-          ref: ${{ github.ref == 'refs/heads/main' && 'main' || (github.ref == 'refs/heads/uat' && 'uat' || 'dev') }}
+          ref: main
          path: infra

      - name: Install kustomize
@@ -243,8 +241,8 @@ jobs:
            echo "::notice::Refusing to push directly to protected branch — falling back to contents API"
            exit 0
          fi
-          PR_BODY=$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base uat --arg title ("ci(uat): update auth image (" + env.GITHUB_SHA[:12] + ")") --arg body "Bumps apps/overlays/uat/kustomization.yaml auth newTag to \`${{ steps.tag.outputs.tag }}\` from cartsnitch/auth CI build $GITHUB_SHA." \
-            '{head: $head, base: $base, title: $title, body: $body}')
+          PR_BODY=$(jq -n --arg head "$BRANCH" --arg body "Bumps apps/overlays/uat/kustomization.yaml auth newTag to \`${{ steps.tag.outputs.tag }}\` from cartsnitch/auth CI build $GITHUB_SHA." \
+            '{head: $head, base: "main", title: ("ci(uat): update auth image (" + env.GITHUB_SHA[:12] + ")"), body: $body}')
          PR_JSON=$(curl -sS -X POST \
            -H "Authorization: token ${CI_GITEA_TOKEN}" \
            -H "Content-Type: application/json" \
@@ -264,7 +262,6 @@ jobs:
          if [ "${REVIEW_HTTP}" -lt 200 ] || [ "${REVIEW_HTTP}" -ge 300 ]; then
            echo "::notice::Failed to request reviewers for cartsnitch/infra PR #${PR_NUM} (HTTP ${REVIEW_HTTP}); continuing"
          fi
-          # CAR-1216: see deploy-dev — same never-fail on merge outcome.
          MERGE_RESP=$(curl -sS -X POST \
            -H "Authorization: token ${CI_GITEA_TOKEN}" \
            -H "Content-Type: application/json" \
@@ -272,8 +269,11 @@ jobs:
            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/merge")
          MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false')
          if [ "$MERGED" = "true" ]; then
-            echo "PR #${PR_NUM} merged into cartsnitch/infra uat"
+            echo "PR #${PR_NUM} merged into cartsnitch/infra main"
          elif echo "$MERGE_RESP" | grep -qi 'does not have enough approvals'; then
+            # GitOps approval gate: PR is correctly opened and surfaces in
+            # CTO queue via the reviewers request above. Treat as success
+            # so the job does not hard-fail on approvals.
            echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure"
            exit 0
          else
Author	SHA1	Message	Date
Barcode Betty	3a6190a805	Merge pull request 'Promote uat→main: CAR-994 Docker login fix + CAR-1423 REGISTRY_TOKEN fix' (#43 ) from uat into main CI / build-and-push (push) Successful in 11m44s Details CI / deploy-dev (push) Failing after 6s Details CI / deploy-uat (push) Failing after 7s Details Merge uat into main: CAR-994 Docker login fix + CAR-1423 two-stage build + CAR-1270 CI_GITEA_TOKEN fix	2026-06-23 00:19:02 +00:00
Barcode Betty	a2d18c18d8	Merge remote-tracking branch 'origin/main' into uat-fresh CI / build-and-push (push) Successful in 14s Details CI / build-and-push (pull_request) Has been skipped Details CI / deploy-dev (push) Has been skipped Details CI / deploy-uat (push) Failing after 5s Details CI / deploy-dev (pull_request) Has been skipped Details CI / deploy-uat (pull_request) Has been skipped Details	2026-06-23 00:16:40 +00:00
Barcode Betty	b5151db0ac	fix: resolve ci.yml merge conflict (CAR-994+CAR-1423+CAR-1270) CI / deploy-dev (push) Has been cancelled Details CI / deploy-uat (push) Has been cancelled Details CI / build-and-push (push) Has been cancelled Details CI / deploy-dev (pull_request) Has been cancelled Details CI / deploy-uat (pull_request) Has been cancelled Details CI / build-and-push (pull_request) Has been cancelled Details	2026-06-23 00:14:25 +00:00
Savannah Savings	72f2568b68	Merge pull request 'fix(ci): use CI_GITEA_TOKEN for cross-repo infra access in deploy jobs (CAR-1270)' (#35 ) from betty/car-1270-ci-gitea-token-main into main CI / build-and-push (push) Successful in 2m5s Details CI / deploy-dev (push) Failing after 3s Details CI / deploy-uat (push) Failing after 3s Details	2026-06-05 05:12:45 +00:00
Barcode Betty	a0be839632	fix(ci): use CI_GITEA_TOKEN for cross-repo infra access in deploy jobs (CAR-1270) CI / build-and-push (pull_request) Has been skipped Details CI / deploy-dev (pull_request) Has been skipped Details CI / deploy-uat (pull_request) Has been skipped Details Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-05 00:53:43 +00:00
Savannah Savings	0977a7c3b3	Merge pull request 'ci(auth): migrate deploy-dev/deploy-uat to PR-bump + fix registry token (CAR-1263)' (#33 ) from cs_betty/car-1263-auth-pr-bump-main into main CI / build-and-push (push) Successful in 10s Details CI / deploy-dev (push) Failing after 34s Details CI / deploy-uat (push) Failing after 36s Details	2026-06-05 00:34:48 +00:00
Barcode Betty	21fba7a842	ci(auth): migrate deploy-dev/deploy-uat to PR-bump + fix registry token (CAR-1263) CI / build-and-push (pull_request) Has been skipped Details CI / deploy-dev (pull_request) Has been skipped Details CI / deploy-uat (pull_request) Has been skipped Details Migrates auth .gitea/workflows/ci.yml deploy-dev and deploy-uat jobs from direct 'git push origin main' to cartsnitch/infra to the CAR-1195 PR-bump pattern. Brings auth in line with cartsnitch/cartsnitch and stops the red deploy-dev/deploy-uat jobs on main pushes. Also fixes the registry-login password to use REGISTRY_TOKEN (CAR-1009 standard) instead of GITEA_TOKEN — uat already had this fix (CAR-1237); main was lagging. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-05 00:23:07 +00:00