Merge pull request 'ci(auth): add Grype scan + defu/kysely CVE bumps (CAR-1446) [uat→main]' (#55 ) from uat into main

ci(auth): add Grype scan + defu/kysely CVE bumps (CAR-1446) [uat→main]
Merge pull request 'ci(auth): add Grype scan step; document provenance/sbom OCI limitation (CAR-1446)' (#53 ) from dev into uat
2026-06-23 04:14:02 +00:00 · 2026-06-23 03:55:28 +00:00 · 2026-06-23 03:43:04 +00:00 · 2026-06-23 03:42:45 +00:00 · 2026-06-23 02:50:37 +00:00 · 2026-06-23 02:41:17 +00:00
4 changed files with 44 additions and 19 deletions
@@ -0,0 +1 @@
+# CI trigger 20260525231507 - post-DinD verification (CAR-1042)
@@ -67,11 +67,31 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

+      - name: Scan Docker image
+        uses: anchore/scan-action@v5
+        id: scan
+        env:
+          GRYPE_CONFIG: .grype.yaml
+        with:
+          image: "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }}"
+          fail-build: true
+          severity-cutoff: high
+          only-fixed: "true"
+          output-format: sarif
+
      - name: Push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
+          # CAR-1446: git.farh.net does not implement the OCI referrers API.
+          # Verified 2026-06-23: GET /v2/cartsnitch/auth/referrers/{digest} →
+          # HTTP 404 "page not found" (plain proxy 404, not an OCI error — the path
+          # does not exist in this Gitea registry version). OCI Distribution Spec
+          # >=1.1 is required for provenance/SBOM attestation manifests; without it
+          # the docker/build-push-action would fail at the attestation PUT.
+          # Compensating control: the Grype scan step above fails the build on any
+          # unfixed HIGH-severity CVE before the image reaches the registry.
          provenance: false
          sbom: false
          tags: ${{ steps.meta.outputs.tags }}
@@ -143,7 +163,7 @@ jobs:
            exit 0
          fi
          TITLE="ci(dev): update auth image (${GITHUB_SHA::12})"
-          PR_BODY=$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base dev --arg title "$TITLE" --arg body "Bumps apps/overlays/dev/kustomization.yaml auth newTag to \`${{ steps.tag.outputs.tag }}\` from cartsnitch/auth CI build $GITHUB_SHA." \
+          PR_BODY=$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base main --arg title "$TITLE" --arg body "Bumps apps/overlays/dev/kustomization.yaml auth newTag to \`${{ steps.tag.outputs.tag }}\` from cartsnitch/auth CI build $GITHUB_SHA." \
            '{head: $head, base: $base, title: $title, body: $body}')
          PR_JSON=$(curl -sS -X POST \
            -H "Authorization: token ${CI_GITEA_TOKEN}" \
@@ -177,12 +197,11 @@ jobs:
          MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false')
          if [ "$MERGED" = "true" ]; then
            echo "PR #${PR_NUM} merged into cartsnitch/infra dev"
-          elif echo "$MERGE_RESP" | grep -qi 'does not have enough approvals'; then
-            echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure"
-            exit 0
          else
-            echo "::error::Auto-merge of cartsnitch/infra PR #${PR_NUM} failed: $MERGE_RESP"
-            exit 1
+            # CAR-1438: PR opened successfully; any non-merged outcome (empty body,
+            # approval-gate, pending checks) is the GitOps gate — not a failure.
+            echo "::notice::infra PR #${PR_NUM} opened — auto-merge not available (${MERGE_RESP:-empty response}); awaiting CTO (cs_savannah) approve+merge"
+            exit 0
          fi

  deploy-uat:
@@ -245,7 +264,7 @@ jobs:
            exit 0
          fi
          TITLE="ci(uat): update auth image (${GITHUB_SHA::12})"
-          PR_BODY=$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base uat --arg title "$TITLE" --arg body "Bumps apps/overlays/uat/kustomization.yaml auth newTag to \`${{ steps.tag.outputs.tag }}\` from cartsnitch/auth CI build $GITHUB_SHA." \
+          PR_BODY=$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base main --arg title "$TITLE" --arg body "Bumps apps/overlays/uat/kustomization.yaml auth newTag to \`${{ steps.tag.outputs.tag }}\` from cartsnitch/auth CI build $GITHUB_SHA." \
            '{head: $head, base: $base, title: $title, body: $body}')
          PR_JSON=$(curl -sS -X POST \
            -H "Authorization: token ${CI_GITEA_TOKEN}" \
@@ -275,10 +294,10 @@ jobs:
          MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false')
          if [ "$MERGED" = "true" ]; then
            echo "PR #${PR_NUM} merged into cartsnitch/infra uat"
-          elif echo "$MERGE_RESP" | grep -qi 'does not have enough approvals'; then
-            echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure"
-            exit 0
          else
-            echo "::error::Auto-merge of cartsnitch/infra PR #${PR_NUM} failed: $MERGE_RESP"
-            exit 1
+            # CAR-1438: PR opened successfully; any non-merged outcome (empty body,
+            # approval-gate, pending checks) is the GitOps gate — not a failure.
+            echo "::notice::infra PR #${PR_NUM} opened — auto-merge not available (${MERGE_RESP:-empty response}); awaiting CTO (cs_savannah) approve+merge"
+            exit 0
          fi
+
@@ -818,9 +818,9 @@
      }
    },
    "node_modules/defu": {
-      "version": "6.1.4",
-      "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.4.tgz",
-      "integrity": "sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg==",
+      "version": "6.1.7",
+      "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.7.tgz",
+      "integrity": "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==",
      "license": "MIT"
    },
    "node_modules/esbuild": {
@@ -909,9 +909,9 @@
      }
    },
    "node_modules/kysely": {
-      "version": "0.28.14",
-      "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.28.14.tgz",
-      "integrity": "sha512-SU3lgh0rPvq7upc6vvdVrCsSMUG1h3ChvHVOY7wJ2fw4C9QEB7X3d5eyYEyULUX7UQtxZJtZXGuT6U2US72UYA==",
+      "version": "0.28.17",
+      "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.28.17.tgz",
+      "integrity": "sha512-nbD8lB9EB3wNdMhOCdx5Li8DxnLbvKByylRLcJ1h+4SkrowVeECAyZlyiKMThF7xFdRz0jSQ2MoJr+wXux2y0Q==",
      "license": "MIT",
      "engines": {
        "node": ">=20.0.0"
@@ -21,5 +21,10 @@
    "@types/pg": "^8.11.0",
    "tsx": "^4.19.0",
    "typescript": "^5.7.0"
+  },
+  "overrides": {
+    "picomatch": "^4.0.4",
+    "defu": "^6.1.5",
+    "kysely": "^0.28.17"
  }
-}
+}
				`@@ -0,0 +1 @@`
				`# CI trigger 20260525231507 - post-DinD verification (CAR-1042)`