Merge pull request 'ci(CAR-1373): apply dev's deploy-job restoration to uat (dev → uat promotion, 3-way resolved)' (#38) from car-1373-uat-merge-resolved into uat

The dev→uat 3-way merge of ci.yml conflicts on:
- CalVer logic (dev is the multi-line readable form)
- ref: main vs parameterized expression (dev wins, per CAR-1374)
- PR body base/head: dev wins (per CAR-1371 + acceptance criteria)
- CAR-1216 comment: dev added, uat didn't have it

Resolution: take dev's version of ci.yml (the corrected form per CAR-1373).

cc @cpfarhood

.gitea/CI_TRIGGER.md

@@ -0,0 +1 @@
+# CI trigger 20260525231507 - post-DinD verification (CAR-1042)

.gitea/workflows/ci.yml

@@ -59,21 +59,11 @@ jobs:
             type=raw,value=${{ steps.calver.outputs.version }},enable=${{ github.ref == 'refs/heads/main' }}
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
 
-      - name: Build Docker image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          load: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-      - name: Push Docker image
+      - name: Build and push Docker image
         uses: docker/build-push-action@v6
         with:
           context: .
           push: true
-          provenance: false
-          sbom: false
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
@@ -142,8 +132,7 @@ jobs:
             echo "::notice::Refusing to push directly to protected branch — falling back to contents API"
             exit 0
           fi
-          TITLE="ci(dev): update auth image (${GITHUB_SHA::12})"
-          PR_BODY=$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base dev --arg title "$TITLE" --arg body "Bumps apps/overlays/dev/kustomization.yaml auth newTag to \`${{ steps.tag.outputs.tag }}\` from cartsnitch/auth CI build $GITHUB_SHA." \
+          PR_BODY=$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base dev --arg title ("ci(dev): update auth image (" + env.GITHUB_SHA[:12] + ")") --arg body "Bumps apps/overlays/dev/kustomization.yaml auth newTag to \`${{ steps.tag.outputs.tag }}\` from cartsnitch/auth CI build $GITHUB_SHA." \
             '{head: $head, base: $base, title: $title, body: $body}')
           PR_JSON=$(curl -sS -X POST \
             -H "Authorization: token ${CI_GITEA_TOKEN}" \
@@ -177,11 +166,12 @@ jobs:
           MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false')
           if [ "$MERGED" = "true" ]; then
             echo "PR #${PR_NUM} merged into cartsnitch/infra dev"
-          else
-            # CAR-1438: PR opened successfully; any non-merged outcome (empty body,
-            # approval-gate, pending checks) is the GitOps gate — not a failure.
-            echo "::notice::infra PR #${PR_NUM} opened — auto-merge not available (${MERGE_RESP:-empty response}); awaiting CTO (cs_savannah) approve+merge"
+          elif echo "$MERGE_RESP" | grep -qi 'does not have enough approvals'; then
+            echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure"
             exit 0
+          else
+            echo "::error::Auto-merge of cartsnitch/infra PR #${PR_NUM} failed: $MERGE_RESP"
+            exit 1
           fi
 
   deploy-uat:
@@ -243,8 +233,7 @@ jobs:
             echo "::notice::Refusing to push directly to protected branch — falling back to contents API"
             exit 0
           fi
-          TITLE="ci(uat): update auth image (${GITHUB_SHA::12})"
-          PR_BODY=$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base uat --arg title "$TITLE" --arg body "Bumps apps/overlays/uat/kustomization.yaml auth newTag to \`${{ steps.tag.outputs.tag }}\` from cartsnitch/auth CI build $GITHUB_SHA." \
+          PR_BODY=$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base uat --arg title ("ci(uat): update auth image (" + env.GITHUB_SHA[:12] + ")") --arg body "Bumps apps/overlays/uat/kustomization.yaml auth newTag to \`${{ steps.tag.outputs.tag }}\` from cartsnitch/auth CI build $GITHUB_SHA." \
             '{head: $head, base: $base, title: $title, body: $body}')
           PR_JSON=$(curl -sS -X POST \
             -H "Authorization: token ${CI_GITEA_TOKEN}" \
@@ -274,10 +263,10 @@ jobs:
           MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false')
           if [ "$MERGED" = "true" ]; then
             echo "PR #${PR_NUM} merged into cartsnitch/infra uat"
-          else
-            # CAR-1438: PR opened successfully; any non-merged outcome (empty body,
-            # approval-gate, pending checks) is the GitOps gate — not a failure.
-            echo "::notice::infra PR #${PR_NUM} opened — auto-merge not available (${MERGE_RESP:-empty response}); awaiting CTO (cs_savannah) approve+merge"
+          elif echo "$MERGE_RESP" | grep -qi 'does not have enough approvals'; then
+            echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure"
             exit 0
+          else
+            echo "::error::Auto-merge of cartsnitch/infra PR #${PR_NUM} failed: $MERGE_RESP"
+            exit 1
           fi
-