Merge pull request 'fix(ci): use CI_GITEA_TOKEN for cross-repo infra access in deploy jobs (CAR-1270)' (#35 ) from betty/car-1270-ci-gitea-token-main into main

fix(ci): use CI_GITEA_TOKEN for cross-repo infra access in deploy jobs (CAR-1270)
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-06-05 05:12:45 +00:00 · 2026-06-05 00:53:43 +00:00 · 2026-06-05 00:34:48 +00:00 · 2026-06-05 00:23:07 +00:00
4 changed files with 40 additions and 79 deletions
@@ -37,17 +37,17 @@ jobs:
        run: |
          DATE_TAG=$(date -u +%Y.%m.%d)
          EXISTING=$(git tag -l "v${DATE_TAG}*" | sort -V | tail -1)
-          if [ -z "$EXISTING" ]; then
-            VERSION="$DATE_TAG"
-          elif [ "$EXISTING" = "v${DATE_TAG}" ]; then
-            VERSION="${DATE_TAG}.2"
-          else
-            BUILD_NUM=$(echo "$EXISTING" | sed "s/v${DATE_TAG}\.//"); VERSION="${DATE_TAG}.$((BUILD_NUM + 1))";
-          fi
+          if [ -z "$EXISTING" ]; then VERSION="$DATE_TAG"
+          elif [ "$EXISTING" = "v${DATE_TAG}" ]; then VERSION="${DATE_TAG}.2"
+          else BUILD_NUM=$(echo "$EXISTING" | sed "s/v${DATE_TAG}\.//"); VERSION="${DATE_TAG}.$((BUILD_NUM + 1))"; fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Log in to Gitea Container Registry
-        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login ${{ env.REGISTRY }} -u "${{ github.actor }}" --password-stdin
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Extract metadata
        id: meta
@@ -59,41 +59,11 @@ jobs:
            type=raw,value=${{ steps.calver.outputs.version }},enable=${{ github.ref == 'refs/heads/main' }}
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}

-      - name: Build Docker image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          load: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-      - name: Scan Docker image
-        uses: anchore/scan-action@v5
-        id: scan
-        env:
-          GRYPE_CONFIG: .grype.yaml
-        with:
-          image: "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }}"
-          fail-build: true
-          severity-cutoff: high
-          only-fixed: "true"
-          output-format: sarif
-
-      - name: Push Docker image
+      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
-          # CAR-1446: git.farh.net does not implement the OCI referrers API.
-          # Verified 2026-06-23: GET /v2/cartsnitch/auth/referrers/{digest} →
-          # HTTP 404 "page not found" (plain proxy 404, not an OCI error — the path
-          # does not exist in this Gitea registry version). OCI Distribution Spec
-          # >=1.1 is required for provenance/SBOM attestation manifests; without it
-          # the docker/build-push-action would fail at the attestation PUT.
-          # Compensating control: the Grype scan step above fails the build on any
-          # unfixed HIGH-severity CVE before the image reaches the registry.
-          provenance: false
-          sbom: false
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

@@ -113,7 +83,7 @@ jobs:
        with:
          repository: cartsnitch/infra
          token: ${{ secrets.CI_GITEA_TOKEN }}
-          ref: ${{ github.ref == 'refs/heads/main' && 'main' || (github.ref == 'refs/heads/uat' && 'uat' || 'dev') }}
+          ref: main
          path: infra

      - name: Install kustomize
@@ -162,9 +132,8 @@ jobs:
            echo "::notice::Refusing to push directly to protected branch — falling back to contents API"
            exit 0
          fi
-          TITLE="ci(dev): update auth image (${GITHUB_SHA::12})"
-          PR_BODY=$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base main --arg title "$TITLE" --arg body "Bumps apps/overlays/dev/kustomization.yaml auth newTag to \`${{ steps.tag.outputs.tag }}\` from cartsnitch/auth CI build $GITHUB_SHA." \
-            '{head: $head, base: $base, title: $title, body: $body}')
+          PR_BODY=$(jq -n --arg head "$BRANCH" --arg body "Bumps apps/overlays/dev/kustomization.yaml auth newTag to \`${{ steps.tag.outputs.tag }}\` from cartsnitch/auth CI build $GITHUB_SHA." \
+            '{head: $head, base: "main", title: ("ci(dev): update auth image (" + env.GITHUB_SHA[:12] + ")"), body: $body}')
          PR_JSON=$(curl -sS -X POST \
            -H "Authorization: token ${CI_GITEA_TOKEN}" \
            -H "Content-Type: application/json" \
@@ -184,11 +153,6 @@ jobs:
          if [ "${REVIEW_HTTP}" -lt 200 ] || [ "${REVIEW_HTTP}" -ge 300 ]; then
            echo "::notice::Failed to request reviewers for cartsnitch/infra PR #${PR_NUM} (HTTP ${REVIEW_HTTP}); continuing"
          fi
-          # CAR-1216: the in-job merge attempt is a best-effort fast-path only.
-          # `cartsnitch/infra` main requires a human approving review; the CI bot
-          # cannot self-approve. Treat any non-merged outcome (approvals pending,
-          # checks pending, any other Gitea message) as the GitOps approval gate
-          # — the PR is already opened and cs_savannah is requested as reviewer.
          MERGE_RESP=$(curl -sS -X POST \
            -H "Authorization: token ${CI_GITEA_TOKEN}" \
            -H "Content-Type: application/json" \
@@ -196,12 +160,16 @@ jobs:
            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/merge")
          MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false')
          if [ "$MERGED" = "true" ]; then
-            echo "PR #${PR_NUM} merged into cartsnitch/infra dev"
-          else
-            # CAR-1438: PR opened successfully; any non-merged outcome (empty body,
-            # approval-gate, pending checks) is the GitOps gate — not a failure.
-            echo "::notice::infra PR #${PR_NUM} opened — auto-merge not available (${MERGE_RESP:-empty response}); awaiting CTO (cs_savannah) approve+merge"
+            echo "PR #${PR_NUM} merged into cartsnitch/infra main"
+          elif echo "$MERGE_RESP" | grep -qi 'does not have enough approvals'; then
+            # GitOps approval gate: PR is correctly opened and surfaces in
+            # CTO queue via the reviewers request above. Treat as success
+            # so the job does not hard-fail on approvals.
+            echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure"
            exit 0
+          else
+            echo "::error::Auto-merge of cartsnitch/infra PR #${PR_NUM} failed: $MERGE_RESP"
+            exit 1
          fi

  deploy-uat:
@@ -214,7 +182,7 @@ jobs:
        with:
          repository: cartsnitch/infra
          token: ${{ secrets.CI_GITEA_TOKEN }}
-          ref: ${{ github.ref == 'refs/heads/main' && 'main' || (github.ref == 'refs/heads/uat' && 'uat' || 'dev') }}
+          ref: main
          path: infra

      - name: Install kustomize
@@ -263,9 +231,8 @@ jobs:
            echo "::notice::Refusing to push directly to protected branch — falling back to contents API"
            exit 0
          fi
-          TITLE="ci(uat): update auth image (${GITHUB_SHA::12})"
-          PR_BODY=$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base main --arg title "$TITLE" --arg body "Bumps apps/overlays/uat/kustomization.yaml auth newTag to \`${{ steps.tag.outputs.tag }}\` from cartsnitch/auth CI build $GITHUB_SHA." \
-            '{head: $head, base: $base, title: $title, body: $body}')
+          PR_BODY=$(jq -n --arg head "$BRANCH" --arg body "Bumps apps/overlays/uat/kustomization.yaml auth newTag to \`${{ steps.tag.outputs.tag }}\` from cartsnitch/auth CI build $GITHUB_SHA." \
+            '{head: $head, base: "main", title: ("ci(uat): update auth image (" + env.GITHUB_SHA[:12] + ")"), body: $body}')
          PR_JSON=$(curl -sS -X POST \
            -H "Authorization: token ${CI_GITEA_TOKEN}" \
            -H "Content-Type: application/json" \
@@ -285,7 +252,6 @@ jobs:
          if [ "${REVIEW_HTTP}" -lt 200 ] || [ "${REVIEW_HTTP}" -ge 300 ]; then
            echo "::notice::Failed to request reviewers for cartsnitch/infra PR #${PR_NUM} (HTTP ${REVIEW_HTTP}); continuing"
          fi
-          # CAR-1216: see deploy-dev — same never-fail on merge outcome.
          MERGE_RESP=$(curl -sS -X POST \
            -H "Authorization: token ${CI_GITEA_TOKEN}" \
            -H "Content-Type: application/json" \
@@ -293,11 +259,14 @@ jobs:
            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/merge")
          MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false')
          if [ "$MERGED" = "true" ]; then
-            echo "PR #${PR_NUM} merged into cartsnitch/infra uat"
-          else
-            # CAR-1438: PR opened successfully; any non-merged outcome (empty body,
-            # approval-gate, pending checks) is the GitOps gate — not a failure.
-            echo "::notice::infra PR #${PR_NUM} opened — auto-merge not available (${MERGE_RESP:-empty response}); awaiting CTO (cs_savannah) approve+merge"
+            echo "PR #${PR_NUM} merged into cartsnitch/infra main"
+          elif echo "$MERGE_RESP" | grep -qi 'does not have enough approvals'; then
+            # GitOps approval gate: PR is correctly opened and surfaces in
+            # CTO queue via the reviewers request above. Treat as success
+            # so the job does not hard-fail on approvals.
+            echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure"
            exit 0
+          else
+            echo "::error::Auto-merge of cartsnitch/infra PR #${PR_NUM} failed: $MERGE_RESP"
+            exit 1
          fi
-
@@ -818,9 +818,9 @@
      }
    },
    "node_modules/defu": {
-      "version": "6.1.7",
-      "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.7.tgz",
-      "integrity": "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==",
+      "version": "6.1.4",
+      "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.4.tgz",
+      "integrity": "sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg==",
      "license": "MIT"
    },
    "node_modules/esbuild": {
@@ -909,9 +909,9 @@
      }
    },
    "node_modules/kysely": {
-      "version": "0.28.17",
-      "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.28.17.tgz",
-      "integrity": "sha512-nbD8lB9EB3wNdMhOCdx5Li8DxnLbvKByylRLcJ1h+4SkrowVeECAyZlyiKMThF7xFdRz0jSQ2MoJr+wXux2y0Q==",
+      "version": "0.28.14",
+      "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.28.14.tgz",
+      "integrity": "sha512-SU3lgh0rPvq7upc6vvdVrCsSMUG1h3ChvHVOY7wJ2fw4C9QEB7X3d5eyYEyULUX7UQtxZJtZXGuT6U2US72UYA==",
      "license": "MIT",
      "engines": {
        "node": ">=20.0.0"
@@ -21,10 +21,5 @@
    "@types/pg": "^8.11.0",
    "tsx": "^4.19.0",
    "typescript": "^5.7.0"
-  },
-  "overrides": {
-    "picomatch": "^4.0.4",
-    "defu": "^6.1.5",
-    "kysely": "^0.28.17"
  }
-}
+}
@@ -115,9 +115,6 @@ export const auth = betterAuth({
  trustedOrigins: [
    "http://localhost:3000",
    "http://localhost:5173",
-    "https://cartsnitch.farh.net",
-    "https://cartsnitch.dev.farh.net",
-    "https://cartsnitch.uat.farh.net",
    "https://cartsnitch.com",
    "https://dev.cartsnitch.com",
    "https://uat.cartsnitch.com",
Author	SHA1	Message	Date
Savannah Savings	72f2568b68	Merge pull request 'fix(ci): use CI_GITEA_TOKEN for cross-repo infra access in deploy jobs (CAR-1270)' (#35 ) from betty/car-1270-ci-gitea-token-main into main CI / build-and-push (push) Successful in 2m5s Details CI / deploy-dev (push) Failing after 3s Details CI / deploy-uat (push) Failing after 3s Details	2026-06-05 05:12:45 +00:00
Barcode Betty	a0be839632	fix(ci): use CI_GITEA_TOKEN for cross-repo infra access in deploy jobs (CAR-1270) CI / build-and-push (pull_request) Has been skipped Details CI / deploy-dev (pull_request) Has been skipped Details CI / deploy-uat (pull_request) Has been skipped Details Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-05 00:53:43 +00:00
Savannah Savings	0977a7c3b3	Merge pull request 'ci(auth): migrate deploy-dev/deploy-uat to PR-bump + fix registry token (CAR-1263)' (#33 ) from cs_betty/car-1263-auth-pr-bump-main into main CI / build-and-push (push) Successful in 10s Details CI / deploy-dev (push) Failing after 34s Details CI / deploy-uat (push) Failing after 36s Details	2026-06-05 00:34:48 +00:00
Barcode Betty	21fba7a842	ci(auth): migrate deploy-dev/deploy-uat to PR-bump + fix registry token (CAR-1263) CI / build-and-push (pull_request) Has been skipped Details CI / deploy-dev (pull_request) Has been skipped Details CI / deploy-uat (pull_request) Has been skipped Details Migrates auth .gitea/workflows/ci.yml deploy-dev and deploy-uat jobs from direct 'git push origin main' to cartsnitch/infra to the CAR-1195 PR-bump pattern. Brings auth in line with cartsnitch/cartsnitch and stops the red deploy-dev/deploy-uat jobs on main pushes. Also fixes the registry-login password to use REGISTRY_TOKEN (CAR-1009 standard) instead of GITEA_TOKEN — uat already had this fix (CAR-1237); main was lagging. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-05 00:23:07 +00:00