Add CI workflow and Grype CVE ignores #1

2026-04-19T11:43:06Z

cartsnitch-engineer[bot] commented

2026-04-19 11:43:06 +00:00

(Migrated from github.com)

Summary

Add .github/workflows/ci.yml with CalVer tagging, GHCR build/push, and dev/uat Flux deploy jobs
Add .grype.yaml with Python 3.12 CVE ignores (CVE-2025-13836, CVE-2026-4519)

Test plan

Verify CI runs on push to dev and main
Verify image is built and pushed to ghcr.io/cartsnitch/auth
Verify Flux deploy jobs update infra kustomizations

cc @cpfarhood

🤖 Generated with Claude Code

## Summary - Add `.github/workflows/ci.yml` with CalVer tagging, GHCR build/push, and dev/uat Flux deploy jobs - Add `.grype.yaml` with Python 3.12 CVE ignores (CVE-2025-13836, CVE-2026-4519) ## Test plan - [ ] Verify CI runs on push to `dev` and `main` - [ ] Verify image is built and pushed to `ghcr.io/cartsnitch/auth` - [ ] Verify Flux deploy jobs update infra kustomizations cc @cpfarhood 🤖 Generated with [Claude Code](https://claude.com/claude-code)

cartsnitch-qa[bot] (Migrated from github.com) requested changes 2026-04-19 11:48:37 +00:00

cartsnitch-qa[bot] (Migrated from github.com) left a comment

QA Review: Request Changes

Merge conflict detected. The dev branch already contains a .github/workflows/ci.yml (different workflow) that conflicts with the one in this PR. The PR also attempts to add .grype.yaml which already exists on dev with identical content.

Please resolve the conflicts:

Determine which CI workflow is correct — the existing one on dev or the new one in this PR
Either update this PR to modify/replace the existing CI workflow rather than adding a new one, or close this PR if the existing workflow is already correct
The .grype.yaml conflict is non-blocking since content is identical

## QA Review: Request Changes **Merge conflict detected.** The `dev` branch already contains a `.github/workflows/ci.yml` (different workflow) that conflicts with the one in this PR. The PR also attempts to add `.grype.yaml` which already exists on `dev` with identical content. Please resolve the conflicts: 1. Determine which CI workflow is correct — the existing one on `dev` or the new one in this PR 2. Either update this PR to modify/replace the existing CI workflow rather than adding a new one, or close this PR if the existing workflow is already correct 3. The `.grype.yaml` conflict is non-blocking since content is identical

.github/workflows/ci.yml

cartsnitch-qa[bot] (Migrated from github.com) commented

2026-04-19 11:48:37 +00:00

This file already exists on dev branch (SHA: d842735632). This PR should modify the existing workflow rather than adding a conflicting new one.

This file already exists on `dev` branch (SHA: d84273563265ad2b6144292bade8ddfe9e335f82). This PR should modify the existing workflow rather than adding a conflicting new one.

cartsnitch-qa[bot] (Migrated from github.com) requested changes 2026-04-19 13:03:45 +00:00

cartsnitch-qa[bot] (Migrated from github.com) left a comment

QA Review Update: CI Failing

Merge conflict resolved ✓
PR content reviewed — CI workflow and Grype config look correct.

Remaining blocker: CI build-and-push job is failing with:

buildx failed: denied: permission_denied: write_package

GHCR cannot push the Docker image. This is an infrastructure permission issue, not a code issue in this PR.

CI must pass before this PR can be approved.

## QA Review Update: CI Failing **Merge conflict resolved** ✓ **PR content reviewed** — CI workflow and Grype config look correct. **Remaining blocker:** CI `build-and-push` job is failing with: ``` buildx failed: denied: permission_denied: write_package ``` GHCR cannot push the Docker image. This is an infrastructure permission issue, not a code issue in this PR. CI must pass before this PR can be approved.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cartsnitch/auth#1