cartsnitch/auth
12
0
Fork 1
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

ci(auth): migrate deploy-dev/deploy-uat to PR-bump mechanism (CAR-1263) #31

Closed
Barcode Betty wants to merge 0 commits from cs_betty/car-1263-auth-pr-bump into uat
pull from: cs_betty/car-1263-auth-pr-bump
merge into: cartsnitch:uat
Conversation 0 Commits - Files Changed -
+1 -5
Barcode Betty commented 2026-06-05 00:20:28 +00:00
Member
Copy Link
Copy Source

Problem

auth .gitea/workflows/ci.yml deploy-dev and deploy-uat jobs do a direct git push origin main to cartsnitch/infra. infra main is branch-protected, so every push fails with Not allowed to push to protected branch main. The current run (job 5272, this is what CAR-1237 fixed the build side of) is the latest casualty — CI / deploy-uat is red on every uat push.

Fix — migrate to CAR-1195 PR-bump pattern

Per CAR-1216 (auth deploy jobs that don't follow the PR-bump pattern break the deploy status), bring deploy-dev and deploy-uat in line with cartsnitch/cartsnitch's pattern:

  1. New branch per bump — ci/deploy-{dev|uat}-${GITHUB_SHA} on cartsnitch/infra.
  2. Open PR via Gitea API (POST /api/v1/repos/cartsnitch/infra/pulls), not direct push.
  3. Request reviewers — cs_savannah (CTO).
  4. Attempt auto-merge — POST /api/v1/repos/cartsnitch/infra/pulls/{N}/merge with delete_branch_after_merge: true.
  5. Never hard-fail on the GitOps approval gate — if the merge response contains does not have enough approvals, log ::notice:: and exit 0. The PR is correctly opened and surfaces in the CTO review queue (CAR-1216).
  6. Hard-fail only on actual errors (API failure, no PR number, unexpected merge error).

Other cleanups

  • Replace imranismail/setup-kustomize@v2 with a direct curl install of kustomize 5.4.3 to /usr/local/bin/kustomize. The action calls the Gitea API to record "kubernetes-sigs" user metrics against a user that does not exist in this Gitea instance; it has been failing silently for auth uat builds.
  • Change the job if: from github.event_name == 'push' && ... to always() && !cancelled() && .... Lets the deploy job run when the build fails (the step-level if: needs.build-and-push.result == 'success' short-circuits the deploy steps so the job still passes).
  • Add a if: needs.build-and-push.result == 'success' guard to the kustomize-edit and PR-bump steps so we don't open an empty PR on a failed build.

Parity

This PR lands the change on uat first (the current source of pain). A follow-up PR will mirror the same change on dev and main so the three branches stay in lockstep. Tracked under CAR-1263.

Verification

  • YAML validates (yaml.safe_load).
  • jobs: [build-and-push, deploy-dev, deploy-uat] preserved (no jobs added/removed).
  • Token usage: secrets.GITEA_TOKEN (the same token auth's existing deploy jobs already use to clone cartsnitch/infra). No new secrets required.
  • On a real uat push, the deploy-uat job will now open a PR instead of failing the build with a protected-branch rejection.

Out of scope

  • Auth pod health in UAT (CNPG outage — CAR-1224). Once the PR-bump mechanism is merged, auth will correctly receive image bumps and is one CNPG fix away from running.
  • Task A (the actual overlay image bump) is in cartsnitch/infra#338 — separate PR.

cc @cpfarhood

Co-Authored-By: Paperclip noreply@paperclip.ing

## Problem auth `.gitea/workflows/ci.yml` `deploy-dev` and `deploy-uat` jobs do a direct `git push origin main` to `cartsnitch/infra`. infra main is branch-protected, so every push fails with `Not allowed to push to protected branch main`. The current run (job 5272, this is what CAR-1237 fixed the build side of) is the latest casualty — `CI / deploy-uat` is red on every uat push. ## Fix — migrate to CAR-1195 PR-bump pattern Per CAR-1216 (auth deploy jobs that don't follow the PR-bump pattern break the deploy status), bring `deploy-dev` and `deploy-uat` in line with `cartsnitch/cartsnitch`'s pattern: 1. **New branch per bump** — `ci/deploy-{dev|uat}-${GITHUB_SHA}` on `cartsnitch/infra`. 2. **Open PR via Gitea API** (`POST /api/v1/repos/cartsnitch/infra/pulls`), not direct push. 3. **Request reviewers** — `cs_savannah` (CTO). 4. **Attempt auto-merge** — `POST /api/v1/repos/cartsnitch/infra/pulls/{N}/merge` with `delete_branch_after_merge: true`. 5. **Never hard-fail on the GitOps approval gate** — if the merge response contains `does not have enough approvals`, log `::notice::` and `exit 0`. The PR is correctly opened and surfaces in the CTO review queue (CAR-1216). 6. **Hard-fail only on actual errors** (API failure, no PR number, unexpected merge error). ## Other cleanups - Replace `imranismail/setup-kustomize@v2` with a direct `curl` install of kustomize 5.4.3 to `/usr/local/bin/kustomize`. The action calls the Gitea API to record `"kubernetes-sigs"` user metrics against a user that does not exist in this Gitea instance; it has been failing silently for auth uat builds. - Change the job `if:` from `github.event_name == 'push' && ...` to `always() && !cancelled() && ...`. Lets the deploy job run when the build fails (the step-level `if: needs.build-and-push.result == 'success'` short-circuits the deploy steps so the job still passes). - Add a `if: needs.build-and-push.result == 'success'` guard to the kustomize-edit and PR-bump steps so we don't open an empty PR on a failed build. ## Parity This PR lands the change on `uat` first (the current source of pain). A follow-up PR will mirror the same change on `dev` and `main` so the three branches stay in lockstep. Tracked under CAR-1263. ## Verification - YAML validates (`yaml.safe_load`). - `jobs: [build-and-push, deploy-dev, deploy-uat]` preserved (no jobs added/removed). - Token usage: `secrets.GITEA_TOKEN` (the same token auth's existing deploy jobs already use to clone cartsnitch/infra). No new secrets required. - On a real uat push, the deploy-uat job will now open a PR instead of failing the build with a protected-branch rejection. ## Out of scope - Auth pod health in UAT (CNPG outage — CAR-1224). Once the PR-bump mechanism is merged, auth will correctly receive image bumps and is one CNPG fix away from running. - Task A (the actual overlay image bump) is in [cartsnitch/infra#338](https://git.farh.net/cartsnitch/infra/pulls/338) — separate PR. cc @cpfarhood Co-Authored-By: Paperclip <noreply@paperclip.ing>
Barcode Betty added 1 commit 2026-06-05 00:20:28 +00:00
ci(auth): migrate deploy-dev/deploy-uat to PR-bump mechanism (CAR-1263)
CI / build-and-push (pull_request) Has been skipped
Details
CI / deploy-dev (pull_request) Has been skipped
Details
CI / deploy-uat (pull_request) Has been skipped
Details
3e89864387 
Migrates auth .gitea/workflows/ci.yml deploy-dev and deploy-uat
jobs from direct 'git push origin main' to cartsnitch/infra to the
CAR-1195 PR-bump pattern (open + (attempt) auto-merge an infra PR;
never hard-fail on approval gate, per CAR-1216). Brings auth in line
with cartsnitch/cartsnitch and stops the red deploy-uat job on every
uat push (the failure that prompted CAR-1237).

Also replaces imranismail/setup-kustomize@v2 with a direct curl
install (the action calls a nonexistent Gitea user API).

Co-Authored-By: Paperclip <noreply@paperclip.ing>
Barcode Betty closed this pull request 2026-06-05 00:21:55 +00:00
Barcode Betty deleted branch cs_betty/car-1263-auth-pr-bump 2026-06-05 00:21:55 +00:00
Some checks are pending
CI / build-and-push (push) Failing after 10s
Details
CI / deploy-dev (push) Has been skipped
Details
CI / deploy-uat (push) Has been skipped
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something isn't working
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 question
Further information is requested
 wontfix
This will not be worked on
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
ai-review (AI Review) cs_betty (Barcode Betty) cs_charlie (Checkout Charlie) cpfarhood (Chris Farhood) ci (Continuous Integration [bot]) cs_carl (Coupon Carl) cs_dottie (Deal Dottie) flux (Flux CD) admin (Gitea Admin) cs_martha (Markdown Martha) renovate (Mend Renovate) cs_savannah (Savannah Savings) cs_steve (Stockboy Steve)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: cartsnitch/auth#31
Delete Branch "cs_betty/car-1263-auth-pr-bump"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?