ci: never hard-fail deploy-dev/deploy-uat on infra-PR merge outcome (CAR-1216)

The CI bot cannot self-approve cartsnitch/infra main's required human
review, so the in-job auto-merge attempt is structurally impossible
and would always fail with SOME message (checks-pending, then
approvals, then transient errors). Special-casing individual error
strings is fragile — CAR-1212's 'Does not have enough approvals' branch
proved it (deploy-dev run 4999 hit the final else-branch instead).

Make job success depend only on the infra PR being OPENED (and
cs_savannah review requested), NOT on the merge outcome. Replace both
the approvals-elif branch and the final else (exit 1) branch with a
single non-failing branch: emit a ::notice:: with the merge response
and exit 0. The ONLY remaining hard-fail is the empty PR_NUM check
(PR could not be created).

Same change applied symmetrically to deploy-uat.

Refs CAR-1195, CAR-1194, CAR-1212, CAR-1216.

.gitea/workflows/ci.yml

@@ -567,18 +567,36 @@ jobs:
             exit 1
           fi
           echo "Opened cartsnitch/infra PR #${PR_NUM} (head=${BRANCH})"
+          # Request CTO (cs_savannah) review as the GitOps hand-off. Best-effort:
+          # log on non-2xx but never fail the job for this.
+          REVIEW_HTTP=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
+            -H "Authorization: token ${CI_GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"reviewers":["cs_savannah"]}' \
+            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/requested_reviewers")
+          if [ "${REVIEW_HTTP}" -lt 200 ] || [ "${REVIEW_HTTP}" -ge 300 ]; then
+            echo "::notice::Failed to request reviewers for cartsnitch/infra PR #${PR_NUM} (HTTP ${REVIEW_HTTP}); continuing"
+          fi
           MERGE_RESP=$(curl -sS -X POST \
             -H "Authorization: token ${CI_GITEA_TOKEN}" \
             -H "Content-Type: application/json" \
             -d '{"Do":"merge","delete_branch_after_merge":true}' \
             "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/merge")
           MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false')
-          if [ "$MERGED" != "true" ]; then
-            echo "::error::Auto-merge of cartsnitch/infra PR #${PR_NUM} failed: $MERGE_RESP"
-            echo "::error::Reassign to cs_savannah (authorized merger for cartsnitch/infra main) for backstop merge."
-            exit 1
+          if [ "$MERGED" = "true" ]; then
+            echo "PR #${PR_NUM} merged into cartsnitch/infra main"
+          else
+            # GitOps approval gate (CAR-1216): the CI bot cannot self-approve
+            # cartsnitch/infra main's required human review, so the in-job
+            # auto-merge is structurally impossible and will always fail with
+            # SOME message (checks-pending, then approvals, then transient
+            # errors). Special-casing individual messages is fragile. The PR
+            # is correctly opened, cs_savannah is requested as reviewer, and
+            # the CTO will backstop-merge — that is the success condition.
+            # Treat every merge-outcome failure as success (exit 0).
+            echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure: $MERGE_RESP"
+            exit 0
           fi
-          echo "PR #${PR_NUM} merged into cartsnitch/infra main"
 
   deploy-uat:
     runs-on: ubuntu-latest
@@ -693,15 +711,33 @@ jobs:
             exit 1
           fi
           echo "Opened cartsnitch/infra PR #${PR_NUM} (head=${BRANCH})"
+          # Request CTO (cs_savannah) review as the GitOps hand-off. Best-effort:
+          # log on non-2xx but never fail the job for this.
+          REVIEW_HTTP=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
+            -H "Authorization: token ${CI_GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"reviewers":["cs_savannah"]}' \
+            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/requested_reviewers")
+          if [ "${REVIEW_HTTP}" -lt 200 ] || [ "${REVIEW_HTTP}" -ge 300 ]; then
+            echo "::notice::Failed to request reviewers for cartsnitch/infra PR #${PR_NUM} (HTTP ${REVIEW_HTTP}); continuing"
+          fi
           MERGE_RESP=$(curl -sS -X POST \
             -H "Authorization: token ${CI_GITEA_TOKEN}" \
             -H "Content-Type: application/json" \
             -d '{"Do":"merge","delete_branch_after_merge":true}' \
             "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/merge")
           MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false')
-          if [ "$MERGED" != "true" ]; then
-            echo "::error::Auto-merge of cartsnitch/infra PR #${PR_NUM} failed: $MERGE_RESP"
-            echo "::error::Reassign to cs_savannah (authorized merger for cartsnitch/infra main) for backstop merge."
-            exit 1
+          if [ "$MERGED" = "true" ]; then
+            echo "PR #${PR_NUM} merged into cartsnitch/infra main"
+          else
+            # GitOps approval gate (CAR-1216): the CI bot cannot self-approve
+            # cartsnitch/infra main's required human review, so the in-job
+            # auto-merge is structurally impossible and will always fail with
+            # SOME message (checks-pending, then approvals, then transient
+            # errors). Special-casing individual messages is fragile. The PR
+            # is correctly opened, cs_savannah is requested as reviewer, and
+            # the CTO will backstop-merge — that is the success condition.
+            # Treat every merge-outcome failure as success (exit 0).
+            echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure: $MERGE_RESP"
+            exit 0
           fi
-          echo "PR #${PR_NUM} merged into cartsnitch/infra main"