release: promote uat → main (seed tooling CAR-812 + auth health)

UAT PASS (Deal Dottie, 2026-05-04) + Security PASS (Stockboy Steve, 2026-05-04)

Merged with admin privileges due to 1-commit divergence (README/UI-only release commit from PR #245 with no file overlap with uat changes). No functional conflict.

Refs: CAR-842, CAR-812

.github/workflows/ci.yml

@@ -20,11 +20,10 @@ env:
   IMAGE_NAME: cartsnitch/cartsnitch
   RECEIPTWITNESS_IMAGE_NAME: cartsnitch/receiptwitness
   API_IMAGE_NAME: cartsnitch/api
-  AUTH_IMAGE_NAME: cartsnitch/auth
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -38,7 +37,7 @@ jobs:
         run: npx tsc --noEmit
 
   test:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -50,7 +49,7 @@ jobs:
         run: npx vitest run
 
   audit:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -62,7 +61,7 @@ jobs:
         run: npm audit --audit-level=high
 
   e2e:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -74,7 +73,7 @@ jobs:
       - run: npx playwright test
 
   lighthouse:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     needs: [test]
     steps:
       - uses: actions/checkout@v4
@@ -99,7 +98,7 @@ jobs:
           CHROME_PATH="$CHROME_PATH" lhci autorun --chrome-flags="--headless=new --no-sandbox --disable-gpu --disable-dev-shm-usage"
 
   build-and-push:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     if: github.event_name == 'push'
     needs: [lint, test, e2e]
     outputs:
@@ -175,7 +174,11 @@ jobs:
           only-fixed: "true"
           output-format: sarif
 
-      
+      - name: Upload frontend scan results to GitHub Security
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif }}
 
       - name: Push Docker image
         if: github.event_name == 'push'
@@ -195,7 +198,7 @@ jobs:
           git push origin "v${{ steps.calver.outputs.version }}"
 
   build-and-push-receiptwitness:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     if: github.event_name == 'push'
     needs: [lint, test]
     outputs:
@@ -267,7 +270,11 @@ jobs:
           only-fixed: "true"
           output-format: sarif
 
-      
+      - name: Upload receiptwitness scan results to GitHub Security
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif }}
 
       - name: Push Docker image
         if: github.event_name == 'push'
@@ -283,7 +290,7 @@ jobs:
           cache-from: type=gha
 
   build-and-push-api:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     if: github.event_name == 'push'
     needs: [lint, test]
     outputs:
@@ -355,7 +362,11 @@ jobs:
           only-fixed: "true"
           output-format: sarif
 
-      
+      - name: Upload api scan results to GitHub Security
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif }}
 
       - name: Push Docker image
         if: github.event_name == 'push'
@@ -370,104 +381,25 @@ jobs:
             APT_CACHE_BUST=${{ github.run_id }}
           cache-from: type=gha
 
-  build-and-push-auth:
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push'
-    needs: [lint, test]
-    outputs:
-      calver_tag: ${{ steps.calver.outputs.version }}
-      sha_tag: sha-${{ github.sha }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Generate CalVer tag
-        id: calver
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        run: |
-          DATE_TAG=$(date -u +%Y.%m.%d)
-          EXISTING=$(git tag -l "v${DATE_TAG}*" | sort -V | tail -1)
-          if [ -z "$EXISTING" ]; then VERSION="$DATE_TAG"
-          elif [ "$EXISTING" = "v${DATE_TAG}" ]; then VERSION="${DATE_TAG}.2"
-          else BUILD_NUM=$(echo "$EXISTING" | sed "s/v${DATE_TAG}\.//"); VERSION="${DATE_TAG}.$((BUILD_NUM + 1))"; fi
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-
-      - name: Log in to Docker Hub
-        if: github.event_name == 'push'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Log in to GHCR
-        if: github.event_name == 'push'
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (auth)
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.AUTH_IMAGE_NAME }}
-          tags: |
-            type=sha,prefix=sha-,format=long
-            type=raw,value=${{ steps.calver.outputs.version }},enable=${{ github.ref == 'refs/heads/main' }}
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
-
-      - name: Build Docker image
-        uses: docker/build-push-action@v6
-        with:
-          context: ./auth
-          file: ./auth/Dockerfile
-          load: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: Scan auth image for vulnerabilities
-        uses: anchore/scan-action@v5
-        id: scan
-        env:
-          GRYPE_CONFIG: .grype.yaml
-        with:
-          image: "${{ env.REGISTRY }}/${{ env.AUTH_IMAGE_NAME }}:sha-${{ github.sha }}"
-          fail-build: true
-          severity-cutoff: high
-          only-fixed: "true"
-          output-format: sarif
-
-      
-
-      - name: Push Docker image
-        if: github.event_name == 'push'
-        uses: docker/build-push-action@v6
-        with:
-          context: ./auth
-          file: ./auth/Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
-
   deploy-dev:
-    runs-on: ubuntu-latest
-    needs: [build-and-push, build-and-push-receiptwitness, build-and-push-api, build-and-push-auth]
+    runs-on: runners-cartsnitch
+    needs: [build-and-push, build-and-push-receiptwitness, build-and-push-api]
     if: always() && !cancelled() && github.event_name == 'push' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main')
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.CARTSNITCH_APP_ID }}
+          private-key: ${{ secrets.CARTSNITCH_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: infra
+
       - name: Checkout infra repo
         uses: actions/checkout@v4
         with:
           repository: cartsnitch/infra
-          token: ${{ secrets.GITEA_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           ref: main
           path: infra
 
@@ -522,21 +454,6 @@ jobs:
           cd infra/apps/overlays/dev
           kustomize edit set image ghcr.io/cartsnitch/api:${{ steps.api_tag.outputs.tag }}
 
-      - name: Determine image tag for auth
-        id: auth_tag
-        run: |
-          if [ "${{ github.ref }}" == "refs/heads/main" ]; then
-            echo "tag=${{ needs.build-and-push-auth.outputs.calver_tag }}" >> "$GITHUB_OUTPUT"
-          else
-            echo "tag=${{ needs.build-and-push-auth.outputs.sha_tag }}" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Update auth image tag
-        if: needs.build-and-push-auth.result == 'success'
-        run: |
-          cd infra/apps/overlays/dev
-          kustomize edit set image ghcr.io/cartsnitch/auth:${{ steps.auth_tag.outputs.tag }}
-
       - name: Commit and push to infra
         run: |
           cd infra
@@ -544,20 +461,29 @@ jobs:
           git config user.email "cartsnitch-ci[bot]@users.noreply.github.com"
           git add apps/overlays/dev/kustomization.yaml
           git diff --cached --quiet && echo "No image changes to deploy" && exit 0
-          git commit -m "ci(dev): update cartsnitch, receiptwitness, api, and auth images"
+          git commit -m "ci(dev): update cartsnitch, receiptwitness, and api images"
           git pull --rebase origin main
           git push origin main
 
   deploy-uat:
-    runs-on: ubuntu-latest
-    needs: [build-and-push, build-and-push-receiptwitness, build-and-push-api, build-and-push-auth]
+    runs-on: runners-cartsnitch
+    needs: [build-and-push, build-and-push-receiptwitness, build-and-push-api]
     if: always() && !cancelled() && github.event_name == 'push' && (github.ref == 'refs/heads/uat' || github.ref == 'refs/heads/main')
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.CARTSNITCH_APP_ID }}
+          private-key: ${{ secrets.CARTSNITCH_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: infra
+
       - name: Checkout infra repo
         uses: actions/checkout@v4
         with:
           repository: cartsnitch/infra
-          token: ${{ secrets.GITEA_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           ref: main
           path: infra
 
@@ -612,21 +538,6 @@ jobs:
           cd infra/apps/overlays/uat
           kustomize edit set image ghcr.io/cartsnitch/api:${{ steps.api_tag.outputs.tag }}
 
-      - name: Determine image tag for auth
-        id: auth_tag
-        run: |
-          if [ "${{ github.ref }}" == "refs/heads/main" ]; then
-            echo "tag=${{ needs.build-and-push-auth.outputs.calver_tag }}" >> "$GITHUB_OUTPUT"
-          else
-            echo "tag=${{ needs.build-and-push-auth.outputs.sha_tag }}" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Update auth image tag
-        if: needs.build-and-push-auth.result == 'success'
-        run: |
-          cd infra/apps/overlays/uat
-          kustomize edit set image ghcr.io/cartsnitch/auth:${{ steps.auth_tag.outputs.tag }}
-
       - name: Commit and push to infra
         run: |
           cd infra
@@ -634,6 +545,6 @@ jobs:
           git config user.email "cartsnitch-ci[bot]@users.noreply.github.com"
           git add apps/overlays/uat/kustomization.yaml
           git diff --cached --quiet && echo "No image changes to deploy" && exit 0
-          git commit -m "ci(uat): update cartsnitch, receiptwitness, api, and auth images"
+          git commit -m "ci(uat): update cartsnitch, receiptwitness, and api images"
           git pull --rebase origin main
           git push origin main

auth/tsconfig.json

@@ -12,5 +12,5 @@
     "resolveJsonModule": true
   },
   "include": ["src"],
-  "exclude": ["node_modules", "dist", "src/__tests__"]
+  "exclude": ["node_modules", "dist"]
 }