ci: push Docker images to Gitea registry (git.farh.net)

chore: promote uat to main — auth repo migration (CAR-722)

.github/workflows/ci.yml

@@ -21,7 +21,7 @@ env:
 
 jobs:
   build-and-push:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     if: github.event_name == 'push'
     outputs:
       calver_tag: ${{ steps.calver.outputs.version }}
@@ -45,8 +45,8 @@ jobs:
       - name: Log in to Gitea Container Registry
         uses: docker/login-action@v3
         with:
-          registry: ${{ env.REGISTRY }}
+          registry: git.farh.net
-          username: ${{ github.actor }}
+          username: cartsnitch
           password: ${{ secrets.GITEA_TOKEN }}
 
       - name: Extract metadata
@@ -66,6 +66,8 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
       - name: Create git tag
         if: github.ref == 'refs/heads/main'
@@ -74,14 +76,23 @@ jobs:
           git push origin "v${{ steps.calver.outputs.version }}"
 
   deploy-dev:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     needs: [build-and-push]
     if: github.event_name == 'push' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main')
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.CARTSNITCH_APP_ID }}
+          private-key: ${{ secrets.CARTSNITCH_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: infra
+
       - uses: actions/checkout@v4
         with:
           repository: cartsnitch/infra
-          token: ${{ secrets.GITEA_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           ref: main
           path: infra
 
@@ -99,7 +110,7 @@ jobs:
       - name: Update auth image tag in dev overlay
         run: |
           cd infra/apps/overlays/dev
-          kustomize edit set image ghcr.io/cartsnitch/auth=git.farh.net/cartsnitch/auth:${{ steps.tag.outputs.tag }}
+          kustomize edit set image ghcr.io/cartsnitch/auth:${{ steps.tag.outputs.tag }}
 
       - name: Commit and push to infra
         run: |
@@ -113,14 +124,23 @@ jobs:
           git push origin main
 
   deploy-uat:
-    runs-on: ubuntu-latest
+    runs-on: runners-cartsnitch
     needs: [build-and-push]
     if: github.event_name == 'push' && (github.ref == 'refs/heads/uat' || github.ref == 'refs/heads/main')
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.CARTSNITCH_APP_ID }}
+          private-key: ${{ secrets.CARTSNITCH_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: infra
+
       - uses: actions/checkout@v4
         with:
           repository: cartsnitch/infra
-          token: ${{ secrets.GITEA_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           ref: main
           path: infra
 
@@ -138,7 +158,7 @@ jobs:
       - name: Update auth image tag in uat overlay
         run: |
           cd infra/apps/overlays/uat
-          kustomize edit set image ghcr.io/cartsnitch/auth=git.farh.net/cartsnitch/auth:${{ steps.tag.outputs.tag }}
+          kustomize edit set image ghcr.io/cartsnitch/auth:${{ steps.tag.outputs.tag }}
 
       - name: Commit and push to infra
         run: |