release: bcrypt cost factor 10→12, Grype CVE ignores, Dockerfile cache-bust (UAT+Security PASS)

release: bcrypt cost factor 10→12, Grype CVE ignores, Dockerfile cache-bust (UAT+Security PASS)

.github/workflows/ci.yml

@@ -569,6 +569,7 @@ jobs:
           git config user.name "cartsnitch-ci[bot]"
           git config user.email "cartsnitch-ci[bot]@users.noreply.github.com"
           git add apps/overlays/dev/kustomization.yaml
+          git diff --cached --quiet && echo "No image changes to deploy" && exit 0
           git commit -m "ci(dev): update cartsnitch, auth, receiptwitness, and api images"
           git pull --rebase origin main
           git push origin main
@@ -667,6 +668,7 @@ jobs:
           git config user.name "cartsnitch-ci[bot]"
           git config user.email "cartsnitch-ci[bot]@users.noreply.github.com"
           git add apps/overlays/uat/kustomization.yaml
+          git diff --cached --quiet && echo "No image changes to deploy" && exit 0
           git commit -m "ci(uat): update cartsnitch, auth, receiptwitness, and api images"
           git pull --rebase origin main
           git push origin main

auth/src/auth.ts

@@ -37,7 +37,7 @@ export const auth = betterAuth({
     maxPasswordLength: 128,
     password: {
       hash: async (password: string) => {
-        return bcrypt.hash(password, 10);
+        return bcrypt.hash(password, 12);
       },
       verify: async (data: { hash: string; password: string }) => {
         return bcrypt.compare(data.password, data.hash);