ci: never hard-fail deploy-dev/deploy-uat on infra-PR merge outcome (CAR-1216)

The CI bot cannot self-approve cartsnitch/infra main's required human review, so the in-job auto-merge attempt is structurally impossible and would always fail with SOME message (checks-pending, then approvals, then transient errors). Special-casing individual error strings is fragile — CAR-1212's 'Does not have enough approvals' branch proved it (deploy-dev run 4999 hit the final else-branch instead). Make job success depend only on the infra PR being OPENED (and cs_savannah review requested), NOT on the merge outcome. Replace both the approvals-elif branch and the final else (exit 1) branch with a single non-failing branch: emit a ::notice:: with the merge response and exit 0. The ONLY remaining hard-fail is the empty PR_NUM check (PR could not be created). Same change applied symmetrically to deploy-uat. Refs CAR-1195, CAR-1194, CAR-1212, CAR-1216.
Merge pull request 'ci: deploy-dev/deploy-uat: report success on infra-main approval gate (CAR-1212)' (#276 ) from betty/car-1212-approval-gate-exit0 into dev
2026-06-03 22:05:37 +00:00 · 2026-06-03 21:49:04 +00:00 · 2026-06-03 21:34:18 +00:00 · 2026-06-03 21:06:44 +00:00 · 2026-06-03 20:53:54 +00:00 · 2026-06-03 20:39:21 +00:00
1 changed files with 130 additions and 26 deletions
@@ -27,10 +27,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
-        with:
-          node-version: "20"
-          cache: npm
      - run: npm ci
      - name: ESLint
        run: npx eslint .
@@ -160,8 +156,8 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          target: prod
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=inline
+          cache-to: type=inline,mode=max

      - name: Scan frontend image for vulnerabilities
        uses: anchore/scan-action@v5
@@ -186,7 +182,7 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          target: prod
-          cache-from: type=gha
+          cache-from: type=inline

      - name: Create git tag
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
@@ -252,8 +248,8 @@ jobs:
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=inline
+          cache-to: type=inline,mode=max

      - name: Scan receiptwitness image for vulnerabilities
        uses: anchore/scan-action@v5
@@ -280,7 +276,7 @@ jobs:
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
+          cache-from: type=inline

  build-and-push-api:
    runs-on: ubuntu-latest
@@ -340,8 +336,8 @@ jobs:
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=inline
+          cache-to: type=inline,mode=max

      - name: Scan api image for vulnerabilities
        uses: anchore/scan-action@v5
@@ -368,7 +364,7 @@ jobs:
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
+          cache-from: type=inline

  build-and-push-auth:
    runs-on: ubuntu-latest
@@ -428,8 +424,8 @@ jobs:
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=inline
+          cache-to: type=inline,mode=max

      - name: Scan auth image for vulnerabilities
        uses: anchore/scan-action@v5
@@ -456,7 +452,7 @@ jobs:
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
+          cache-from: type=inline

  deploy-dev:
    runs-on: ubuntu-latest
@@ -467,7 +463,7 @@ jobs:
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          repository: cartsnitch/infra
-          token: ${{ secrets.REGISTRY_TOKEN }}
+          token: ${{ secrets.CI_GITEA_TOKEN }}
          ref: main
          path: infra

@@ -475,7 +471,16 @@ jobs:
        uses: azure/setup-kubectl@v4

      - name: Install kustomize
-        uses: imranismail/setup-kustomize@v2
+        # imranismail/setup-kustomize@v2 calls the Gitea API to record
+        # telemetry under the "kubernetes-sigs" user, which doesn't exist
+        # on this Gitea instance. Install the binary directly instead.
+        run: |
+          set -euo pipefail
+          version="5.4.3"
+          url="https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${version}/kustomize_v${version}_linux_amd64.tar.gz"
+          curl -fsSL --retry 3 "$url" | tar -xz -C /tmp kustomize
+          sudo install -m 0755 /tmp/kustomize /usr/local/bin/kustomize
+          kustomize version

      - name: Determine image tag for frontend
        id: frontend_tag
@@ -537,16 +542,61 @@ jobs:
          cd infra/apps/overlays/dev
          kustomize edit set image ghcr.io/cartsnitch/auth=git.farh.net/cartsnitch/auth:${{ steps.auth_tag.outputs.tag }}

-      - name: Commit and push to infra
+      - name: Commit and push to infra (via PR)
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
        run: |
          cd infra
          git config user.name "cartsnitch-ci[bot]"
          git config user.email "cartsnitch-ci[bot]@users.noreply.git.farh.net"
          git add apps/overlays/dev/kustomization.yaml
          git diff --cached --quiet && echo "No image changes to deploy" && exit 0
+          BRANCH="ci/deploy-dev-${GITHUB_SHA}"
+          git checkout -b "$BRANCH"
          git commit -m "ci(dev): update cartsnitch, receiptwitness, api, and auth images"
-          git pull --rebase origin main
-          git push origin main
+          git push origin "$BRANCH"
+          PR_BODY=$(printf 'Auto-opened by deploy-dev (CAR-1195).\n\nBuild SHA: %s' "${GITHUB_SHA}")
+          PR_JSON=$(curl -sS -X POST \
+            -H "Authorization: token ${CI_GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base main --arg title "ci(dev): update overlay image tags (${GITHUB_SHA::12})" --arg body "$PR_BODY" '{head:$head,base:$base,title:$title,body:$body}')" \
+            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls")
+          PR_NUM=$(echo "$PR_JSON" | jq -r '.number // empty')
+          if [ -z "$PR_NUM" ]; then
+            echo "::error::Failed to open PR against cartsnitch/infra: $PR_JSON"
+            exit 1
+          fi
+          echo "Opened cartsnitch/infra PR #${PR_NUM} (head=${BRANCH})"
+          # Request CTO (cs_savannah) review as the GitOps hand-off. Best-effort:
+          # log on non-2xx but never fail the job for this.
+          REVIEW_HTTP=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
+            -H "Authorization: token ${CI_GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"reviewers":["cs_savannah"]}' \
+            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/requested_reviewers")
+          if [ "${REVIEW_HTTP}" -lt 200 ] || [ "${REVIEW_HTTP}" -ge 300 ]; then
+            echo "::notice::Failed to request reviewers for cartsnitch/infra PR #${PR_NUM} (HTTP ${REVIEW_HTTP}); continuing"
+          fi
+          MERGE_RESP=$(curl -sS -X POST \
+            -H "Authorization: token ${CI_GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"Do":"merge","delete_branch_after_merge":true}' \
+            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/merge")
+          MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false')
+          if [ "$MERGED" = "true" ]; then
+            echo "PR #${PR_NUM} merged into cartsnitch/infra main"
+          else
+            # GitOps approval gate (CAR-1216): the CI bot cannot self-approve
+            # cartsnitch/infra main's required human review, so the in-job
+            # auto-merge is structurally impossible and will always fail with
+            # SOME message (checks-pending, then approvals, then transient
+            # errors). Special-casing individual messages is fragile. The PR
+            # is correctly opened, cs_savannah is requested as reviewer, and
+            # the CTO will backstop-merge — that is the success condition.
+            # Treat every merge-outcome failure as success (exit 0).
+            echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure: $MERGE_RESP"
+            exit 0
+          fi

  deploy-uat:
    runs-on: ubuntu-latest
@@ -557,7 +607,7 @@ jobs:
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          repository: cartsnitch/infra
-          token: ${{ secrets.REGISTRY_TOKEN }}
+          token: ${{ secrets.CI_GITEA_TOKEN }}
          ref: main
          path: infra

@@ -565,7 +615,16 @@ jobs:
        uses: azure/setup-kubectl@v4

      - name: Install kustomize
-        uses: imranismail/setup-kustomize@v2
+        # imranismail/setup-kustomize@v2 calls the Gitea API to record
+        # telemetry under the "kubernetes-sigs" user, which doesn't exist
+        # on this Gitea instance. Install the binary directly instead.
+        run: |
+          set -euo pipefail
+          version="5.4.3"
+          url="https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${version}/kustomize_v${version}_linux_amd64.tar.gz"
+          curl -fsSL --retry 3 "$url" | tar -xz -C /tmp kustomize
+          sudo install -m 0755 /tmp/kustomize /usr/local/bin/kustomize
+          kustomize version

      - name: Determine image tag for frontend
        id: frontend_tag
@@ -627,13 +686,58 @@ jobs:
          cd infra/apps/overlays/uat
          kustomize edit set image ghcr.io/cartsnitch/auth=git.farh.net/cartsnitch/auth:${{ steps.auth_tag.outputs.tag }}

-      - name: Commit and push to infra
+      - name: Commit and push to infra (via PR)
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
        run: |
          cd infra
          git config user.name "cartsnitch-ci[bot]"
          git config user.email "cartsnitch-ci[bot]@users.noreply.git.farh.net"
          git add apps/overlays/uat/kustomization.yaml
          git diff --cached --quiet && echo "No image changes to deploy" && exit 0
+          BRANCH="ci/deploy-uat-${GITHUB_SHA}"
+          git checkout -b "$BRANCH"
          git commit -m "ci(uat): update cartsnitch, receiptwitness, api, and auth images"
-          git pull --rebase origin main
-          git push origin main
+          git push origin "$BRANCH"
+          PR_BODY=$(printf 'Auto-opened by deploy-uat (CAR-1195).\n\nBuild SHA: %s' "${GITHUB_SHA}")
+          PR_JSON=$(curl -sS -X POST \
+            -H "Authorization: token ${CI_GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base main --arg title "ci(uat): update overlay image tags (${GITHUB_SHA::12})" --arg body "$PR_BODY" '{head:$head,base:$base,title:$title,body:$body}')" \
+            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls")
+          PR_NUM=$(echo "$PR_JSON" | jq -r '.number // empty')
+          if [ -z "$PR_NUM" ]; then
+            echo "::error::Failed to open PR against cartsnitch/infra: $PR_JSON"
+            exit 1
+          fi
+          echo "Opened cartsnitch/infra PR #${PR_NUM} (head=${BRANCH})"
+          # Request CTO (cs_savannah) review as the GitOps hand-off. Best-effort:
+          # log on non-2xx but never fail the job for this.
+          REVIEW_HTTP=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
+            -H "Authorization: token ${CI_GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"reviewers":["cs_savannah"]}' \
+            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/requested_reviewers")
+          if [ "${REVIEW_HTTP}" -lt 200 ] || [ "${REVIEW_HTTP}" -ge 300 ]; then
+            echo "::notice::Failed to request reviewers for cartsnitch/infra PR #${PR_NUM} (HTTP ${REVIEW_HTTP}); continuing"
+          fi
+          MERGE_RESP=$(curl -sS -X POST \
+            -H "Authorization: token ${CI_GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"Do":"merge","delete_branch_after_merge":true}' \
+            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/merge")
+          MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false')
+          if [ "$MERGED" = "true" ]; then
+            echo "PR #${PR_NUM} merged into cartsnitch/infra main"
+          else
+            # GitOps approval gate (CAR-1216): the CI bot cannot self-approve
+            # cartsnitch/infra main's required human review, so the in-job
+            # auto-merge is structurally impossible and will always fail with
+            # SOME message (checks-pending, then approvals, then transient
+            # errors). Special-casing individual messages is fragile. The PR
+            # is correctly opened, cs_savannah is requested as reviewer, and
+            # the CTO will backstop-merge — that is the success condition.
+            # Treat every merge-outcome failure as success (exit 0).
+            echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure: $MERGE_RESP"
+            exit 0
+          fi
Author	SHA1	Message	Date
Barcode Betty	8ed8226e20	ci: never hard-fail deploy-dev/deploy-uat on infra-PR merge outcome (CAR-1216) The CI bot cannot self-approve cartsnitch/infra main's required human review, so the in-job auto-merge attempt is structurally impossible and would always fail with SOME message (checks-pending, then approvals, then transient errors). Special-casing individual error strings is fragile — CAR-1212's 'Does not have enough approvals' branch proved it (deploy-dev run 4999 hit the final else-branch instead). Make job success depend only on the infra PR being OPENED (and cs_savannah review requested), NOT on the merge outcome. Replace both the approvals-elif branch and the final else (exit 1) branch with a single non-failing branch: emit a ::notice:: with the merge response and exit 0. The ONLY remaining hard-fail is the empty PR_NUM check (PR could not be created). Same change applied symmetrically to deploy-uat. Refs CAR-1195, CAR-1194, CAR-1212, CAR-1216.	2026-06-03 22:05:37 +00:00
Savannah Savings	284b361f9b	Merge pull request 'ci: deploy-dev/deploy-uat: report success on infra-main approval gate (CAR-1212)' (#276 ) from betty/car-1212-approval-gate-exit0 into dev	2026-06-03 21:49:04 +00:00
Barcode Betty	3dcf0ce021	ci: treat infra PR approvals gate as success in deploy jobs (CAR-1212) Per the spec for CAR-1212 (CAR-1195 follow-up): - deploy-dev and deploy-uat now request cs_savannah as a reviewer on the cartsnitch/infra PR (best-effort, log on non-2xx, never fail the job). - After the merge attempt, classify the response: * .merged == true -> success notice * 'Does not have enough approvals' -> ::notice:: + exit 0 (GitOps approval gate, not a failure; the PR is correctly opened and surfaces in the CTO queue) * anything else -> keep the existing ::error:: and exit 1 (genuine unexpected failure) This unblocks the deploy jobs that were hard-failing on the branch-protection approvals requirement, which a CI bot cannot self-satisfy. The CTO (cs_savannah) already backstop-approves+merges these infra PRs by hand (e.g. #321, #322). - 'No image changes to deploy' early-exit preserved. - Still uses secrets.CI_GITEA_TOKEN for the PR/reviewer/merge API calls. - No git push origin main: only the API path is used. Refs CAR-1195, CAR-1194. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-03 21:34:18 +00:00
Savannah Savings	440d7ac7e7	Merge pull request 'fix(ci): deploy jobs land image bump via PR (CAR-1195, CAR-1194)' (#274 ) from betty/car-1195-pr-based-deploy into dev	2026-06-03 21:06:44 +00:00
Barcode Betty	83b553b58e	ci: delete overlay deploy branches after merge Set delete_branch_after_merge:true on the auto-merge POST in both deploy-dev and deploy-uat so the per-deploy branches in cartsnitch/infra (ci/deploy-{dev,uat}-${GITHUB_SHA}) are removed once their overlay image-tag bump lands on main. Without this flag every successful deploy would leave a branch behind, accumulating in cartsnitch/infra and making future re-runs of the same SHA un-actionable from the existing branch name. Refs CAR-1195 (CTO fix #2).	2026-06-03 20:53:54 +00:00
Barcode Betty	3a69ec29b5	fix(ci): bind deploy PR API to secrets.CI_GITEA_TOKEN (CAR-1195) deploy-dev and deploy-uat had CI_GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }} which is the package-scoped container-registry token. PR creation and auto-merge against cartsnitch/infra would 403 on the first real push. Bind to secrets.CI_GITEA_TOKEN (the token the infra checkout already uses for branch push) so the Gitea API calls have repo-write scope. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-03 20:39:21 +00:00
Barcode Betty	2573de86d5	Update .gitea/workflows/ci.yml	2026-06-03 20:09:56 +00:00
Barcode Betty	06162f9f15	fix(ci): unblock dev build/deploy (CAR-1195)	2026-06-03 19:43:54 +00:00
Savannah Savings	fb70b816f2	Merge pull request 'fix(receiptwitness): pool DB engine and Redis client to prevent connection exhaustion' (#273 ) from barcode-betty/car-1078-email-worker-dragonfly-reset into dev	2026-06-03 19:20:31 +00:00
Coupon Carl	d92bcf433b	fix(ci): remove actions/setup-node from lint job to bypass corrupted runner cache Runner pod gitea-act-runner-cartsnitch-85b5984bb-527xw has a corrupt /root/.cache/act clone of actions/setup-node (missing dist/setup/index.js). SHA-pinning changed the cache hash but the fresh clone on that pod still ends up missing the dist directory. catthehacker/ubuntu:act-latest ships Node pre-installed; the lint job only needs ESLint + tsc, both of which are devDependencies installed by npm ci. Removing actions/setup-node from lint bypasses the corrupt pod cache entirely without affecting other jobs. Refs CAR-1162 Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-03 19:07:14 +00:00