Merge pull request 'Promote to Production: CAR-1215 react-router audit-gate fix' (#282 ) from uat into main

Promote to Production: CAR-1215 react-router audit-gate fix UAT PASS: Deal Dottie — all 5 regression steps green Security PASS: Stockboy Steve — lockfile-only, 3 high advisories cleared ref: CAR-1215, CAR-1217
Promote to UAT: CAR-1215 react-router audit-gate fix (#280 )
2026-06-04 01:53:08 +00:00 · 2026-06-03 22:14:58 +00:00 · 2026-06-03 22:14:12 +00:00 · 2026-06-03 21:56:05 +00:00 · 2026-06-03 21:49:34 +00:00 · 2026-06-03 21:49:04 +00:00
2 changed files with 137 additions and 33 deletions
@@ -27,10 +27,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
-        with:
-          node-version: "20"
-          cache: npm
      - run: npm ci
      - name: ESLint
        run: npx eslint .
@@ -160,8 +156,8 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          target: prod
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=inline
+          cache-to: type=inline,mode=max

      - name: Scan frontend image for vulnerabilities
        uses: anchore/scan-action@v5
@@ -186,7 +182,7 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          target: prod
-          cache-from: type=gha
+          cache-from: type=inline

      - name: Create git tag
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
@@ -252,8 +248,8 @@ jobs:
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=inline
+          cache-to: type=inline,mode=max

      - name: Scan receiptwitness image for vulnerabilities
        uses: anchore/scan-action@v5
@@ -280,7 +276,7 @@ jobs:
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
+          cache-from: type=inline

  build-and-push-api:
    runs-on: ubuntu-latest
@@ -340,8 +336,8 @@ jobs:
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=inline
+          cache-to: type=inline,mode=max

      - name: Scan api image for vulnerabilities
        uses: anchore/scan-action@v5
@@ -368,7 +364,7 @@ jobs:
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
+          cache-from: type=inline

  build-and-push-auth:
    runs-on: ubuntu-latest
@@ -428,8 +424,8 @@ jobs:
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=inline
+          cache-to: type=inline,mode=max

      - name: Scan auth image for vulnerabilities
        uses: anchore/scan-action@v5
@@ -456,7 +452,7 @@ jobs:
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
+          cache-from: type=inline

  deploy-dev:
    runs-on: ubuntu-latest
@@ -467,7 +463,7 @@ jobs:
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          repository: cartsnitch/infra
-          token: ${{ secrets.REGISTRY_TOKEN }}
+          token: ${{ secrets.CI_GITEA_TOKEN }}
          ref: main
          path: infra

@@ -475,7 +471,16 @@ jobs:
        uses: azure/setup-kubectl@v4

      - name: Install kustomize
-        uses: imranismail/setup-kustomize@v2
+        # imranismail/setup-kustomize@v2 calls the Gitea API to record
+        # telemetry under the "kubernetes-sigs" user, which doesn't exist
+        # on this Gitea instance. Install the binary directly instead.
+        run: |
+          set -euo pipefail
+          version="5.4.3"
+          url="https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${version}/kustomize_v${version}_linux_amd64.tar.gz"
+          curl -fsSL --retry 3 "$url" | tar -xz -C /tmp kustomize
+          sudo install -m 0755 /tmp/kustomize /usr/local/bin/kustomize
+          kustomize version

      - name: Determine image tag for frontend
        id: frontend_tag
@@ -537,16 +542,61 @@ jobs:
          cd infra/apps/overlays/dev
          kustomize edit set image ghcr.io/cartsnitch/auth=git.farh.net/cartsnitch/auth:${{ steps.auth_tag.outputs.tag }}

-      - name: Commit and push to infra
+      - name: Commit and push to infra (via PR)
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
        run: |
          cd infra
          git config user.name "cartsnitch-ci[bot]"
          git config user.email "cartsnitch-ci[bot]@users.noreply.git.farh.net"
          git add apps/overlays/dev/kustomization.yaml
          git diff --cached --quiet && echo "No image changes to deploy" && exit 0
+          BRANCH="ci/deploy-dev-${GITHUB_SHA}"
+          git checkout -b "$BRANCH"
          git commit -m "ci(dev): update cartsnitch, receiptwitness, api, and auth images"
-          git pull --rebase origin main
-          git push origin main
+          git push origin "$BRANCH"
+          PR_BODY=$(printf 'Auto-opened by deploy-dev (CAR-1195).\n\nBuild SHA: %s' "${GITHUB_SHA}")
+          PR_JSON=$(curl -sS -X POST \
+            -H "Authorization: token ${CI_GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base main --arg title "ci(dev): update overlay image tags (${GITHUB_SHA::12})" --arg body "$PR_BODY" '{head:$head,base:$base,title:$title,body:$body}')" \
+            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls")
+          PR_NUM=$(echo "$PR_JSON" | jq -r '.number // empty')
+          if [ -z "$PR_NUM" ]; then
+            echo "::error::Failed to open PR against cartsnitch/infra: $PR_JSON"
+            exit 1
+          fi
+          echo "Opened cartsnitch/infra PR #${PR_NUM} (head=${BRANCH})"
+          # Request CTO (cs_savannah) review as the GitOps hand-off. Best-effort:
+          # log on non-2xx but never fail the job for this.
+          REVIEW_HTTP=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
+            -H "Authorization: token ${CI_GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"reviewers":["cs_savannah"]}' \
+            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/requested_reviewers")
+          if [ "${REVIEW_HTTP}" -lt 200 ] || [ "${REVIEW_HTTP}" -ge 300 ]; then
+            echo "::notice::Failed to request reviewers for cartsnitch/infra PR #${PR_NUM} (HTTP ${REVIEW_HTTP}); continuing"
+          fi
+          MERGE_RESP=$(curl -sS -X POST \
+            -H "Authorization: token ${CI_GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"Do":"merge","delete_branch_after_merge":true}' \
+            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/merge")
+          MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false')
+          if [ "$MERGED" = "true" ]; then
+            echo "PR #${PR_NUM} merged into cartsnitch/infra main"
+          elif echo "$MERGE_RESP" | grep -qi 'does not have enough approvals'; then
+            # GitOps approval gate: the PR is correctly opened and surfaces in
+            # the CTO queue via the reviewers request above. Treat as success
+            # (exit 0) so the deploy job does not hard-fail on the approvals
+            # requirement that only a human maintainer can satisfy.
+            echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure"
+            exit 0
+          else
+            echo "::error::Auto-merge of cartsnitch/infra PR #${PR_NUM} failed: $MERGE_RESP"
+            echo "::error::Reassign to cs_savannah (authorized merger for cartsnitch/infra main) for backstop merge."
+            exit 1
+          fi

  deploy-uat:
    runs-on: ubuntu-latest
@@ -557,7 +607,7 @@ jobs:
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          repository: cartsnitch/infra
-          token: ${{ secrets.REGISTRY_TOKEN }}
+          token: ${{ secrets.CI_GITEA_TOKEN }}
          ref: main
          path: infra

@@ -565,7 +615,16 @@ jobs:
        uses: azure/setup-kubectl@v4

      - name: Install kustomize
-        uses: imranismail/setup-kustomize@v2
+        # imranismail/setup-kustomize@v2 calls the Gitea API to record
+        # telemetry under the "kubernetes-sigs" user, which doesn't exist
+        # on this Gitea instance. Install the binary directly instead.
+        run: |
+          set -euo pipefail
+          version="5.4.3"
+          url="https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${version}/kustomize_v${version}_linux_amd64.tar.gz"
+          curl -fsSL --retry 3 "$url" | tar -xz -C /tmp kustomize
+          sudo install -m 0755 /tmp/kustomize /usr/local/bin/kustomize
+          kustomize version

      - name: Determine image tag for frontend
        id: frontend_tag
@@ -627,13 +686,58 @@ jobs:
          cd infra/apps/overlays/uat
          kustomize edit set image ghcr.io/cartsnitch/auth=git.farh.net/cartsnitch/auth:${{ steps.auth_tag.outputs.tag }}

-      - name: Commit and push to infra
+      - name: Commit and push to infra (via PR)
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
        run: |
          cd infra
          git config user.name "cartsnitch-ci[bot]"
          git config user.email "cartsnitch-ci[bot]@users.noreply.git.farh.net"
          git add apps/overlays/uat/kustomization.yaml
          git diff --cached --quiet && echo "No image changes to deploy" && exit 0
+          BRANCH="ci/deploy-uat-${GITHUB_SHA}"
+          git checkout -b "$BRANCH"
          git commit -m "ci(uat): update cartsnitch, receiptwitness, api, and auth images"
-          git pull --rebase origin main
-          git push origin main
+          git push origin "$BRANCH"
+          PR_BODY=$(printf 'Auto-opened by deploy-uat (CAR-1195).\n\nBuild SHA: %s' "${GITHUB_SHA}")
+          PR_JSON=$(curl -sS -X POST \
+            -H "Authorization: token ${CI_GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base main --arg title "ci(uat): update overlay image tags (${GITHUB_SHA::12})" --arg body "$PR_BODY" '{head:$head,base:$base,title:$title,body:$body}')" \
+            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls")
+          PR_NUM=$(echo "$PR_JSON" | jq -r '.number // empty')
+          if [ -z "$PR_NUM" ]; then
+            echo "::error::Failed to open PR against cartsnitch/infra: $PR_JSON"
+            exit 1
+          fi
+          echo "Opened cartsnitch/infra PR #${PR_NUM} (head=${BRANCH})"
+          # Request CTO (cs_savannah) review as the GitOps hand-off. Best-effort:
+          # log on non-2xx but never fail the job for this.
+          REVIEW_HTTP=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
+            -H "Authorization: token ${CI_GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"reviewers":["cs_savannah"]}' \
+            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/requested_reviewers")
+          if [ "${REVIEW_HTTP}" -lt 200 ] || [ "${REVIEW_HTTP}" -ge 300 ]; then
+            echo "::notice::Failed to request reviewers for cartsnitch/infra PR #${PR_NUM} (HTTP ${REVIEW_HTTP}); continuing"
+          fi
+          MERGE_RESP=$(curl -sS -X POST \
+            -H "Authorization: token ${CI_GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"Do":"merge","delete_branch_after_merge":true}' \
+            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/merge")
+          MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false')
+          if [ "$MERGED" = "true" ]; then
+            echo "PR #${PR_NUM} merged into cartsnitch/infra main"
+          elif echo "$MERGE_RESP" | grep -qi 'does not have enough approvals'; then
+            # GitOps approval gate: the PR is correctly opened and surfaces in
+            # the CTO queue via the reviewers request above. Treat as success
+            # (exit 0) so the deploy job does not hard-fail on the approvals
+            # requirement that only a human maintainer can satisfy.
+            echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure"
+            exit 0
+          else
+            echo "::error::Auto-merge of cartsnitch/infra PR #${PR_NUM} failed: $MERGE_RESP"
+            echo "::error::Reassign to cs_savannah (authorized merger for cartsnitch/infra main) for backstop merge."
+            exit 1
+          fi
@@ -8305,9 +8305,9 @@
      }
    },
    "node_modules/react-router": {
-      "version": "7.14.0",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.14.0.tgz",
-      "integrity": "sha512-m/xR9N4LQLmAS0ZhkY2nkPA1N7gQ5TUVa5n8TgANuDTARbn1gt+zLPXEm7W0XDTbrQ2AJSJKhoa6yx1D8BcpxQ==",
+      "version": "7.16.0",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.16.0.tgz",
+      "integrity": "sha512-wArC8lVyJb3+jM9OpDyW6hLCizACWkvQR/sSGqSs+o5uEXEtGlqdZ4v8hENR3Jad6i+LRkK93q/+bQAcvl6V1A==",
      "license": "MIT",
      "dependencies": {
        "cookie": "^1.0.1",
@@ -8327,12 +8327,12 @@
      }
    },
    "node_modules/react-router-dom": {
-      "version": "7.14.0",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.14.0.tgz",
-      "integrity": "sha512-2G3ajSVSZMEtmTjIklRWlNvo8wICEpLihfD/0YMDxbWK2UyP5EGfnoIn9AIQGnF3G/FX0MRbHXdFcD+rL1ZreQ==",
+      "version": "7.16.0",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.16.0.tgz",
+      "integrity": "sha512-kMUAbimWB5FVbF4Bce4bJsiKJWLIUHq/mEG8+CFDnCSgltptBiG5nguducmsJeGKytlCvQud9Qhzpn49iduTlA==",
      "license": "MIT",
      "dependencies": {
-        "react-router": "7.14.0"
+        "react-router": "7.16.0"
      },
      "engines": {
        "node": ">=20.0.0"
Author	SHA1	Message	Date
Coupon Carl	a0088acb1a	Merge pull request 'Promote to Production: CAR-1215 react-router audit-gate fix' (#282 ) from uat into main Promote to Production: CAR-1215 react-router audit-gate fix UAT PASS: Deal Dottie — all 5 regression steps green Security PASS: Stockboy Steve — lockfile-only, 3 high advisories cleared ref: CAR-1215, CAR-1217	2026-06-04 01:53:08 +00:00
Savannah Savings	eff1098289	Promote to UAT: CAR-1215 react-router audit-gate fix (#280 ) Promotes CAR-1215 to uat. audit gate green; lighthouse pre-existing red (tracked separately).	2026-06-03 22:14:58 +00:00
Savannah Savings	8eeaa92ad8	CAR-1215: bump react-router to 7.16.0 (clear audit gate) (#278 ) Lockfile-only bump react-router/react-router-dom 7.14.0->7.16.0 clearing GHSA-49rj-9fvp-4h2h, GHSA-2j2x-hqr9-3h42, GHSA-8x6r-g9mw-2r78. QA PASS (cs_charlie), security PASS (cs_steve). audit gate now green; lighthouse pre-existing red (out of scope, tracked separately).	2026-06-03 22:14:12 +00:00
Barcode Betty	fc3a0b4d92	chore(deps): bump react-router + react-router-dom to 7.16.0 (CAR-1215) Lockfile-only bump from 7.14.0 -> 7.16.0. The ^7.0.0 range in package.json already permits 7.16.0, so no source changes. Clears three high-severity advisories that block the audit CI gate: - GHSA-49rj-9fvp-4h2h (turbo-stream arbitrary constructor invocation) - GHSA-2j2x-hqr9-3h42 (protocol-relative URL open redirect) - GHSA-8x6r-g9mw-2r78 (DoS via unbounded path expansion) No runtime behavior change; react-router stays on 7.x. npm audit --audit-level=high exits clean (0 high/critical) locally. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-03 21:56:05 +00:00
Savannah Savings	009aa92777	Merge pull request 'Promote to UAT: deploy-dev/deploy-uat approval-gate success (CAR-1212)' (#277 ) from dev into uat	2026-06-03 21:49:34 +00:00
Savannah Savings	284b361f9b	Merge pull request 'ci: deploy-dev/deploy-uat: report success on infra-main approval gate (CAR-1212)' (#276 ) from betty/car-1212-approval-gate-exit0 into dev	2026-06-03 21:49:04 +00:00
Barcode Betty	3dcf0ce021	ci: treat infra PR approvals gate as success in deploy jobs (CAR-1212) Per the spec for CAR-1212 (CAR-1195 follow-up): - deploy-dev and deploy-uat now request cs_savannah as a reviewer on the cartsnitch/infra PR (best-effort, log on non-2xx, never fail the job). - After the merge attempt, classify the response: * .merged == true -> success notice * 'Does not have enough approvals' -> ::notice:: + exit 0 (GitOps approval gate, not a failure; the PR is correctly opened and surfaces in the CTO queue) * anything else -> keep the existing ::error:: and exit 1 (genuine unexpected failure) This unblocks the deploy jobs that were hard-failing on the branch-protection approvals requirement, which a CI bot cannot self-satisfy. The CTO (cs_savannah) already backstop-approves+merges these infra PRs by hand (e.g. #321, #322). - 'No image changes to deploy' early-exit preserved. - Still uses secrets.CI_GITEA_TOKEN for the PR/reviewer/merge API calls. - No git push origin main: only the API path is used. Refs CAR-1195, CAR-1194. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-03 21:34:18 +00:00
Savannah Savings	b3a452be50	Merge pull request 'promote(dev→uat): CI deploy PR-based image bump (CAR-1195, CAR-1194)' (#275 ) from dev into uat	2026-06-03 21:13:44 +00:00
Savannah Savings	440d7ac7e7	Merge pull request 'fix(ci): deploy jobs land image bump via PR (CAR-1195, CAR-1194)' (#274 ) from betty/car-1195-pr-based-deploy into dev	2026-06-03 21:06:44 +00:00
Barcode Betty	83b553b58e	ci: delete overlay deploy branches after merge Set delete_branch_after_merge:true on the auto-merge POST in both deploy-dev and deploy-uat so the per-deploy branches in cartsnitch/infra (ci/deploy-{dev,uat}-${GITHUB_SHA}) are removed once their overlay image-tag bump lands on main. Without this flag every successful deploy would leave a branch behind, accumulating in cartsnitch/infra and making future re-runs of the same SHA un-actionable from the existing branch name. Refs CAR-1195 (CTO fix #2).	2026-06-03 20:53:54 +00:00
Barcode Betty	3a69ec29b5	fix(ci): bind deploy PR API to secrets.CI_GITEA_TOKEN (CAR-1195) deploy-dev and deploy-uat had CI_GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }} which is the package-scoped container-registry token. PR creation and auto-merge against cartsnitch/infra would 403 on the first real push. Bind to secrets.CI_GITEA_TOKEN (the token the infra checkout already uses for branch push) so the Gitea API calls have repo-write scope. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-03 20:39:21 +00:00
Barcode Betty	2573de86d5	Update .gitea/workflows/ci.yml	2026-06-03 20:09:56 +00:00
Barcode Betty	06162f9f15	fix(ci): unblock dev build/deploy (CAR-1195)	2026-06-03 19:43:54 +00:00
Savannah Savings	fb70b816f2	Merge pull request 'fix(receiptwitness): pool DB engine and Redis client to prevent connection exhaustion' (#273 ) from barcode-betty/car-1078-email-worker-dragonfly-reset into dev	2026-06-03 19:20:31 +00:00
Coupon Carl	d92bcf433b	fix(ci): remove actions/setup-node from lint job to bypass corrupted runner cache Runner pod gitea-act-runner-cartsnitch-85b5984bb-527xw has a corrupt /root/.cache/act clone of actions/setup-node (missing dist/setup/index.js). SHA-pinning changed the cache hash but the fresh clone on that pod still ends up missing the dist directory. catthehacker/ubuntu:act-latest ships Node pre-installed; the lint job only needs ESLint + tsc, both of which are devDependencies installed by npm ci. Removing actions/setup-node from lint bypasses the corrupt pod cache entirely without affecting other jobs. Refs CAR-1162 Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-03 19:07:14 +00:00
Coupon Carl	80786b9f1f	fix(ci): use CI_GITEA_TOKEN for cross-repo checkout Update deploy-dev and deploy-uat jobs to use CI_GITEA_TOKEN for checking out the cartsnitch/infra repository instead of REGISTRY_TOKEN. CI_GITEA_TOKEN is the org-level Actions secret configured for cross-repo access, while REGISTRY_TOKEN continues to be used for Docker registry login. This resolves CAR-986 by enabling CI to commit image tag updates to the private infra repository. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-25 22:47:40 +00:00