name: CI on: push: branches: [main, dev, uat] pull_request: branches: [main, dev, uat] concurrency: group: ci-${{ github.ref }} cancel-in-progress: true permissions: contents: write packages: write security-events: write env: REGISTRY: git.farh.net IMAGE_NAME: cartsnitch/cartsnitch RECEIPTWITNESS_IMAGE_NAME: cartsnitch/receiptwitness API_IMAGE_NAME: cartsnitch/api AUTH_IMAGE_NAME: cartsnitch/auth jobs: lint: runs-on: ubuntu-latest steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 - run: npm ci - name: ESLint run: npx eslint . - name: Type check run: npx tsc --noEmit test: runs-on: ubuntu-latest steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 with: node-version: "20" cache: npm - run: npm ci - name: Run tests run: npx vitest run audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 with: node-version: "20" cache: npm - run: npm ci - name: Check for vulnerabilities run: npm audit --audit-level=high e2e: runs-on: ubuntu-latest steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 with: node-version: "20" cache: npm - run: npm ci - run: npx playwright install --with-deps chromium - run: npx playwright test lighthouse: runs-on: ubuntu-latest needs: [test] steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 with: node-version: "20" cache: npm - run: npm ci - run: npm run build - name: Install Chromium for Lighthouse run: | npm install -g playwright npx playwright install --with-deps chromium - name: Start preview server run: | npm run preview & npx wait-on http://127.0.0.1:4173/ --timeout 30000 - name: Run Lighthouse CI run: | CHROME_PATH=$(find /home/runner/.cache/ms-playwright -name chrome -type f 2>/dev/null | head -1) npm install -g @lhci/cli CHROME_PATH="$CHROME_PATH" lhci autorun --chrome-flags="--headless=new --no-sandbox --disable-gpu --disable-dev-shm-usage" build-and-push: runs-on: ubuntu-latest if: github.event_name == 'push' needs: [lint, test, e2e] outputs: calver_tag: ${{ steps.calver.outputs.version }} sha_tag: sha-${{ github.sha }} steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 with: fetch-depth: 0 - name: Generate CalVer tag id: calver if: github.event_name == 'push' && github.ref == 'refs/heads/main' run: | DATE_TAG=$(date -u +%Y.%m.%d) EXISTING=$(git tag -l "v${DATE_TAG}*" | sort -V | tail -1) if [ -z "$EXISTING" ]; then VERSION="$DATE_TAG" elif [ "$EXISTING" = "v${DATE_TAG}" ]; then VERSION="${DATE_TAG}.2" else BUILD_NUM=$(echo "$EXISTING" | sed "s/v${DATE_TAG}\.//") VERSION="${DATE_TAG}.$((BUILD_NUM + 1))" fi echo "version=$VERSION" >> "$GITHUB_OUTPUT" echo "CalVer tag: $VERSION" - name: Log in to Docker Hub if: github.event_name == 'push' uses: docker/login-action@v3 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Log in to Gitea registry if: github.event_name == 'push' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.REGISTRY_TOKEN }} - name: Extract metadata id: meta uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | type=sha,prefix=sha-,format=long type=raw,value=${{ steps.calver.outputs.version }},enable=${{ github.ref == 'refs/heads/main' }} type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }} - name: Build Docker image uses: docker/build-push-action@v6 with: context: . load: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} target: prod cache-from: type=inline cache-to: type=inline,mode=max - name: Scan frontend image for vulnerabilities uses: anchore/scan-action@v5 id: scan env: GRYPE_CONFIG: .grype.yaml with: image: "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }}" fail-build: true severity-cutoff: high only-fixed: "true" output-format: sarif - name: Push Docker image if: github.event_name == 'push' uses: docker/build-push-action@v6 with: context: . push: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} target: prod cache-from: type=inline - name: Create git tag if: github.event_name == 'push' && github.ref == 'refs/heads/main' run: | git tag "v${{ steps.calver.outputs.version }}" git push origin "v${{ steps.calver.outputs.version }}" build-and-push-receiptwitness: runs-on: ubuntu-latest if: github.event_name == 'push' needs: [lint, test] outputs: calver_tag: ${{ steps.calver.outputs.version }} sha_tag: sha-${{ github.sha }} steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 with: fetch-depth: 0 - name: Generate CalVer tag id: calver if: github.event_name == 'push' && github.ref == 'refs/heads/main' run: | DATE_TAG=$(date -u +%Y.%m.%d) EXISTING=$(git tag -l "v${DATE_TAG}*" | sort -V | tail -1) if [ -z "$EXISTING" ]; then VERSION="$DATE_TAG" elif [ "$EXISTING" = "v${DATE_TAG}" ]; then VERSION="${DATE_TAG}.2" else BUILD_NUM=$(echo "$EXISTING" | sed "s/v${DATE_TAG}\.//"); VERSION="${DATE_TAG}.$((BUILD_NUM + 1))"; fi echo "version=$VERSION" >> "$GITHUB_OUTPUT" - name: Log in to Docker Hub if: github.event_name == 'push' uses: docker/login-action@v3 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Log in to Gitea registry if: github.event_name == 'push' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.REGISTRY_TOKEN }} - name: Extract metadata id: meta uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.RECEIPTWITNESS_IMAGE_NAME }} tags: | type=sha,prefix=sha-,format=long type=raw,value=${{ steps.calver.outputs.version }},enable=${{ github.ref == 'refs/heads/main' }} type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }} - name: Build Docker image uses: docker/build-push-action@v6 with: context: . file: ./receiptwitness/Dockerfile load: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} build-args: | APT_CACHE_BUST=${{ github.run_id }} cache-from: type=inline cache-to: type=inline,mode=max - name: Scan receiptwitness image for vulnerabilities uses: anchore/scan-action@v5 id: scan env: GRYPE_CONFIG: .grype.yaml with: image: "${{ env.REGISTRY }}/${{ env.RECEIPTWITNESS_IMAGE_NAME }}:sha-${{ github.sha }}" fail-build: true severity-cutoff: high only-fixed: "true" output-format: sarif - name: Push Docker image if: github.event_name == 'push' uses: docker/build-push-action@v6 with: context: . file: ./receiptwitness/Dockerfile push: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} build-args: | APT_CACHE_BUST=${{ github.run_id }} cache-from: type=inline build-and-push-api: runs-on: ubuntu-latest if: github.event_name == 'push' needs: [lint, test] outputs: calver_tag: ${{ steps.calver.outputs.version }} sha_tag: sha-${{ github.sha }} steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 with: fetch-depth: 0 - name: Generate CalVer tag id: calver if: github.event_name == 'push' && github.ref == 'refs/heads/main' run: | DATE_TAG=$(date -u +%Y.%m.%d) EXISTING=$(git tag -l "v${DATE_TAG}*" | sort -V | tail -1) if [ -z "$EXISTING" ]; then VERSION="$DATE_TAG" elif [ "$EXISTING" = "v${DATE_TAG}" ]; then VERSION="${DATE_TAG}.2" else BUILD_NUM=$(echo "$EXISTING" | sed "s/v${DATE_TAG}\.//"); VERSION="${DATE_TAG}.$((BUILD_NUM + 1))"; fi echo "version=$VERSION" >> "$GITHUB_OUTPUT" - name: Log in to Docker Hub if: github.event_name == 'push' uses: docker/login-action@v3 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Log in to Gitea registry if: github.event_name == 'push' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.REGISTRY_TOKEN }} - name: Extract metadata (API) id: meta uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.API_IMAGE_NAME }} tags: | type=sha,prefix=sha-,format=long type=raw,value=${{ steps.calver.outputs.version }},enable=${{ github.ref == 'refs/heads/main' }} type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }} - name: Build Docker image uses: docker/build-push-action@v6 with: context: ./api file: ./api/Dockerfile load: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} build-args: | APT_CACHE_BUST=${{ github.run_id }} cache-from: type=inline cache-to: type=inline,mode=max - name: Scan api image for vulnerabilities uses: anchore/scan-action@v5 id: scan env: GRYPE_CONFIG: .grype.yaml with: image: "${{ env.REGISTRY }}/${{ env.API_IMAGE_NAME }}:sha-${{ github.sha }}" fail-build: true severity-cutoff: high only-fixed: "true" output-format: sarif - name: Push Docker image if: github.event_name == 'push' uses: docker/build-push-action@v6 with: context: ./api file: ./api/Dockerfile push: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} build-args: | APT_CACHE_BUST=${{ github.run_id }} cache-from: type=inline build-and-push-auth: runs-on: ubuntu-latest if: github.event_name == 'push' needs: [lint, test] outputs: calver_tag: ${{ steps.calver.outputs.version }} sha_tag: sha-${{ github.sha }} steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 with: fetch-depth: 0 - name: Generate CalVer tag id: calver if: github.event_name == 'push' && github.ref == 'refs/heads/main' run: | DATE_TAG=$(date -u +%Y.%m.%d) EXISTING=$(git tag -l "v${DATE_TAG}*" | sort -V | tail -1) if [ -z "$EXISTING" ]; then VERSION="$DATE_TAG" elif [ "$EXISTING" = "v${DATE_TAG}" ]; then VERSION="${DATE_TAG}.2" else BUILD_NUM=$(echo "$EXISTING" | sed "s/v${DATE_TAG}\.//"); VERSION="${DATE_TAG}.$((BUILD_NUM + 1))"; fi echo "version=$VERSION" >> "$GITHUB_OUTPUT" - name: Log in to Docker Hub if: github.event_name == 'push' uses: docker/login-action@v3 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Log in to Gitea registry if: github.event_name == 'push' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.REGISTRY_TOKEN }} - name: Extract metadata (auth) id: meta uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.AUTH_IMAGE_NAME }} tags: | type=sha,prefix=sha-,format=long type=raw,value=${{ steps.calver.outputs.version }},enable=${{ github.ref == 'refs/heads/main' }} type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }} - name: Build Docker image uses: docker/build-push-action@v6 with: context: ./auth file: ./auth/Dockerfile load: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} build-args: | APT_CACHE_BUST=${{ github.run_id }} cache-from: type=inline cache-to: type=inline,mode=max - name: Scan auth image for vulnerabilities uses: anchore/scan-action@v5 id: scan env: GRYPE_CONFIG: .grype.yaml with: image: "${{ env.REGISTRY }}/${{ env.AUTH_IMAGE_NAME }}:sha-${{ github.sha }}" fail-build: true severity-cutoff: high only-fixed: "true" output-format: sarif - name: Push Docker image if: github.event_name == 'push' uses: docker/build-push-action@v6 with: context: ./auth file: ./auth/Dockerfile push: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} build-args: | APT_CACHE_BUST=${{ github.run_id }} cache-from: type=inline deploy-dev: runs-on: ubuntu-latest needs: [build-and-push, build-and-push-receiptwitness, build-and-push-api, build-and-push-auth] if: always() && !cancelled() && github.event_name == 'push' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main') steps: - name: Checkout infra repo uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 with: repository: cartsnitch/infra token: ${{ secrets.CI_GITEA_TOKEN }} ref: main path: infra - name: Install kubectl uses: azure/setup-kubectl@v4 - name: Install kustomize # imranismail/setup-kustomize@v2 calls the Gitea API to record # telemetry under the "kubernetes-sigs" user, which doesn't exist # on this Gitea instance. Install the binary directly instead. run: | set -euo pipefail version="5.4.3" url="https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${version}/kustomize_v${version}_linux_amd64.tar.gz" curl -fsSL --retry 3 "$url" | tar -xz -C /tmp kustomize sudo install -m 0755 /tmp/kustomize /usr/local/bin/kustomize kustomize version - name: Determine image tag for frontend id: frontend_tag run: | if [ "${{ github.ref }}" == "refs/heads/main" ]; then echo "tag=${{ needs.build-and-push.outputs.calver_tag }}" >> "$GITHUB_OUTPUT" else echo "tag=${{ needs.build-and-push.outputs.sha_tag }}" >> "$GITHUB_OUTPUT" fi - name: Update frontend image tag if: needs.build-and-push.result == 'success' run: | cd infra/apps/overlays/dev kustomize edit set image ghcr.io/cartsnitch/cartsnitch=git.farh.net/cartsnitch/cartsnitch:${{ steps.frontend_tag.outputs.tag }} - name: Determine image tag for receiptwitness id: receiptwitness_tag run: | if [ "${{ github.ref }}" == "refs/heads/main" ]; then echo "tag=${{ needs.build-and-push-receiptwitness.outputs.calver_tag }}" >> "$GITHUB_OUTPUT" else echo "tag=${{ needs.build-and-push-receiptwitness.outputs.sha_tag }}" >> "$GITHUB_OUTPUT" fi - name: Update receiptwitness image tag if: needs.build-and-push-receiptwitness.result == 'success' run: | cd infra/apps/overlays/dev kustomize edit set image ghcr.io/cartsnitch/receiptwitness=git.farh.net/cartsnitch/receiptwitness:${{ steps.receiptwitness_tag.outputs.tag }} - name: Determine image tag for api id: api_tag run: | if [ "${{ github.ref }}" == "refs/heads/main" ]; then echo "tag=${{ needs.build-and-push-api.outputs.calver_tag }}" >> "$GITHUB_OUTPUT" else echo "tag=${{ needs.build-and-push-api.outputs.sha_tag }}" >> "$GITHUB_OUTPUT" fi - name: Update api image tag if: needs.build-and-push-api.result == 'success' run: | cd infra/apps/overlays/dev kustomize edit set image ghcr.io/cartsnitch/api=git.farh.net/cartsnitch/api:${{ steps.api_tag.outputs.tag }} - name: Determine image tag for auth id: auth_tag run: | if [ "${{ github.ref }}" == "refs/heads/main" ]; then echo "tag=${{ needs.build-and-push-auth.outputs.calver_tag }}" >> "$GITHUB_OUTPUT" else echo "tag=${{ needs.build-and-push-auth.outputs.sha_tag }}" >> "$GITHUB_OUTPUT" fi - name: Update auth image tag if: needs.build-and-push-auth.result == 'success' run: | cd infra/apps/overlays/dev kustomize edit set image ghcr.io/cartsnitch/auth=git.farh.net/cartsnitch/auth:${{ steps.auth_tag.outputs.tag }} - name: Commit and push to infra (via PR) env: CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }} run: | cd infra git config user.name "cartsnitch-ci[bot]" git config user.email "cartsnitch-ci[bot]@users.noreply.git.farh.net" git add apps/overlays/dev/kustomization.yaml git diff --cached --quiet && echo "No image changes to deploy" && exit 0 BRANCH="ci/deploy-dev-${GITHUB_SHA}" git checkout -b "$BRANCH" git commit -m "ci(dev): update cartsnitch, receiptwitness, api, and auth images" git push origin "$BRANCH" PR_BODY=$(printf 'Auto-opened by deploy-dev (CAR-1195).\n\nBuild SHA: %s' "${GITHUB_SHA}") PR_JSON=$(curl -sS -X POST \ -H "Authorization: token ${CI_GITEA_TOKEN}" \ -H "Content-Type: application/json" \ -d "$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base main --arg title "ci(dev): update overlay image tags (${GITHUB_SHA::12})" --arg body "$PR_BODY" '{head:$head,base:$base,title:$title,body:$body}')" \ "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls") PR_NUM=$(echo "$PR_JSON" | jq -r '.number // empty') if [ -z "$PR_NUM" ]; then echo "::error::Failed to open PR against cartsnitch/infra: $PR_JSON" exit 1 fi echo "Opened cartsnitch/infra PR #${PR_NUM} (head=${BRANCH})" # Request CTO (cs_savannah) review as the GitOps hand-off. Best-effort: # log on non-2xx but never fail the job for this. REVIEW_HTTP=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \ -H "Authorization: token ${CI_GITEA_TOKEN}" \ -H "Content-Type: application/json" \ -d '{"reviewers":["cs_savannah"]}' \ "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/requested_reviewers") if [ "${REVIEW_HTTP}" -lt 200 ] || [ "${REVIEW_HTTP}" -ge 300 ]; then echo "::notice::Failed to request reviewers for cartsnitch/infra PR #${PR_NUM} (HTTP ${REVIEW_HTTP}); continuing" fi MERGE_RESP=$(curl -sS -X POST \ -H "Authorization: token ${CI_GITEA_TOKEN}" \ -H "Content-Type: application/json" \ -d '{"Do":"merge","delete_branch_after_merge":true}' \ "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/merge") MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false') if [ "$MERGED" = "true" ]; then echo "PR #${PR_NUM} merged into cartsnitch/infra main" elif echo "$MERGE_RESP" | grep -qi 'does not have enough approvals'; then # GitOps approval gate: the PR is correctly opened and surfaces in # the CTO queue via the reviewers request above. Treat as success # (exit 0) so the deploy job does not hard-fail on the approvals # requirement that only a human maintainer can satisfy. echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure" exit 0 else echo "::error::Auto-merge of cartsnitch/infra PR #${PR_NUM} failed: $MERGE_RESP" echo "::error::Reassign to cs_savannah (authorized merger for cartsnitch/infra main) for backstop merge." exit 1 fi deploy-uat: runs-on: ubuntu-latest needs: [build-and-push, build-and-push-receiptwitness, build-and-push-api, build-and-push-auth] if: always() && !cancelled() && github.event_name == 'push' && (github.ref == 'refs/heads/uat' || github.ref == 'refs/heads/main') steps: - name: Checkout infra repo uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 with: repository: cartsnitch/infra token: ${{ secrets.CI_GITEA_TOKEN }} ref: main path: infra - name: Install kubectl uses: azure/setup-kubectl@v4 - name: Install kustomize # imranismail/setup-kustomize@v2 calls the Gitea API to record # telemetry under the "kubernetes-sigs" user, which doesn't exist # on this Gitea instance. Install the binary directly instead. run: | set -euo pipefail version="5.4.3" url="https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${version}/kustomize_v${version}_linux_amd64.tar.gz" curl -fsSL --retry 3 "$url" | tar -xz -C /tmp kustomize sudo install -m 0755 /tmp/kustomize /usr/local/bin/kustomize kustomize version - name: Determine image tag for frontend id: frontend_tag run: | if [ "${{ github.ref }}" == "refs/heads/main" ]; then echo "tag=${{ needs.build-and-push.outputs.calver_tag }}" >> "$GITHUB_OUTPUT" else echo "tag=${{ needs.build-and-push.outputs.sha_tag }}" >> "$GITHUB_OUTPUT" fi - name: Update frontend image tag if: needs.build-and-push.result == 'success' run: | cd infra/apps/overlays/uat kustomize edit set image ghcr.io/cartsnitch/cartsnitch=git.farh.net/cartsnitch/cartsnitch:${{ steps.frontend_tag.outputs.tag }} - name: Determine image tag for receiptwitness id: receiptwitness_tag run: | if [ "${{ github.ref }}" == "refs/heads/main" ]; then echo "tag=${{ needs.build-and-push-receiptwitness.outputs.calver_tag }}" >> "$GITHUB_OUTPUT" else echo "tag=${{ needs.build-and-push-receiptwitness.outputs.sha_tag }}" >> "$GITHUB_OUTPUT" fi - name: Update receiptwitness image tag if: needs.build-and-push-receiptwitness.result == 'success' run: | cd infra/apps/overlays/uat kustomize edit set image ghcr.io/cartsnitch/receiptwitness=git.farh.net/cartsnitch/receiptwitness:${{ steps.receiptwitness_tag.outputs.tag }} - name: Determine image tag for api id: api_tag run: | if [ "${{ github.ref }}" == "refs/heads/main" ]; then echo "tag=${{ needs.build-and-push-api.outputs.calver_tag }}" >> "$GITHUB_OUTPUT" else echo "tag=${{ needs.build-and-push-api.outputs.sha_tag }}" >> "$GITHUB_OUTPUT" fi - name: Update api image tag if: needs.build-and-push-api.result == 'success' run: | cd infra/apps/overlays/uat kustomize edit set image ghcr.io/cartsnitch/api=git.farh.net/cartsnitch/api:${{ steps.api_tag.outputs.tag }} - name: Determine image tag for auth id: auth_tag run: | if [ "${{ github.ref }}" == "refs/heads/main" ]; then echo "tag=${{ needs.build-and-push-auth.outputs.calver_tag }}" >> "$GITHUB_OUTPUT" else echo "tag=${{ needs.build-and-push-auth.outputs.sha_tag }}" >> "$GITHUB_OUTPUT" fi - name: Update auth image tag if: needs.build-and-push-auth.result == 'success' run: | cd infra/apps/overlays/uat kustomize edit set image ghcr.io/cartsnitch/auth=git.farh.net/cartsnitch/auth:${{ steps.auth_tag.outputs.tag }} - name: Commit and push to infra (via PR) env: CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }} run: | cd infra git config user.name "cartsnitch-ci[bot]" git config user.email "cartsnitch-ci[bot]@users.noreply.git.farh.net" git add apps/overlays/uat/kustomization.yaml git diff --cached --quiet && echo "No image changes to deploy" && exit 0 BRANCH="ci/deploy-uat-${GITHUB_SHA}" git checkout -b "$BRANCH" git commit -m "ci(uat): update cartsnitch, receiptwitness, api, and auth images" git push origin "$BRANCH" PR_BODY=$(printf 'Auto-opened by deploy-uat (CAR-1195).\n\nBuild SHA: %s' "${GITHUB_SHA}") PR_JSON=$(curl -sS -X POST \ -H "Authorization: token ${CI_GITEA_TOKEN}" \ -H "Content-Type: application/json" \ -d "$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base main --arg title "ci(uat): update overlay image tags (${GITHUB_SHA::12})" --arg body "$PR_BODY" '{head:$head,base:$base,title:$title,body:$body}')" \ "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls") PR_NUM=$(echo "$PR_JSON" | jq -r '.number // empty') if [ -z "$PR_NUM" ]; then echo "::error::Failed to open PR against cartsnitch/infra: $PR_JSON" exit 1 fi echo "Opened cartsnitch/infra PR #${PR_NUM} (head=${BRANCH})" # Request CTO (cs_savannah) review as the GitOps hand-off. Best-effort: # log on non-2xx but never fail the job for this. REVIEW_HTTP=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \ -H "Authorization: token ${CI_GITEA_TOKEN}" \ -H "Content-Type: application/json" \ -d '{"reviewers":["cs_savannah"]}' \ "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/requested_reviewers") if [ "${REVIEW_HTTP}" -lt 200 ] || [ "${REVIEW_HTTP}" -ge 300 ]; then echo "::notice::Failed to request reviewers for cartsnitch/infra PR #${PR_NUM} (HTTP ${REVIEW_HTTP}); continuing" fi MERGE_RESP=$(curl -sS -X POST \ -H "Authorization: token ${CI_GITEA_TOKEN}" \ -H "Content-Type: application/json" \ -d '{"Do":"merge","delete_branch_after_merge":true}' \ "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/merge") MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false') if [ "$MERGED" = "true" ]; then echo "PR #${PR_NUM} merged into cartsnitch/infra main" elif echo "$MERGE_RESP" | grep -qi 'does not have enough approvals'; then # GitOps approval gate: the PR is correctly opened and surfaces in # the CTO queue via the reviewers request above. Treat as success # (exit 0) so the deploy job does not hard-fail on the approvals # requirement that only a human maintainer can satisfy. echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure" exit 0 else echo "::error::Auto-merge of cartsnitch/infra PR #${PR_NUM} failed: $MERGE_RESP" echo "::error::Reassign to cs_savannah (authorized merger for cartsnitch/infra main) for backstop merge." exit 1 fi