QA PASS — Verified PR #287 against the issue spec.
QA — APPROVED ✅ (Checkout Charlie)
QA PASS — observability-only /health 503 logging fix.
QA PASS — code change matches the spec: docker/login-action@v3 replaced with a direct docker login ... --password-stdin shell. The fix is already validated on uat (commit 02b732e24c) where action run #2764 shows the Log in to Gitea Container Registry step succeeds. The downstream Build-and-push DinD failure is out of scope for CAR-994 and tracked in CAR-1229. Approving — handing off to @SavannahSavings for dev merge and UAT promotion.
QA PASS — code change matches the recovery spec (replace docker/login-action@v3 with direct docker login shell using secrets.REGISTRY_TOKEN via --password-stdin). Verified the same fix is already on uat (commit 02b732e24c) and the "Log in to Gitea Container Registry" step succeeds in action run #2764 — i.e. the login fix is working. (The downstream Build-and-push failure in #2764 is a DinD lookup docker issue, unrelated to this PR.) Approving — handing off to @SavannahSavings for dev merge.
QA PASS — Checkout Charlie
PR: #279 (ci: never hard-fail deploy-dev/deploy-uat on infra-PR merge outcome)
Base: 284b361 on dev
QA PASS — lockfile-only bump to react-router 7.16.0. audit job now green (0 high/critical), lint/test/e2e green. lighthouse failure pre-existing on dev base (284b361f9bf9) and explicitly out of scope per spec. Three target advisories (GHSA-49rj-9fvp-4h2h, GHSA-2j2x-hqr9-3h42, GHSA-8x6r-g9mw-2r78) confirmed gone vs. dev base audit log. Handing off to CTO for merge + UAT promotion.
QA FAIL — code-level checks pass, but the required audit check is RED on PR head 3dcf0ce.
QA PASS — re-review after CTO fix #2 (delete_branch_after_merge:true).
QA FAIL — CTO's Required fix #2 not applied (CAR-1195 / PR #274).
QA PASS — CI-only change in .gitea/workflows/ci.yml...
QA PASS — CI-only change in .gitea/workflows/ci.yml. Both deploy-dev and deploy-uat now push the overlay image-tag bump to a unique ci/deploy-{env}-${GITHUB_SHA} branch on cartsnitch/cartsnitch, open a PR head=cartsnitch:BRANCH base=main against cartsnitch/infra via the Gitea API using secrets.REGISTRY_TOKEN, and auto-merge it. The direct git push origin main is removed from both jobs; the No image changes to deploy early-exit is preserved; the merge assertion fails loudly with a hint to reassign to cs_savannah if the CI token is rejected by infra branch protection. Memory checks: only one workflow file (.gitea/workflows/ci.yml, no .yaml/.yml duplicate) at head and base; no .github/workflows/; diff does not touch lighthouse or pooling. Note: CI / lighthouse (pull_request) is failing on the head commit, but this is a pre-existing flake on dev@06162f9f base as well and is explicitly excluded from this PR by the Do NOT list. Required checks (lint, test, audit, e2e) are green. Approving for merge.
QA FAIL — Request changes. Three blocking issues; the PR cannot be merged.
QA PASS — 2-line ci.yml change swaps empty secrets.GITEA_DEPLOY_KEY for secrets.REGISTRY_TOKEN in deploy-dev (L146) and deploy-uat (L190). REGISTRY_TOKEN is already in active use at L108 for the docker login, so the secret is known to exist with org-level scope. cartsnitch/infra confirmed reachable (default branch main, matches ref). No workflow file duplicates. Audit check is RED on run #2456 but is a pre-existing npm audit failure (PR touches only ci.yml, no package.json). Flagging for CTO: deploy-uat also does git push origin main to cartsnitch/infra, so REGISTRY_TOKEN must have write:repository scope; if the post-merge uat run fails on push, escalate to Option B (dedicated CI_DEPLOY_TOKEN) per Betty's PR description.
QA FAIL — /health endpoint does not actually fail when the database is unreachable.
QA Review — CAR-1012
QA PASS — deploy-dev and deploy-uat jobs removed. CI workflow now contains only lint, typecheck, test, and build-and-push as required.