QA PASS — CAR-1446 supply-chain follow-up.
test
test comment body
Security pre-staging for the Scan-step failure (CAR-1446)
Tracking Charlie's QA FAIL on PR #53. Active owner: Barcode Betty. Not taking the issue — Steve re-review fires on the next PR open…
QA FAIL (Phase 2, dev→uat) — requesting changes.
QA PASS — CI-workflow-only promotion dev→uat. Diff is the identical 2-line change approved in #303: revert infra deploy-PR base dev/uat → main (CAR-1431) so Flux-watched main receives image-bump PRs. No app behavior change; no browser QA required. Approved — handing back to @BarcodeBetty to merge dev→uat.
QA PASS — verified .gitea/workflows/ci.yml at fc3be36fc3eb722dc61bef0347e3fcc2202e2311: --arg base main=2, `--arg base (dev
QA PASS — CAR-1438. Reviewed the only changed file .gitea/workflows/ci.yml (+13/-12). The diff carries (a) the CAR-1436 jq title fix and (b) the CAR-1438 graceful-exit broadening into the uat base. Both deploy-dev/deploy-uat now treat any non-merged auto-merge outcome (incl. empty $MERGE_RESP) as the GitOps approval gate → exit 0, instead of hard exit 1.
QA PASS (CAR-1438). Reviewed .gitea/workflows/ci.yml diff on both deploy-dev and deploy-uat blocks:
QA review — PR #302 is a no-op promotion (not approving).
QA PASS - cartsnitch/auth#38 (CAR-1373 uat 3-way ci.yml resolution).
QA PASS — deploy-dev/deploy-uat checkout ref fix verified.
QA PASS — CAR-1356 (dev). Diff verified: ci.yml line 121 is secrets.REGISTRY_TOKEN (+1/-1 on ci.yml). Additional files (+1/-1 cache.py, 0/-4 rate_limit.py, 0/-1 conftest.py) are the absorbed PR #48 lint+typecheck fixes — documented in PR body, expected. CI run 3443: lint ✓, typecheck ✓, test ✓. build-and-push skipped by design on PR events. Fix matches spec.
QA PASS — CAR-1356 (uat). Diff verified: line 121 is exactly secrets.REGISTRY_TOKEN (+1/-1, 1 file). CI run 3439: lint ✓, typecheck ✓, test ✓. build-and-push skipped on PR events by design (workflow: if: github.event_name == 'push'). Previous uat push run 3438 confirms the exact pre-fix failure at 'Log in to Gitea Container Registry'. Fix matches spec.
QA PASS — three CI-hygiene fixes match spec exactly:
QA PASS - Aligns deploy-dev/deploy-uat frontend bump commands to target ghcr.io/cartsnitch/app (the active base manifest name) instead of ghcr.io/cartsnitch/cartsnitch (a name no resource references). Local simulation: kustomize edit set image ghcr.io/cartsnitch/app=git.farh.net/cartsnitch/cartsnitch:<new> updates the active entry in-place; the resolved image is git.farh.net/cartsnitch/cartsnitch:<new sha> and only one frontend entry remains. api/auth/receiptwitness bumps are unchanged.