fix(ci): add provenance: false to fix registry push failures

OCI attestation manifests fail to push on Gitea registry when image
layers already exist (cross-repo blob references). Disabling provenance
generation on all four build-push-action steps ensures a simple single
manifest push that Gitea handles reliably.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.gitea/workflows/ci.yml

@@ -78,6 +78,8 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+        with:
+          driver-opts: network=host
 
       - name: Log in to Gitea Container Registry
         uses: docker/login-action@v3
@@ -89,6 +91,7 @@ jobs:
       - name: Build and push API image
         uses: docker/build-push-action@v6
         with:
+          provenance: false
           context: .
           file: Dockerfile
           target: runner
@@ -102,6 +105,7 @@ jobs:
       - name: Build and push Migrate image
         uses: docker/build-push-action@v6
         with:
+          provenance: false
           context: .
           file: Dockerfile
           target: migrate
@@ -115,6 +119,7 @@ jobs:
       - name: Build and push Seed image
         uses: docker/build-push-action@v6
         with:
+          provenance: false
           context: .
           file: Dockerfile
           target: seed
@@ -128,6 +133,7 @@ jobs:
       - name: Build and push Reset image
         uses: docker/build-push-action@v6
         with:
+          provenance: false
           context: .
           file: Dockerfile
           target: reset

UAT_PLAYBOOK.md

@@ -21,6 +21,14 @@ GroomBook API is a Hono-based REST service (TypeScript/Node.js) powering the pet
 
 ## Test Cases
 
+### 4.0 Health Check
+
+| # | Scenario | Steps | Expected |
+|---|----------|-------|----------|
+| TC-API-0.1 | Unauthenticated health check | GET /api/health | 200 OK, `{"status":"ok"}` |
+
+> **Note (GRO-1544):** Health endpoint registered on `api` basePath before auth middleware at `/api/health`. The old path `/health` was incorrect (routed to web pod via HTTPRoute `/*` rule).
+
 ### 4.1 Authentication
 
 | # | Scenario | Steps | Expected |

src/index.ts

@@ -58,8 +58,8 @@ app.use(
   })
 );
 
-// Health check (no auth required)
-app.get("/health", (c) => c.json({ status: "ok" }));
+// Health check — no auth required, registered on app at full path before auth middleware
+app.get("/api/health", (c) => c.json({ status: "ok" }));
 
 // Public booking routes — no auth required, must be registered before auth middleware
 app.route("/api/book", bookRouter);

src/middleware/auth.ts

@@ -23,7 +23,7 @@ if (process.env.AUTH_DISABLED === "true") {
 }
 
 export const authMiddleware: MiddlewareHandler = async (c, next) => {
-  if (c.req.path.startsWith("/api/auth/")) {
+  if (c.req.path.startsWith("/api/auth/") || c.req.path === "/api/health") {
     await next();
     return;
   }