fix(GRO-1576): add provenance: false to all build-push-action steps

Docker Buildx v6 defaults to OCI attestation manifests (--attest
type=provenance,mode=max). These hit a Gitea registry bug when image
layers are pre-existing (blob mount), causing "unknown" errors on manifest
list push. API image succeeds because it pushes new layers; migrate/seed/
reset fail because their layers already exist.

Disabling provenance attestation on all four build-push-action steps
resolves the push failures. Addresses GRO-1575.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.gitea/workflows/ci.yml

@@ -93,6 +93,7 @@ jobs:
           file: Dockerfile
           target: runner
           push: true
+          provenance: false
           tags: |
             git.farh.net/groombook/api:${{ steps.version.outputs.tag }}
             ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/api:latest' || '' }}
@@ -106,6 +107,7 @@ jobs:
           file: Dockerfile
           target: migrate
           push: true
+          provenance: false
           tags: |
             git.farh.net/groombook/migrate:${{ steps.version.outputs.tag }}
             ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/migrate:latest' || '' }}
@@ -119,6 +121,7 @@ jobs:
           file: Dockerfile
           target: seed
           push: true
+          provenance: false
           tags: |
             git.farh.net/groombook/seed:${{ steps.version.outputs.tag }}
             ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/seed:latest' || '' }}
@@ -132,6 +135,7 @@ jobs:
           file: Dockerfile
           target: reset
           push: true
+          provenance: false
           tags: |
             git.farh.net/groombook/reset:${{ steps.version.outputs.tag }}
             ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/reset:latest' || '' }}

UAT_PLAYBOOK.md

@@ -21,14 +21,6 @@ GroomBook API is a Hono-based REST service (TypeScript/Node.js) powering the pet
 
 ## Test Cases
 
-### 4.0 Health Check
-
-| # | Scenario | Steps | Expected |
-|---|----------|-------|----------|
-| TC-API-0.1 | Unauthenticated health check | GET /api/health | 200 OK, `{"status":"ok"}` |
-
-> **Note (GRO-1544):** Health endpoint registered on `api` basePath before auth middleware at `/api/health`. The old path `/health` was incorrect (routed to web pod via HTTPRoute `/*` rule).
-
 ### 4.1 Authentication
 
 | # | Scenario | Steps | Expected |

packages/db/migrations/0031_buffer_rules.sql

@@ -6,10 +6,8 @@
 CREATE TYPE "pet_size_category" AS ENUM ('small', 'medium', 'large', 'xlarge');
 CREATE TYPE "coat_type" AS ENUM ('smooth', 'double', 'wire', 'curly', 'long', 'hairless');
 
--- ─── Add columns to pets if missing, then cast to enums ──────────────────────
+-- ─── Alter pets columns to use new enums ─────────────────────────────────────
 
-ALTER TABLE "pets" ADD COLUMN IF NOT EXISTS "coat_type" text;
-ALTER TABLE "pets" ADD COLUMN IF NOT EXISTS "pet_size_category" text;
 ALTER TABLE "pets" ALTER COLUMN "coat_type" TYPE "coat_type" USING "coat_type"::text::"coat_type";
 ALTER TABLE "pets" ALTER COLUMN "pet_size_category" TYPE "pet_size_category" USING "pet_size_category"::text::"pet_size_category";
 

packages/db/migrations/0032_staff_read_at.sql

@@ -1 +0,0 @@
--- no-op: journal entry exists but no schema change was needed

packages/db/migrations/0033_add_services_default_buffer_minutes.sql

@@ -1,6 +0,0 @@
--- Migration: 0033_add_services_default_buffer_minutes.sql
--- Adds missing default_buffer_minutes column to services table.
--- 0031_buffer_rules was applied to the DB but its journal entry was missing,
--- so this ensures idempotent column addition for fresh DB restores.
-
-ALTER TABLE "services" ADD COLUMN IF NOT EXISTS "default_buffer_minutes" integer DEFAULT 0 NOT NULL;

packages/db/migrations/meta/0033_snapshot.json

@@ -1,103 +0,0 @@
-{
-  "id": "0033_add_services_default_buffer_minutes",
-  "version": "7",
-  "dialect": "postgresql",
-  "tables": {
-    "authProviderConfig": {
-      "name": "auth_provider_config",
-      "columns": {
-        "id": { "name": "id", "type": "uuid", "primaryKey": true, "default": "gen_random_uuid()", "isNullable": false },
-        "providerId": { "name": "provider_id", "type": "text", "isNullable": false },
-        "displayName": { "name": "display_name", "type": "text", "isNullable": false },
-        "issuerUrl": { "name": "issuer_url", "type": "text", "isNullable": false },
-        "internalBaseUrl": { "name": "internal_base_url", "type": "text", "isNullable": true },
-        "clientId": { "name": "client_id", "type": "text", "isNullable": false },
-        "clientSecret": { "name": "client_secret", "type": "text", "isNullable": false },
-        "scopes": { "name": "scopes", "type": "text", "isNullable": false, "default": "'openid profile email'" },
-        "enabled": { "name": "enabled", "type": "boolean", "isNullable": false, "default": "true" },
-        "createdAt": { "name": "created_at", "type": "timestamp", "isNullable": false, "default": "now()" },
-        "updatedAt": { "name": "updated_at", "type": "timestamp", "isNullable": false, "default": "now()" }
-      },
-      "indexes": {},
-      "foreignKeys": {},
-      "compositePrimaryKeys": {}
-    },
-    "businessSettings": {
-      "name": "business_settings",
-      "columns": {
-        "id": { "name": "id", "type": "uuid", "primaryKey": true, "default": "gen_random_uuid()", "isNullable": false },
-        "businessName": { "name": "business_name", "type": "text", "isNullable": false, "default": "'GroomBook'" },
-        "logoBase64": { "name": "logo_base64", "type": "text", "isNullable": true },
-        "logoMimeType": { "name": "logo_mime_type", "type": "text", "isNullable": true },
-        "logoKey": { "name": "logo_key", "type": "text", "isNullable": true },
-        "primaryColor": { "name": "primary_color", "type": "text", "isNullable": false, "default": "'#4f8a6f'" },
-        "accentColor": { "name": "accent_color", "type": "text", "isNullable": false, "default": "'#8b7355'" },
-        "createdAt": { "name": "created_at", "type": "timestamp", "isNullable": false, "default": "now()" },
-        "updatedAt": { "name": "updated_at", "type": "timestamp", "isNullable": false, "default": "now()" }
-      },
-      "indexes": {},
-      "foreignKeys": {},
-      "compositePrimaryKeys": {}
-    },
-    "clients": {
-      "name": "clients",
-      "columns": {
-        "id": { "name": "id", "type": "uuid", "primaryKey": true, "default": "gen_random_uuid()", "isNullable": false },
-        "name": { "name": "name", "type": "text", "isNullable": false },
-        "email": { "name": "email", "type": "text", "isNullable": true },
-        "phone": { "name": "phone", "type": "text", "isNullable": true },
-        "address": { "name": "address", "type": "text", "isNullable": true },
-        "notes": { "name": "notes", "type": "text", "isNullable": true },
-        "emailOptOut": { "name": "email_opt_out", "type": "boolean", "isNullable": false, "default": "false" },
-        "smsOptIn": { "name": "sms_opt_in", "type": "boolean", "isNullable": false, "default": "false" },
-        "smsConsentDate": { "name": "sms_consent_date", "type": "timestamp", "isNullable": true },
-        "smsOptOutDate": { "name": "sms_opt_out_date", "type": "timestamp", "isNullable": true },
-        "smsConsentText": { "name": "sms_consent_text", "type": "text", "isNullable": true },
-        "stripeCustomerId": { "name": "stripe_customer_id", "type": "text", "isNullable": true },
-        "status": { "name": "status", "type": "client_status", "isNullable": false, "default": "'active'" },
-        "disabledAt": { "name": "disabled_at", "type": "timestamp", "isNullable": true },
-        "createdAt": { "name": "created_at", "type": "timestamp", "isNullable": false, "default": "now()" },
-        "updatedAt": { "name": "updated_at", "type": "timestamp", "isNullable": false, "default": "now()" }
-      },
-      "indexes": {},
-      "foreignKeys": {},
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": { "idx_clients_stripe_customer_id": { "columns": ["stripe_customer_id"] } }
-    },
-    "invoices": {
-      "name": "invoices",
-      "columns": {
-        "id": { "name": "id", "type": "uuid", "primaryKey": true, "default": "gen_random_uuid()", "isNullable": false },
-        "appointmentId": { "name": "appointment_id", "type": "uuid", "isNullable": true },
-        "clientId": { "name": "client_id", "type": "uuid", "isNullable": false },
-        "subtotalCents": { "name": "subtotal_cents", "type": "integer", "isNullable": false },
-        "taxCents": { "name": "tax_cents", "type": "integer", "isNullable": false, "default": "0" },
-        "tipCents": { "name": "tip_cents", "type": "integer", "isNullable": false, "default": "0" },
-        "totalCents": { "name": "total_cents", "type": "integer", "isNullable": false },
-        "status": { "name": "status", "type": "invoice_status", "isNullable": false, "default": "'draft'" },
-        "paymentMethod": { "name": "payment_method", "type": "payment_method", "isNullable": true },
-        "paidAt": { "name": "paid_at", "type": "timestamp", "isNullable": true },
-        "stripePaymentIntentId": { "name": "stripe_payment_intent_id", "type": "text", "isNullable": true },
-        "stripeRefundId": { "name": "stripe_refund_id", "type": "text", "isNullable": true },
-        "paymentFailureReason": { "name": "payment_failure_reason", "type": "text", "isNullable": true },
-        "notes": { "name": "notes", "type": "text", "isNullable": true },
-        "createdAt": { "name": "created_at", "type": "timestamp", "isNullable": false, "default": "now()" },
-        "updatedAt": { "name": "updated_at", "type": "timestamp", "isNullable": false, "default": "now()" }
-      },
-      "indexes": { "idx_invoices_client_id": { "columns": ["client_id"] }, "idx_invoices_status": { "columns": ["status"] }, "idx_invoices_created_at": { "columns": ["created_at"] } },
-      "foreignKeys": { "invoices_appointment_id_fkey": { "columns": ["appointmentId"], "reference": { "table": "appointments", "columns": ["id"] } }, "invoices_client_id_fkey": { "columns": ["clientId"], "reference": { "table": "clients", "columns": ["id"] } } },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": { "idx_invoices_stripe_payment_intent_id": { "columns": ["stripe_payment_intent_id"] } }
-    }
-  },
-  "enums": {
-    "appointment_status": { "name": "appointment_status", "values": ["scheduled", "confirmed", "in_progress", "completed", "cancelled", "no_show"] },
-    "client_status": { "name": "client_status", "values": ["active", "disabled"] },
-    "impersonation_session_status": { "name": "impersonation_session_status", "values": ["active", "ended", "expired"] },
-    "invoice_status": { "name": "invoice_status", "values": ["draft", "pending", "paid", "void"] },
-    "payment_method": { "name": "payment_method", "values": ["cash", "card", "check", "other"] },
-    "staff_role": { "name": "staff_role", "values": ["groomer", "receptionist", "manager"] },
-    "waitlist_status": { "name": "waitlist_status", "values": ["active", "notified", "expired", "cancelled"] }
-  },
-  "nativeEnums": {}
-}

packages/db/migrations/meta/_journal.json

@@ -218,27 +218,6 @@
       "when": 1775828067192,
       "tag": "0030_messaging",
       "breakpoints": true
-    },
-    {
-      "idx": 31,
-      "version": "7",
-      "when": 1775860800000,
-      "tag": "0031_buffer_rules",
-      "breakpoints": true
-    },
-    {
-      "idx": 32,
-      "version": "7",
-      "when": 1775894400000,
-      "tag": "0032_staff_read_at",
-      "breakpoints": true
-    },
-    {
-      "idx": 33,
-      "version": "7",
-      "when": 1779500000000,
-      "tag": "0033_add_services_default_buffer_minutes",
-      "breakpoints": true
     }
   ]
 }

packages/db/src/index.ts

@@ -12,7 +12,7 @@ export function getDb() {
   if (_db) return _db;
   const url = process.env.DATABASE_URL;
   if (!url) throw new Error("DATABASE_URL is not set");
-  const client = postgres(url, { max: 10, connect_timeout: 5 });
+  const client = postgres(url, { max: 10 });
   _db = drizzle(client, { schema });
   return _db;
 }

src/index.ts

@@ -58,8 +58,8 @@ app.use(
   })
 );
 
-// Health check — no auth required, registered on app at full path before auth middleware
-app.get("/api/health", (c) => c.json({ status: "ok" }));
+// Health check (no auth required)
+app.get("/health", (c) => c.json({ status: "ok" }));
 
 // Public booking routes — no auth required, must be registered before auth middleware
 app.route("/api/book", bookRouter);
@@ -282,16 +282,14 @@ startReminderScheduler();
 
 function shutdown() {
   console.log("Shutting down gracefully...");
-  // SIGTERM/SIGINT → server.close() → callback → process.exit(0)
-  // If graceful close takes >8s, force-exit to avoid being killed undrained
-  setTimeout(() => {
-    console.error("Graceful close timeout — forcing exit");
-    process.exit(1);
-  }, 8_000);
   server.close(() => {
     console.log("HTTP server closed");
     process.exit(0);
   });
+  setTimeout(() => {
+    console.error("Forced shutdown after timeout");
+    process.exit(1);
+  }, 10_000);
 }
 
 process.on("SIGTERM", shutdown);

src/lib/auth.ts

@@ -186,9 +186,7 @@ export async function initAuth(): Promise<void> {
     const discoveryUrlStr = `${providerConfig.issuerUrl}/.well-known/openid-configuration`;
     let oidcConfig: Record<string, string> = {};
     try {
-      const discoveryRes = await fetch(discoveryUrlStr, {
-        signal: AbortSignal.timeout(5000),
-      });
+      const discoveryRes = await fetch(discoveryUrlStr);
       if (discoveryRes.ok) {
         const discovery = await discoveryRes.json() as {
           authorization_endpoint?: string;