fix(ci): docker:27-cli image job; clear postcss and sharp HIGHs (#24)

.gitea/workflows/ci.yaml

@@ -115,44 +115,57 @@ jobs:
     # Builds the portal image and ships it through the same path every
     # other service in orca-infra uses: push :latest + :sha-<sha> to
     # repo.breakpilot.com, then POST a github-style payload to the
-    # orca webhook so the master pulls and redeploys breakpilot-portal.
-    #
-    # Webhook target (registered once on the master via
-    #   orca webhooks add --repo platform/portal \
-    #                     --service breakpilot-portal --branch main
-    # ) accepts unsigned payloads — orca matches on repo + branch.
+    # orca webhook so the master pulls and redeploys the portal services.
     needs: [shared, test]
     # NOTE: no hashFiles() here — at job level it evaluates BEFORE checkout
     # against an empty workspace, so the old condition was always false and
     # this job silently never ran (deployment sat on a June-10 image).
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: docker
+    # The runner's default job container has no docker CLI, so
+    # docker/login-action + docker/build-push-action die with "Unable to
+    # locate executable file: docker" (proven by tenant-registry run 5441).
+    # Same pattern as the proven breakpilot-compliance build-push-deploy.yml:
+    # run in docker:27-cli and use plain docker commands.
+    container: docker:27-cli
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/login-action@v3
-        with:
-          registry: repo.breakpilot.com
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_PASS }}
-      - uses: docker/build-push-action@v6
-        with:
-          push: true
-          tags: |
-            repo.breakpilot.com/breakpilot/portal:latest
-            repo.breakpilot.com/breakpilot/portal:sha-${{ github.sha }}
+      - name: Checkout
+        run: |
+          apk add --no-cache git curl openssl
+          git clone --depth 1 --branch ${GITHUB_REF_NAME} $(echo ${GITHUB_SERVER_URL} | sed -E "s#^(https?://)#\1ci:${{ secrets.GITHUB_TOKEN }}@#")/${GITHUB_REPOSITORY}.git .
+
+      - name: Login
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASS: ${{ secrets.REGISTRY_PASS }}
+        run: echo "$REGISTRY_PASS" | docker login repo.breakpilot.com -u "$REGISTRY_USER" --password-stdin
+
+      - name: Build + push
+        run: |
+          set -eu
+          docker build \
+            -t repo.breakpilot.com/breakpilot/portal:latest \
+            -t repo.breakpilot.com/breakpilot/portal:sha-${GITHUB_SHA} \
+            .
+          docker push repo.breakpilot.com/breakpilot/portal:latest
+          docker push repo.breakpilot.com/breakpilot/portal:sha-${GITHUB_SHA}
+
       - name: sign image (cosign)
         run: |
           { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
           chmod +x /usr/local/bin/cosign 2>/dev/null || true
           cosign sign --yes --key env://COSIGN_KEY repo.breakpilot.com/breakpilot/portal:latest || echo "::warning::cosign failed"
+
       - name: trigger orca redeploy
         # Signs the POST with HMAC-SHA256 over the JSON body using the
         # secret orca generated when the webhook was registered. Orca's
         # endpoint is publicly reachable on the master, so the signature
-        # gates who can fire a deploy.
+        # gates who can fire a deploy. Plain http like the proven
+        # compliance trigger-orca job (the endpoint does not serve TLS).
         env:
           ORCA_WEBHOOK_SECRET: ${{ secrets.ORCA_WEBHOOK_SECRET }}
         run: |
+          set -eu
           BODY='{"repository":{"full_name":"platform/portal"},"ref":"refs/heads/main"}'
           SIG="sha256=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$ORCA_WEBHOOK_SECRET" -hex | awk '{print $NF}')"
           curl -ksSf -X POST \
@@ -160,4 +173,4 @@ jobs:
             -H "X-GitHub-Event: push" \
             -H "X-Hub-Signature-256: $SIG" \
             -d "$BODY" \
-            https://46.225.100.82:6880/api/v1/webhooks/github
+            http://46.225.100.82:6880/api/v1/webhooks/github