Merge pull request 'ci: push images to Harbor (repo.meghsakha.com) + cosign' (#16) from ci/harbor-repo-meghsakha into main

.gitea/workflows/ci.yaml

@@ -8,6 +8,10 @@ on:
   push:
     branches: [main]
 
+env:
+  COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
+  COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+
 jobs:
   shared:
     runs-on: docker
@@ -110,7 +114,7 @@ jobs:
   image:
     # Builds the portal image and ships it through the same path every
     # other service in orca-infra uses: push :latest + :sha-<sha> to
-    # registry.meghsakha.com, then POST a github-style payload to the
+    # repo.meghsakha.com, then POST a github-style payload to the
     # orca webhook so the master pulls and redeploys breakpilot-portal.
     #
     # Webhook target (registered once on the master via
@@ -124,15 +128,15 @@ jobs:
       - uses: actions/checkout@v4
       - uses: docker/login-action@v3
         with:
-          registry: registry.meghsakha.com
+          registry: repo.meghsakha.com
           username: ${{ secrets.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_PASS }}
       - uses: docker/build-push-action@v6
         with:
           push: true
           tags: |
-            registry.meghsakha.com/breakpilot/portal:latest
+            repo.meghsakha.com/breakpilot/portal:latest
-            registry.meghsakha.com/breakpilot/portal:sha-${{ github.sha }}
+            repo.meghsakha.com/breakpilot/portal:sha-${{ github.sha }}
       - name: trigger orca redeploy
         # Signs the POST with HMAC-SHA256 over the JSON body using the
         # secret orca generated when the webhook was registered. Orca's

src/lib/host.ts

@@ -11,7 +11,20 @@ export type HostMatch =
   | { kind: "unknown" };
 
 // Longest-first so `stage.breakpilot.com` is matched before `breakpilot.com`.
-const APEX_HOSTS = ["stage.breakpilot.com", "breakpilot.com", "localhost"];
+// Built-ins cover dev (localhost) + the canonical breakpilot.com targets.
+// PORTAL_APEX_HOSTS is a comma-separated env override for per-environment
+// hosts (e.g. portal-dev.meghsakha.com while breakpilot.com isn't registered).
+const APEX_HOSTS = (() => {
+  const base = ["stage.breakpilot.com", "breakpilot.com", "localhost"];
+  const extra = (process.env.PORTAL_APEX_HOSTS ?? "")
+    .split(",")
+    .map((h) => h.trim().toLowerCase())
+    .filter(Boolean);
+  // Longest-first to keep the suffix-strip loop correct.
+  return Array.from(new Set([...extra, ...base])).sort(
+    (a, b) => b.length - a.length,
+  );
+})();
 const APEX_SET = new Set(APEX_HOSTS);
 
 export function parseHost(host: string | null | undefined): HostMatch {