build: bump golang 1.24 → 1.25

go.mod requires >= 1.25.0; previous Dockerfile pinned 1.24 which failed
at `go mod download` with: "go: go.mod requires go >= 1.25.0".

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -93,30 +93,35 @@ jobs:
         run: go build ./...
 
   image:
+    # Mirrors the portal CI pattern (platform/portal PR #14): push to
+    # registry.meghsakha.com, then POST a github-style payload signed
+    # with HMAC-SHA256 to the orca webhook on the master. Master matches
+    # on repo+branch and redeploys the breakpilot-tenant-registry service.
     needs: [shared, test]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' && hashFiles('Dockerfile') != ''
     runs-on: docker
     steps:
       - uses: actions/checkout@v4
-
       - uses: docker/login-action@v3
         with:
-          registry: repo.breakpilot.com
+          registry: registry.meghsakha.com
           username: ${{ secrets.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_PASS }}
-
       - uses: docker/build-push-action@v6
         with:
           push: true
           tags: |
-            repo.breakpilot.com/breakpilot/${{ github.event.repository.name }}:sha-${{ github.sha }}
-            repo.breakpilot.com/breakpilot/${{ github.event.repository.name }}:env-stage
-
-      - uses: anchore/sbom-action@v0
-        with:
-          image: repo.breakpilot.com/breakpilot/${{ github.event.repository.name }}:sha-${{ github.sha }}
-
-      - name: orca deploy stage
-        run: orca apply --env=stage --image-tag=sha-${{ github.sha }}
+            registry.meghsakha.com/breakpilot/tenant-registry:latest
+            registry.meghsakha.com/breakpilot/tenant-registry:sha-${{ github.sha }}
+      - name: trigger orca redeploy
         env:
-          ORCA_TOKEN: ${{ secrets.ORCA_STAGE_TOKEN }}
+          ORCA_WEBHOOK_SECRET: ${{ secrets.ORCA_WEBHOOK_SECRET }}
+        run: |
+          BODY='{"repository":{"full_name":"platform/tenant-registry"},"ref":"refs/heads/main"}'
+          SIG="sha256=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$ORCA_WEBHOOK_SECRET" -hex | awk '{print $NF}')"
+          curl -ksSf -X POST \
+            -H "Content-Type: application/json" \
+            -H "X-GitHub-Event: push" \
+            -H "X-Hub-Signature-256: $SIG" \
+            -d "$BODY" \
+            https://46.225.100.82:6880/api/v1/webhooks/github

.gitea/workflows/release.yaml

@@ -22,7 +22,7 @@ jobs:
 
       - name: verify stage soak (>= 24h on this image)
         run: |
-          IMG=repo.breakpilot.com/breakpilot/${{ github.event.repository.name }}:env-stage
+          IMG=registry.breakpilot.com/${{ github.event.repository.name }}:env-stage
           SOAK_SECONDS=$(orca image-age --env=stage --image $IMG)
           if [ "$SOAK_SECONDS" -lt 86400 ]; then
             echo "Stage soak only $SOAK_SECONDS s, < 24h. Aborting."
@@ -34,12 +34,12 @@ jobs:
       - name: re-tag image as semver + env-prod
         uses: docker/login-action@v3
         with:
-          registry: repo.breakpilot.com
+          registry: registry.breakpilot.com
           username: ${{ secrets.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_PASS }}
 
       - run: |
-          IMG=repo.breakpilot.com/breakpilot/${{ github.event.repository.name }}
+          IMG=registry.breakpilot.com/${{ github.event.repository.name }}
           docker pull $IMG:env-stage
           docker tag  $IMG:env-stage $IMG:v${{ steps.v.outputs.version }}
           docker tag  $IMG:env-stage $IMG:env-prod
@@ -67,7 +67,7 @@ jobs:
           curl -X POST -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
             -H "Content-Type: application/json" \
             -d "$(jq -Rs '{tag_name:"v${{ steps.v.outputs.version }}", name:"v${{ steps.v.outputs.version }}", body:.}' < RELEASE_NOTES.md)" \
-            https://git.breakpilot.com/api/v1/repos/${{ github.repository }}/releases
+            https://gitea.meghsakha.com/api/v1/repos/${{ github.repository }}/releases
 
   rollback-on-failure:
     needs: promote

Dockerfile

@@ -3,7 +3,7 @@
 #   /tenant-registry  — long-running API server
 #   /migrate          — one-shot schema migrator (Orca init container in prod)
 
-FROM golang:1.24-alpine AS build
+FROM golang:1.25-alpine AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download