From 8d8a5814d8e80d4eb7213380d40d675bdac44f61 Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com>
Date: Wed, 10 Jun 2026 14:08:41 +0200
Subject: [PATCH 1/2] ci(tenant-registry): retarget image build to
 registry.meghsakha.com + orca webhook

Mirrors the portal CI pattern (platform/portal #14). Previous workflow
pushed to a future-prod registry that doesn't exist, then called an orca
CLI shape this version doesn't ship.

- Registry: registry.meghsakha.com
- Image path: breakpilot/tenant-registry
- Tags: :latest (webhook deploy) + :sha-<sha> (traceability)
- Webhook: HMAC-signed POST to the orca master

One-time setup before this can deploy:
1. Add Gitea Actions secrets to this repo: REGISTRY_USER, REGISTRY_PASS, ORCA_WEBHOOK_SECRET
2. On the orca master:
   orca webhooks add --repo platform/tenant-registry \
                     --service breakpilot-tenant-registry --branch main

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .gitea/workflows/ci.yaml | 31 ++++++++++++++++++-------------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index ad675d6..7a65b0d 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -93,30 +93,35 @@ jobs:
         run: go build ./...
 
   image:
+    # Mirrors the portal CI pattern (platform/portal PR #14): push to
+    # registry.meghsakha.com, then POST a github-style payload signed
+    # with HMAC-SHA256 to the orca webhook on the master. Master matches
+    # on repo+branch and redeploys the breakpilot-tenant-registry service.
     needs: [shared, test]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' && hashFiles('Dockerfile') != ''
     runs-on: docker
     steps:
       - uses: actions/checkout@v4
-
       - uses: docker/login-action@v3
         with:
-          registry: registry.breakpilot.com
+          registry: registry.meghsakha.com
           username: ${{ secrets.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_PASS }}
-
       - uses: docker/build-push-action@v6
         with:
           push: true
           tags: |
-            registry.breakpilot.com/${{ github.event.repository.name }}:sha-${{ github.sha }}
-            registry.breakpilot.com/${{ github.event.repository.name }}:env-stage
-
-      - uses: anchore/sbom-action@v0
-        with:
-          image: registry.breakpilot.com/${{ github.event.repository.name }}:sha-${{ github.sha }}
-
-      - name: orca deploy stage
-        run: orca apply --env=stage --image-tag=sha-${{ github.sha }}
+            registry.meghsakha.com/breakpilot/tenant-registry:latest
+            registry.meghsakha.com/breakpilot/tenant-registry:sha-${{ github.sha }}
+      - name: trigger orca redeploy
         env:
-          ORCA_TOKEN: ${{ secrets.ORCA_STAGE_TOKEN }}
+          ORCA_WEBHOOK_SECRET: ${{ secrets.ORCA_WEBHOOK_SECRET }}
+        run: |
+          BODY='{"repository":{"full_name":"platform/tenant-registry"},"ref":"refs/heads/main"}'
+          SIG="sha256=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$ORCA_WEBHOOK_SECRET" -hex | awk '{print $NF}')"
+          curl -ksSf -X POST \
+            -H "Content-Type: application/json" \
+            -H "X-GitHub-Event: push" \
+            -H "X-Hub-Signature-256: $SIG" \
+            -d "$BODY" \
+            https://46.225.100.82:6880/api/v1/webhooks/github
-- 
2.54.0


From fedcea06c743d290ba310faaa9e8dbfb6101f047 Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com>
Date: Wed, 10 Jun 2026 14:10:57 +0200
Subject: [PATCH 2/2] =?UTF-8?q?build:=20bump=20golang=201.24=20=E2=86=92?=
 =?UTF-8?q?=201.25?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

go.mod requires >= 1.25.0; previous Dockerfile pinned 1.24 which failed
at `go mod download` with: "go: go.mod requires go >= 1.25.0".

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index d83fa9f..f678abf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,7 @@
 #   /tenant-registry  — long-running API server
 #   /migrate          — one-shot schema migrator (Orca init container in prod)
 
-FROM golang:1.24-alpine AS build
+FROM golang:1.25-alpine AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
-- 
2.54.0