fix(ci): update to v1.8.21 for x86 base images

.gitea/workflows/deploy.yml

@@ -105,17 +105,32 @@ jobs:
             if [[ "${{ github.ref_type }}" == "tag" ]]; then
               echo "🔎 Checking for @mintel dependencies in package.json..."
               # Extract any @mintel/ version (they should be synced in monorepo)
-              UPSTREAM_VERSION=$(grep -o '"@mintel/.*": "[^"]*"' package.json | head -1 | cut -d'"' -f4 | sed 's/\^//; s/\~//')
+              UPSTREAM_VERSION=$(grep -o '"@mintel/.*": "[^"]*"' package.json | grep -v "next-utils" | cut -d'"' -f4 | sed 's/\^//; s/\~//' | sort -V | tail -1)
               TAG_TO_WAIT="v$UPSTREAM_VERSION"
               
               if [[ -n "$UPSTREAM_VERSION" && "$UPSTREAM_VERSION" != "workspace:"* ]]; then
-                echo "⏳ This release depends on @mintel v$UPSTREAM_VERSION. Waiting for upstream build..."
-                # Fetch script from monorepo (main)
-                curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
-                  "https://git.infra.mintel.me/mmintel/at-mintel/raw/branch/main/packages/infra/scripts/wait-for-upstream.sh" > wait-for-upstream.sh
-                chmod +x wait-for-upstream.sh
+                # 1. Discovery (Works without token for public repositories)
+                UPSTREAM_SHA=$(git ls-remote --tags https://git.infra.mintel.me/mmintel/at-mintel.git "$TAG_TO_WAIT" | grep "$TAG_TO_WAIT" | tail -n1 | awk '{print $1}')
                 
-                GITEA_TOKEN=${{ secrets.GITHUB_TOKEN }} ./wait-for-upstream.sh "mmintel/at-mintel" "$TAG_TO_WAIT"
+                if [[ -z "$UPSTREAM_SHA" ]]; then
+                  echo "❌ Error: Tag $TAG_TO_WAIT not found in mmintel/at-mintel."
+                  exit 1
+                fi
+                echo "✅ Tag verified: Found upstream SHA $UPSTREAM_SHA for $TAG_TO_WAIT"
+
+                # 2. Status Check (Requires PAT for cross-repo API access)
+                POLL_TOKEN="${{ secrets.GITEA_PAT || secrets.MINTEL_PRIVATE_TOKEN }}"
+                
+                if [[ -n "$POLL_TOKEN" ]]; then
+                  echo "⏳ POLL_TOKEN found. Checking upstream build status..."
+                  curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+                    "https://git.infra.mintel.me/mmintel/at-mintel/raw/branch/main/packages/infra/scripts/wait-for-upstream.sh" > wait-for-upstream.sh
+                  chmod +x wait-for-upstream.sh
+                  GITEA_TOKEN="$POLL_TOKEN" ./wait-for-upstream.sh "mmintel/at-mintel" "$TAG_TO_WAIT"
+                else
+                  echo "ℹ️ No PAT secret found. Skipping build status wait (Actions API is restricted)."
+                  echo "   If this build fails, ensure that mmintel/at-mintel $TAG_TO_WAIT has finished its Docker build."
+                fi
               fi
             fi
           else
@@ -256,12 +271,15 @@ jobs:
             AUTH_MIDDLEWARE="$STD_MW"
             COMPOSE_PROFILES=""
           else
+            # Exclude Gatekeeper from the main app router to prevent redirect loops
+            TRAEFIK_RULE="Host(\`${TRAEFIK_HOST}\`) && !PathPrefix(\`/gatekeeper\`)"
             # Order: Forward (Proto) -> Auth -> Compression
             AUTH_MIDDLEWARE="${PROJECT_NAME}-forward,${PROJECT_NAME}-auth,compress"
             COMPOSE_PROFILES="gatekeeper"
           fi
-          
+
           # Gatekeeper Origin
+          COOKIE_DOMAIN=.$(echo $NEXT_PUBLIC_BASE_URL | sed 's|https://||')
           GATEKEEPER_ORIGIN="$NEXT_PUBLIC_BASE_URL/gatekeeper"
 
           # Generate Environment File
@@ -285,7 +303,7 @@ jobs:
           DIRECTUS_DB_USER=$DIRECTUS_DB_USER
           DIRECTUS_DB_PASSWORD=$DIRECTUS_DB_PASSWORD
           DIRECTUS_API_TOKEN=$DIRECTUS_API_TOKEN
-          INTERNAL_DIRECTUS_URL=http://directus:8055
+          INTERNAL_DIRECTUS_URL=http://${PROJECT_NAME}-directus:8055
           
           # Mail
           MAIL_HOST=$MAIL_HOST
@@ -361,7 +379,7 @@ jobs:
           URL="${{ needs.prepare.outputs.next_public_url }}"
           echo "Checking health of $URL..."
           for i in {1..12}; do
-            if curl -s -f "$URL" > /dev/null; then
+            if curl -s -f -k -L "$URL" > /dev/null; then
               echo "✅ Health check passed!"
               exit 0
             fi

docker-compose.yaml

@@ -31,7 +31,7 @@ services:
 
       - "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.address=http://${PROJECT_NAME}-gatekeeper:3000/gatekeeper/api/verify"
       - "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.trustForwardHeader=true"
-      - "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.authRequestHeaders=Host,X-Forwarded-Host,X-Forwarded-Proto,X-Forwarded-For"
+      - "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.authRequestHeaders=X-Forwarded-Host,X-Forwarded-Proto,X-Forwarded-For,Cookie"
       - "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.authResponseHeaders=X-Auth-User"
     healthcheck:
       test: [ "CMD", "node", "-e", "fetch('http://127.0.0.1:3000/api/health').then(r => r.ok ? process.exit(0) : process.exit(1)).catch(() => process.exit(1))" ]
@@ -49,17 +49,21 @@ services:
       infra:
         aliases:
           - ${PROJECT_NAME:-mb-grid-solutions}-gatekeeper
-          - gatekeeper
     env_file:
       - ${ENV_FILE:-.env}
     environment:
       PORT: ${PORT:-3000}
       PROJECT_NAME: ${PROJECT_NAME:-MB Grid Solutions}
       PROJECT_COLOR: ${PROJECT_COLOR:-#82ed20}
-      COOKIE_DOMAIN: ${COOKIE_DOMAIN:-.mb-grid-solutions.com}
-      AUTH_COOKIE_NAME: ${AUTH_COOKIE_NAME:-mintel_gatekeeper_session}
-      GATEKEEPER_PASSWORD: ${GATEKEEPER_PASSWORD:-mintel}
+      COOKIE_DOMAIN: ${COOKIE_DOMAIN}
+      AUTH_COOKIE_NAME: ${AUTH_COOKIE_NAME}
+      GATEKEEPER_PASSWORD: ${GATEKEEPER_PASSWORD}
       NEXT_PUBLIC_BASE_URL: ${GATEKEEPER_ORIGIN}
+    healthcheck:
+      test: [ "CMD", "node", "-e", "fetch('http://127.0.0.1:3000/gatekeeper/login').then(r => r.ok ? process.exit(0) : process.exit(1)).catch(() => process.exit(1))" ]
+      interval: 10s
+      timeout: 5s
+      retries: 5
     labels:
       - "traefik.enable=true"
       - "traefik.http.services.${PROJECT_NAME}-gatekeeper.loadbalancer.server.port=3000"
@@ -72,7 +76,7 @@ services:
       infra:
         aliases:
           - ${PROJECT_NAME:-mb-grid-solutions}-directus
-      backend:
+      testing-backend:
     env_file:
       - ${ENV_FILE:-.env}
     environment:
@@ -81,8 +85,8 @@ services:
       DB_PORT: '5432'
       WEBSOCKETS_ENABLED: 'true'
       PUBLIC_URL: ${DIRECTUS_URL}
-      KEY: ${DIRECTUS_KEY}
-      SECRET: ${DIRECTUS_SECRET}
+      KEY: ${DIRECTUS_KEY:-01234567-89ab-cdef-0123-456789abcdef}
+      SECRET: ${DIRECTUS_SECRET:-long-secret-for-signing-tokens-must-be-32-chars}
       ADMIN_EMAIL: ${DIRECTUS_ADMIN_EMAIL}
       ADMIN_PASSWORD: ${DIRECTUS_ADMIN_PASSWORD}
       DB_DATABASE: ${DIRECTUS_DB_NAME:-directus}
@@ -105,12 +109,18 @@ services:
       - "traefik.http.routers.${PROJECT_NAME}-directus.middlewares=${PROJECT_NAME}-forward,compress"
       - "traefik.http.services.${PROJECT_NAME}-directus.loadbalancer.server.port=8055"
       - "traefik.docker.network=infra"
+    healthcheck:
+      test: [ "CMD", "node", "-e", "fetch('http://localhost:8055/admin').then(r => r.ok ? process.exit(0) : process.exit(1)).catch(() => process.exit(1))" ]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
 
   directus-db:
     image: postgres:15-alpine
     restart: always
     networks:
-      - backend
+      - testing-backend
     env_file:
       - ${ENV_FILE:-.env}
     environment:
@@ -123,7 +133,7 @@ services:
 networks:
   infra:
     external: true
-  backend:
+  testing-backend:
     internal: true
 
 volumes:

package.json

@@ -25,8 +25,8 @@
   "license": "ISC",
   "description": "",
   "dependencies": {
-    "@mintel/next-config": "^1.6.0",
-    "@mintel/next-utils": "^1.7.15",
+    "@mintel/next-config": "^1.8.21",
+    "@mintel/next-utils": "^1.8.21",
     "@sentry/nextjs": "^10.38.0",
     "framer-motion": "^12.29.2",
     "lucide-react": "^0.562.0",
@@ -42,10 +42,10 @@
     "@commitlint/cli": "^20.4.0",
     "@commitlint/config-conventional": "^20.4.0",
     "@directus/sdk": "^21.0.0",
-    "@mintel/cli": "^1.6.0",
-    "@mintel/eslint-config": "^1.6.0",
-    "@mintel/husky-config": "^1.6.0",
-    "@mintel/tsconfig": "^1.6.0",
+    "@mintel/cli": "^1.8.21",
+    "@mintel/eslint-config": "^1.8.21",
+    "@mintel/husky-config": "^1.8.21",
+    "@mintel/tsconfig": "^1.8.21",
     "@tailwindcss/postcss": "^4.1.18",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",