Zuev/magistr
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

/

Browse Source
This commit is contained in:
Zuev
2026-07-30 03:18:43 +03:00
parent a759155b15
commit 87f3d98621
9 changed files with 177 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
scripts/check-artifact-pinning.sh
View File

@@ -119,9 +119,12 @@ check_workflow_gates() {
if ! grep -Eq '^ needs: \[build-and-push-backend, build-and-push-frontend, security-scan\]$' "$WORKFLOW"; then
fail "deploy обязан зависеть от успешного security-scan"
fi
if ! grep -Eq '^[[:space:]]{2}workflow_dispatch:[[:space:]]*$' "$WORKFLOW" \
|| ! grep -Fq "if: \${{ gitea.event_name == 'workflow_dispatch' }}" "$WORKFLOW"; then
fail "production deploy должен запускаться только через ручной workflow_dispatch"
if ! grep -Eq '^[[:space:]]{2}push:[[:space:]]*$' "$WORKFLOW" \
|| ! grep -Eq '^[[:space:]]{6}- main[[:space:]]*$' "$WORKFLOW"; then
fail "production deploy должен автоматически запускаться после push в main"
fi
if grep -Fq "if: \${{ gitea.event_name == 'workflow_dispatch' }}" "$WORKFLOW"; then
fail "production deploy не должен требовать ручной workflow_dispatch"
fi
if ! grep -Eq '^ KUBECTL_VERSION: v[0-9]+\.[0-9]+\.[0-9]+$' "$WORKFLOW" \

5
scripts/test-artifact-pinning.sh
View File

@@ -74,10 +74,11 @@ fi
cp "$ROOT_DIR/.gitea/workflows/docker-build.yaml" \
"$FIXTURE_DIR/.gitea/workflows/docker-build.yaml"
sed -i "/gitea.event_name == 'workflow_dispatch'/d" \
MANUAL_DEPLOY_GATE=" if: \${{ gitea.event_name == 'workflow_dispatch' }}"
sed -i "/^ needs: \\[build-and-push-backend, build-and-push-frontend, security-scan\\]$/a\\$MANUAL_DEPLOY_GATE" \
"$FIXTURE_DIR/.gitea/workflows/docker-build.yaml"
if PROJECT_ROOT="$FIXTURE_DIR" bash "$CHECK_SCRIPT" >/dev/null 2>&1; then
printf 'Ошибка теста: автоматический production deploy на push не был отклонён\n' >&2
printf 'Ошибка теста: обязательный ручной production deploy не был отклонён\n' >&2
exit 1
fi