баг-фикс 30/34

.gitea/workflows/docker-build.yaml

@@ -1,4 +1,4 @@
-name: Build and Push Docker Images
+name: Проверка, сборка и развёртывание Magistr
 
 on:
   push:
@@ -7,32 +7,79 @@ on:
     tags:
       - 'v*'
 
+concurrency:
+  group: magistr-production
+  cancel-in-progress: false
+
 env:
-  REGISTRY: gitea.zuev.company # Замените на реальный домен вашего Gitea
+  REGISTRY: gitea.zuev.company
   BACKEND_IMAGE: zuev/magistr-backend
   FRONTEND_IMAGE: zuev/magistr-frontend
 
 jobs:
-  build-and-push-backend:
+  checks:
+    name: Обязательные проверки
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
-      - name: Checkout repository
+      - name: Получить исходный код
         uses: actions/checkout@v4
 
-      - name: Log in to the Container registry
+      - name: Backend unit и component tests
+        run: >-
+          docker run --rm
+          -v "${{ github.workspace }}/backend:/workspace"
+          -w /workspace
+          maven:3.9.9-eclipse-temurin-17
+          mvn -Dapi.version=1.44 '-Dtest=!*IntegrationTest' test
+
+      - name: Frontend static и unit tests
+        run: >-
+          docker run --rm
+          -v "${{ github.workspace }}/frontend:/workspace"
+          -w /workspace
+          node:22-alpine3.23
+          sh -c "npm ci && npm run check"
+
+      - name: Проверить Docker Compose
+        env:
+          POSTGRES_PASSWORD: ci-config-only
+          JWT_SECRET: ci-only-secret-not-for-runtime-0123456789abcdef0123456789abcdef
+        run: docker compose config --quiet
+
+      - name: Проверить сценарий immutable rollout и rollback
+        run: bash scripts/test-deploy-images.sh
+
+  build-and-push-backend:
+    name: Собрать backend image
+    needs: checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    outputs:
+      digest: ${{ steps.build.outputs.digest }}
+    steps:
+      - name: Получить исходный код
+        uses: actions/checkout@v4
+
+      - name: Войти в Container Registry
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
-          password: ${{ secrets.ZUEV_TOKEN }} # Нужно создать секрет ZUEV_TOKEN в настройках репозитория (Personal Access Token)
+          password: ${{ secrets.ZUEV_TOKEN }}
 
-      - name: Extract metadata (tags, labels) for Docker
+      - name: Сформировать immutable tags и labels
         id: meta
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}
+          flavor: latest=false
+          tags: |
+            type=sha,format=long,prefix=sha-
+            type=ref,event=tag
 
-      - name: Build and push Docker image
+      - name: Собрать и опубликовать backend image
+        id: build
         uses: docker/build-push-action@v6
         with:
           context: ./backend
@@ -41,26 +88,38 @@ jobs:
           labels: |
             ${{ steps.meta.outputs.labels }}
             org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+
   build-and-push-frontend:
+    name: Собрать frontend image
+    needs: checks
     runs-on: ubuntu-latest
+    timeout-minutes: 20
+    outputs:
+      digest: ${{ steps.build.outputs.digest }}
     steps:
-      - name: Checkout repository
+      - name: Получить исходный код
         uses: actions/checkout@v4
 
-      - name: Log in to the Container registry
+      - name: Войти в Container Registry
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.ZUEV_TOKEN }}
 
-      - name: Extract metadata (tags, labels) for Docker
+      - name: Сформировать immutable tags и labels
         id: meta
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}
+          flavor: latest=false
+          tags: |
+            type=sha,format=long,prefix=sha-
+            type=ref,event=tag
 
-      - name: Build and push Docker image
+      - name: Собрать и опубликовать frontend image
+        id: build
         uses: docker/build-push-action@v6
         with:
           context: ./frontend
@@ -69,29 +128,38 @@ jobs:
           labels: |
             ${{ steps.meta.outputs.labels }}
             org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
 
   deploy-to-k8s:
+    name: Развернуть проверенные digests
     needs: [build-and-push-backend, build-and-push-frontend]
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment: production
+    env:
+      BACKEND_REF: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}@${{ needs.build-and-push-backend.outputs.digest }}
+      FRONTEND_REF: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}@${{ needs.build-and-push-frontend.outputs.digest }}
+      KUBECTL_VERSION: v1.33.12
+      KUBECTL_SHA256: fe80ae4133b44fa2077db4af144e80765eb1b3b2eede55fbff6933c4374d8c6e
     steps:
-      - name: Create kubeconfig
-        run: |
-          mkdir -p ~/.kube
-          echo "${{ secrets.KUBECONFIG_DATA }}" | base64 -d > ~/.kube/config
-          chmod 600 ~/.kube/config
+      - name: Получить deploy-скрипт
+        uses: actions/checkout@v4
 
-      - name: Install kubectl
+      - name: Создать kubeconfig
+        env:
+          KUBECONFIG_DATA: ${{ secrets.KUBECONFIG_DATA }}
         run: |
-          curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
-          chmod +x kubectl
-          mv kubectl /usr/local/bin/
+          install -d -m 700 "$HOME/.kube"
+          printf '%s' "$KUBECONFIG_DATA" | base64 --decode > "$HOME/.kube/config"
+          chmod 600 "$HOME/.kube/config"
 
-      - name: Trigger Kubernetes Rollout
+      - name: Установить проверенный kubectl
         run: |
-          # Перезапускаем поды, чтобы они скачали свежий :main образ
-          kubectl rollout restart deployment backend frontend -n magistr
-          
-          # Ждём успешного обновления (5 минут на backend из-за Spring Boot)
-          kubectl rollout status deployment/frontend -n magistr --timeout=120s
-          kubectl rollout status deployment/backend -n magistr --timeout=300s
+          curl --fail --show-error --silent --location --retry 3 \
+            --output kubectl \
+            "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
+          echo "${KUBECTL_SHA256}  kubectl" | sha256sum --check --strict
+          sudo install -m 0755 kubectl /usr/local/bin/kubectl
 
+      - name: Применить digests и проверить rollout
+        run: bash scripts/deploy-images.sh "$BACKEND_REF" "$FRONTEND_REF"