Устранить уязвимости backend-образа

scripts/check-artifact-pinning.sh

@@ -123,6 +123,15 @@ check_downloaded_backend_artifact() {
     fi
 }
 
+check_backend_runtime_updates() {
+    local dockerfile="$PROJECT_ROOT/backend/Dockerfile"
+
+    require_file "$dockerfile" || return
+    if ! grep -Fq 'RUN apk upgrade --no-cache' "$dockerfile"; then
+        fail "runtime-образ backend должен устанавливать доступные исправления Alpine"
+    fi
+}
+
 check_testcontainer_images() {
     local image_catalog="$PROJECT_ROOT/backend/src/test/java/com/magistr/app/testing/TestContainerImages.java"
 
@@ -160,6 +169,7 @@ check_compose_images
 check_actions
 check_workflow_gates
 check_downloaded_backend_artifact
+check_backend_runtime_updates
 check_testcontainer_images
 check_optional_kubernetes_images
 

scripts/test-artifact-pinning.sh

@@ -37,6 +37,14 @@ if PROJECT_ROOT="$FIXTURE_DIR" bash "$CHECK_SCRIPT" >/dev/null 2>&1; then
     exit 1
 fi
 
+cp "$ROOT_DIR/backend/Dockerfile" "$FIXTURE_DIR/backend/Dockerfile"
+sed -i '/RUN apk upgrade --no-cache/d' "$FIXTURE_DIR/backend/Dockerfile"
+if PROJECT_ROOT="$FIXTURE_DIR" bash "$CHECK_SCRIPT" >/dev/null 2>&1; then
+    printf 'Ошибка теста: отсутствие Alpine security updates не было отклонено\n' >&2
+    exit 1
+fi
+
+cp "$ROOT_DIR/backend/Dockerfile" "$FIXTURE_DIR/backend/Dockerfile"
 cp "$ROOT_DIR/.gitea/workflows/docker-build.yaml" \
     "$FIXTURE_DIR/.gitea/workflows/docker-build.yaml"
 sed -i "/gitea.event_name == 'workflow_dispatch'/d" \