баг-фикс завершён

.gitea/workflows/docker-build.yaml

@@ -15,6 +15,9 @@ env:
   REGISTRY: gitea.zuev.company
   BACKEND_IMAGE: zuev/magistr-backend
   FRONTEND_IMAGE: zuev/magistr-frontend
+  MAVEN_IMAGE: maven:3.9.9-eclipse-temurin-17@sha256:f58d59b6273e785ac0a4477f6e9b5ba1d7731c75b906c0f7b34076f1851318cc
+  NODE_IMAGE: node:22-alpine3.23@sha256:8516dce0483394d5708d4b2ee6cacb79fb1d617ea4e2787c2120bcca92ce372e
+  TRIVY_IMAGE: aquasec/trivy:0.63.0@sha256:6fb0646988fcd2fdf7bf123f7174945ebc2c9c72d1fa1567c8d7daeeb70f8037
 
 jobs:
   checks:
@@ -23,14 +26,14 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Получить исходный код
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Backend unit и component tests
         run: >-
           docker run --rm
           -v "${{ github.workspace }}/backend:/workspace"
           -w /workspace
-          maven:3.9.9-eclipse-temurin-17
+          "${{ env.MAVEN_IMAGE }}"
           mvn -Dapi.version=1.44 '-Dtest=!*IntegrationTest' test
 
       - name: Frontend static и unit tests
@@ -38,7 +41,7 @@ jobs:
           docker run --rm
           -v "${{ github.workspace }}/frontend:/workspace"
           -w /workspace
-          node:22-alpine3.23
+          "${{ env.NODE_IMAGE }}"
           sh -c "npm ci && npm run check"
 
       - name: Проверить Docker Compose
@@ -50,6 +53,9 @@ jobs:
       - name: Проверить сценарий immutable rollout и rollback
         run: bash scripts/test-deploy-images.sh
 
+      - name: Проверить закрепление артефактов и supply-chain gates
+        run: bash scripts/test-artifact-pinning.sh
+
   build-and-push-backend:
     name: Собрать backend image
     needs: checks
@@ -59,10 +65,10 @@ jobs:
       digest: ${{ steps.build.outputs.digest }}
     steps:
       - name: Получить исходный код
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Войти в Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -70,7 +76,7 @@ jobs:
 
       - name: Сформировать immutable tags и labels
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}
           flavor: latest=false
@@ -80,10 +86,12 @@ jobs:
 
       - name: Собрать и опубликовать backend image
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: ./backend
           push: true
+          provenance: mode=max
+          sbom: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: |
             ${{ steps.meta.outputs.labels }}
@@ -99,10 +107,10 @@ jobs:
       digest: ${{ steps.build.outputs.digest }}
     steps:
       - name: Получить исходный код
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Войти в Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -110,7 +118,7 @@ jobs:
 
       - name: Сформировать immutable tags и labels
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}
           flavor: latest=false
@@ -120,19 +128,53 @@ jobs:
 
       - name: Собрать и опубликовать frontend image
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: ./frontend
           push: true
+          provenance: mode=max
+          sbom: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: |
             ${{ steps.meta.outputs.labels }}
             org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
             org.opencontainers.image.revision=${{ github.sha }}
 
+  security-scan:
+    name: Проверить опубликованные образы
+    needs: [build-and-push-backend, build-and-push-frontend]
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      BACKEND_REF: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}@${{ needs.build-and-push-backend.outputs.digest }}
+      FRONTEND_REF: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}@${{ needs.build-and-push-frontend.outputs.digest }}
+    steps:
+      - name: Войти в Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.ZUEV_TOKEN }}
+
+      - name: Проверить backend на HIGH и CRITICAL уязвимости
+        run: >-
+          docker run --rm
+          -v "$HOME/.docker:/root/.docker:ro"
+          "${{ env.TRIVY_IMAGE }}"
+          image --scanners vuln --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed
+          "$BACKEND_REF"
+
+      - name: Проверить frontend на HIGH и CRITICAL уязвимости
+        run: >-
+          docker run --rm
+          -v "$HOME/.docker:/root/.docker:ro"
+          "${{ env.TRIVY_IMAGE }}"
+          image --scanners vuln --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed
+          "$FRONTEND_REF"
+
   deploy-to-k8s:
     name: Развернуть проверенные digests
-    needs: [build-and-push-backend, build-and-push-frontend]
+    needs: [build-and-push-backend, build-and-push-frontend, security-scan]
     runs-on: ubuntu-latest
     timeout-minutes: 15
     environment: production
@@ -143,7 +185,7 @@ jobs:
       KUBECTL_SHA256: fe80ae4133b44fa2077db4af144e80765eb1b3b2eede55fbff6933c4374d8c6e
     steps:
       - name: Получить deploy-скрипт
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Создать kubeconfig
         env: