Zuev/magistr
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

баг-фикс завершён

Browse Source
This commit is contained in:
Zuev
2026-07-19 20:16:12 +03:00
parent bc0e1ab1b4
commit ee876f1acd
43 changed files with 1228 additions and 258 deletions
Download Patch File Download Diff File Expand all files Collapse all files

68
.gitea/workflows/docker-build.yaml
View File

@@ -15,6 +15,9 @@ env:
REGISTRY: gitea.zuev.company
BACKEND_IMAGE: zuev/magistr-backend
FRONTEND_IMAGE: zuev/magistr-frontend
MAVEN_IMAGE: maven:3.9.9-eclipse-temurin-17@sha256:f58d59b6273e785ac0a4477f6e9b5ba1d7731c75b906c0f7b34076f1851318cc
NODE_IMAGE: node:22-alpine3.23@sha256:8516dce0483394d5708d4b2ee6cacb79fb1d617ea4e2787c2120bcca92ce372e
TRIVY_IMAGE: aquasec/trivy:0.63.0@sha256:6fb0646988fcd2fdf7bf123f7174945ebc2c9c72d1fa1567c8d7daeeb70f8037
jobs:
checks:
@@ -23,14 +26,14 @@ jobs:
timeout-minutes: 20
steps:
- name: Получить исходный код
uses: actions/checkout@v4
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Backend unit и component tests
run: >-
docker run --rm
-v "${{ github.workspace }}/backend:/workspace"
-w /workspace
maven:3.9.9-eclipse-temurin-17
"${{ env.MAVEN_IMAGE }}"
mvn -Dapi.version=1.44 '-Dtest=!*IntegrationTest' test
- name: Frontend static и unit tests
@@ -38,7 +41,7 @@ jobs:
docker run --rm
-v "${{ github.workspace }}/frontend:/workspace"
-w /workspace
node:22-alpine3.23
"${{ env.NODE_IMAGE }}"
sh -c "npm ci && npm run check"
- name: Проверить Docker Compose
@@ -50,6 +53,9 @@ jobs:
- name: Проверить сценарий immutable rollout и rollback
run: bash scripts/test-deploy-images.sh
- name: Проверить закрепление артефактов и supply-chain gates
run: bash scripts/test-artifact-pinning.sh
build-and-push-backend:
name: Собрать backend image
needs: checks
@@ -59,10 +65,10 @@ jobs:
digest: ${{ steps.build.outputs.digest }}
steps:
- name: Получить исходный код
uses: actions/checkout@v4
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Войти в Container Registry
uses: docker/login-action@v3
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
@@ -70,7 +76,7 @@ jobs:
- name: Сформировать immutable tags и labels
id: meta
uses: docker/metadata-action@v5
uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
with:
images: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}
flavor: latest=false
@@ -80,10 +86,12 @@ jobs:
- name: Собрать и опубликовать backend image
id: build
uses: docker/build-push-action@v6
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
with:
context: ./backend
push: true
provenance: mode=max
sbom: true
tags: ${{ steps.meta.outputs.tags }}
labels: |
${{ steps.meta.outputs.labels }}
@@ -99,10 +107,10 @@ jobs:
digest: ${{ steps.build.outputs.digest }}
steps:
- name: Получить исходный код
uses: actions/checkout@v4
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Войти в Container Registry
uses: docker/login-action@v3
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
@@ -110,7 +118,7 @@ jobs:
- name: Сформировать immutable tags и labels
id: meta
uses: docker/metadata-action@v5
uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
with:
images: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}
flavor: latest=false
@@ -120,19 +128,53 @@ jobs:
- name: Собрать и опубликовать frontend image
id: build
uses: docker/build-push-action@v6
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
with:
context: ./frontend
push: true
provenance: mode=max
sbom: true
tags: ${{ steps.meta.outputs.tags }}
labels: |
${{ steps.meta.outputs.labels }}
org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
org.opencontainers.image.revision=${{ github.sha }}
security-scan:
name: Проверить опубликованные образы
needs: [build-and-push-backend, build-and-push-frontend]
runs-on: ubuntu-latest
timeout-minutes: 20
env:
BACKEND_REF: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}@${{ needs.build-and-push-backend.outputs.digest }}
FRONTEND_REF: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}@${{ needs.build-and-push-frontend.outputs.digest }}
steps:
- name: Войти в Container Registry
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.ZUEV_TOKEN }}
- name: Проверить backend на HIGH и CRITICAL уязвимости
run: >-
docker run --rm
-v "$HOME/.docker:/root/.docker:ro"
"${{ env.TRIVY_IMAGE }}"
image --scanners vuln --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed
"$BACKEND_REF"
- name: Проверить frontend на HIGH и CRITICAL уязвимости
run: >-
docker run --rm
-v "$HOME/.docker:/root/.docker:ro"
"${{ env.TRIVY_IMAGE }}"
image --scanners vuln --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed
"$FRONTEND_REF"
deploy-to-k8s:
name: Развернуть проверенные digests
needs: [build-and-push-backend, build-and-push-frontend]
needs: [build-and-push-backend, build-and-push-frontend, security-scan]
runs-on: ubuntu-latest
timeout-minutes: 15
environment: production
@@ -143,7 +185,7 @@ jobs:
KUBECTL_SHA256: fe80ae4133b44fa2077db4af144e80765eb1b3b2eede55fbff6933c4374d8c6e
steps:
- name: Получить deploy-скрипт
uses: actions/checkout@v4
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Создать kubeconfig
env: