Новый сервис pcp-tgu-ui-service: ТГУ-фронт на headless-auth nstart + платформенный CI/деплой

2026-06-09 13:35:13 +03:00
parent 0b617594fd
commit 505bf1f31c
129 changed files with 21640 additions and 0 deletions
@@ -0,0 +1,132 @@
+stages:
+  - build
+  - verify
+  - push
+
+default:
+  image: repo.nstart.cloud/nstart/node:24-trixie-slim
+  cache:
+    paths:
+      - .npm/
+
+install:
+  stage: build
+  script:
+    - npm ci --cache .npm --prefer-offline
+  artifacts:
+    expire_in: 1h
+    paths:
+      - node_modules/
+
+oci:
+  stage: build
+  image: repo.nstart.cloud/nstart/docker-cli-buildx:1.0.0
+  services:
+    - name: repo.nstart.cloud/library/docker:29.1.2-dind
+      alias: docker
+      command: ["--tls=false"]
+  variables:
+    DOCKER_HOST: tcp://docker:2375
+    DOCKER_TLS_CERTDIR: ""
+  script:
+    - |
+      export VERSION=$(jq -r '.version' package.json)
+      export IMAGE_NAME=$CI_PROJECT_NAME
+
+      docker bake save
+
+      docker bake app --print \
+        | jq -r '.target.app.tags[]' \
+        > dist/tags.txt
+  artifacts:
+    paths:
+      - dist/
+    expire_in: 1 day
+
+trivy:
+  stage: verify
+  image:
+    name: repo.nstart.cloud/aquasec/trivy:0.69.3
+    entrypoint: [""]
+  needs:
+    - job: oci
+      artifacts: true
+  variables:
+    TRIVY_CACHE_DIR: .trivycache
+  cache:
+    paths:
+      - .trivycache/
+  script:
+    - |
+      mkdir -p dist/oci-layout
+      OCI_TAR="$(find dist -maxdepth 1 -type f -name '*.tar' -print -quit)"
+
+      tar -xf "$OCI_TAR" -C dist/oci-layout
+
+      trivy image --input "dist/oci-layout" \
+        --format table \
+        --table-mode detailed \
+        --scanners vuln,secret,misconfig \
+        --image-config-scanners misconfig,secret \
+        --pkg-types os,library \
+        --severity HIGH,CRITICAL \
+        --ignore-unfixed \
+        --exit-code 1
+
+build:
+  stage: verify
+  needs: ["install"]
+  script:
+    - npm run build
+
+semgrep:
+  stage: verify
+  image: repo.nstart.cloud/semgrep/semgrep:1.160.0
+  script:
+    - semgrep scan --config auto --error .
+
+.push_oci:
+  image:
+    name: repo.nstart.cloud/skopeo/stable:latest
+    entrypoint: [""]
+  script:
+    - |
+      skopeo login "$REGISTRY" -u "$REGISTRY_USER" -p "$REGISTRY_PASSWORD"
+
+      OCI_TAR="$(find dist -maxdepth 1 -type f -name '*.tar' -print -quit)"
+
+      while IFS= read -r DEST_TAG; do
+        [ -n "$DEST_TAG" ] || continue
+
+        skopeo copy --dest-tls-verify=false \
+          "oci-archive:${OCI_TAR}:latest" \
+          "docker://${DEST_TAG}"
+      done < dist/tags.txt
+
+manual:
+  stage: push
+  extends: .push_oci
+  needs:
+    - job: oci
+      artifacts: true
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: manual
+      allow_failure: true
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+      when: manual
+      allow_failure: true
+    - when: never
+  manual_confirmation: "Вы уверены, что хотите запустить push в registry?"
+
+auto:
+  stage: push
+  extends: .push_oci
+  needs:
+    - job: oci
+      artifacts: true
+    - job: trivy
+  rules:
+    - if: $CI_COMMIT_TAG
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    - when: never