Merge branch 'fix/ci-registry-proxy-paths' into 'main'
fix(ci): use /dockerhub/ prefix для Nexus proxy путей See merge request 2-6/2-6-4/terravault/ordinis!300
This commit is contained in:
Александр Зимин
+12
-12
@@ -98,7 +98,7 @@ default:
|
||||
# содержит весь changelog со всеми историческими commit'ами — false positive.
|
||||
commit-msg-lint:
|
||||
stage: test
|
||||
image: repo.nstart.cloud/library/alpine:3.20
|
||||
image: repo.nstart.cloud/dockerhub/library/alpine:3.20
|
||||
script:
|
||||
# Runner не имеет outbound к dl-cdn.alpinelinux.org (Permission denied) —
|
||||
# переадресуем apk на internal Nexus mirror. Это нужно во всех Alpine
|
||||
@@ -174,7 +174,7 @@ commit-msg-lint:
|
||||
# ─── TEST ──────────────────────────────────────
|
||||
maven-test:
|
||||
stage: test
|
||||
image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21
|
||||
image: repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21
|
||||
script:
|
||||
- mvn $MAVEN_CLI_OPTS verify
|
||||
artifacts:
|
||||
@@ -193,9 +193,9 @@ maven-test:
|
||||
# не имеет Docker.
|
||||
maven-e2e:
|
||||
stage: test
|
||||
image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21
|
||||
image: repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21
|
||||
services:
|
||||
- name: repo.nstart.cloud/library/docker:29.1.2-dind
|
||||
- name: repo.nstart.cloud/dockerhub/library/docker:29.1.2-dind
|
||||
alias: docker
|
||||
command: ["--tls=false"]
|
||||
variables:
|
||||
@@ -221,7 +221,7 @@ maven-e2e:
|
||||
# на hot paths (parseRef, OnCloseAction, schema traversal).
|
||||
maven-bench:
|
||||
stage: test
|
||||
image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21
|
||||
image: repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21
|
||||
script:
|
||||
- mvn $MAVEN_CLI_OPTS -P bench -pl ordinis-bench -am package -DskipTests
|
||||
# Quick smoke: 1 fork, 2 warmups, 3 measurements × 2s. Total ~5 min.
|
||||
@@ -247,7 +247,7 @@ maven-bench:
|
||||
# идентичных jar'ов ~30 sec.
|
||||
maven-package:
|
||||
stage: build
|
||||
image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21
|
||||
image: repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21
|
||||
script:
|
||||
- mvn $MAVEN_CLI_OPTS package -DskipTests
|
||||
artifacts:
|
||||
@@ -262,7 +262,7 @@ maven-package:
|
||||
# не выдаёт errors на изменения docs/**.
|
||||
build-docs:
|
||||
stage: build
|
||||
image: repo.nstart.cloud/library/node:20-alpine
|
||||
image: repo.nstart.cloud/dockerhub/library/node:20-alpine
|
||||
before_script:
|
||||
# npm install pnpm — corepack может hang на CI runner integrity checks.
|
||||
- npm install -g --silent pnpm@9.15.4
|
||||
@@ -298,7 +298,7 @@ build-docs:
|
||||
stage: publish
|
||||
image: repo.nstart.cloud/nstart/docker-cli-buildx:1.0.0
|
||||
services:
|
||||
- name: repo.nstart.cloud/library/docker:29.1.2-dind
|
||||
- name: repo.nstart.cloud/dockerhub/library/docker:29.1.2-dind
|
||||
alias: docker
|
||||
command: ["--tls=false"]
|
||||
# docker-builds группа залипла в GitLab Sidekiq после force-cancel зомби
|
||||
@@ -467,7 +467,7 @@ docker-docs:
|
||||
stage: publish
|
||||
image: repo.nstart.cloud/nstart/docker-cli-buildx:1.0.0
|
||||
services:
|
||||
- name: repo.nstart.cloud/library/docker:29.1.2-dind
|
||||
- name: repo.nstart.cloud/dockerhub/library/docker:29.1.2-dind
|
||||
alias: docker
|
||||
command: ["--tls=false"]
|
||||
resource_group: docker-builds-v2
|
||||
@@ -544,7 +544,7 @@ retag-docs:
|
||||
|
||||
resolve-tag:
|
||||
stage: trigger-deploy
|
||||
image: repo.nstart.cloud/library/alpine:3.20
|
||||
image: repo.nstart.cloud/dockerhub/library/alpine:3.20
|
||||
script:
|
||||
- echo "RESOLVED_IMAGE_TAG=$IMAGE_TAG" > resolved.env
|
||||
# DOCS_IMAGE_TAG может быть пустым если docker-docs не пересобирался
|
||||
@@ -624,7 +624,7 @@ release:
|
||||
# Pinned к alpine3.20 (не latest) — Nexus mirror APKINDEX для v3.23
|
||||
# рассинхронизирован с filesystem (claims old version, only newer files exist).
|
||||
# v3.20 mirror consistent, apk add работает. См. ci/apk-update-fix история.
|
||||
image: repo.nstart.cloud/library/node:22-alpine3.20
|
||||
image: repo.nstart.cloud/dockerhub/library/node:22-alpine3.20
|
||||
# Раньше `needs: trigger-deploy-staging` блокировал release когда staging
|
||||
# deploy hang'ался (helm pending-upgrade cascade — каждый retry оставлял
|
||||
# stuck revision, helm wait timeout 15m → rollback → next pipeline стартует
|
||||
@@ -739,7 +739,7 @@ release:
|
||||
# Allow_failure: true — manual deploy backup path остаётся если что.
|
||||
commit-prod-image-bump:
|
||||
stage: release
|
||||
image: repo.nstart.cloud/library/alpine:3.20
|
||||
image: repo.nstart.cloud/dockerhub/library/alpine:3.20
|
||||
needs:
|
||||
# На tag pipeline images приходят через retag-* (не docker-*) после
|
||||
# !205 (ci/retag-on-tag-pipeline). Поэтому needs ссылается на retag-*.
|
||||
|
||||
+2
-2
@@ -2,8 +2,8 @@
|
||||
# Stage 1: build HTML через @diplodoc/cli (yfm).
|
||||
# Stage 2: nginx serving static files на /docs/ path.
|
||||
|
||||
ARG NODE_IMAGE=repo.nstart.cloud/library/node:20-alpine
|
||||
ARG NGINX_IMAGE=repo.nstart.cloud/library/nginx:1.27-alpine
|
||||
ARG NODE_IMAGE=repo.nstart.cloud/dockerhub/library/node:20-alpine
|
||||
ARG NGINX_IMAGE=repo.nstart.cloud/dockerhub/library/nginx:1.27-alpine
|
||||
|
||||
# ─── Stage 1: Build HTML ─────────────────────
|
||||
FROM ${NODE_IMAGE} AS builder
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
FROM repo.nstart.cloud/library/node:22-alpine AS build
|
||||
FROM repo.nstart.cloud/dockerhub/library/node:22-alpine AS build
|
||||
# Build identity для VersionBadge / UpdateBanner. Внутри Docker build context
|
||||
# нет .git/ (BUILD_CONTEXT=ordinis-admin-ui/), vite execSync падает →
|
||||
# fallback "unknown" / package.json. CI передаёт реальные значения через
|
||||
@@ -26,7 +26,7 @@ RUN --mount=type=cache,target=/root/.local/share/pnpm/store pnpm install --froze
|
||||
COPY . .
|
||||
RUN pnpm build
|
||||
|
||||
FROM repo.nstart.cloud/library/nginx:1.27-alpine
|
||||
FROM repo.nstart.cloud/dockerhub/library/nginx:1.27-alpine
|
||||
COPY --from=build /app/dist /usr/share/nginx/html
|
||||
# Шаблон обрабатывается официальным entrypoint nginx-image:
|
||||
# /docker-entrypoint.d/20-envsubst-on-templates.sh пробегает по
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
#
|
||||
# .dockerignore исключает frontend (admin-ui), bench, docs, target/, .git/,
|
||||
# IDE metadata — backend image остаётся компактным.
|
||||
FROM repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21 AS build
|
||||
FROM repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21 AS build
|
||||
# Git info из CI environment (`.gitlab-ci.yml` `--build-arg`) — нужен для
|
||||
# Spring Boot build-info goal через ordinis-app/pom.xml. Внутри Docker
|
||||
# context .git/ исключён (.dockerignore), поэтому git-commit-id-maven-plugin
|
||||
@@ -29,7 +29,7 @@ RUN mvn -B -pl ordinis-app -am package -DskipTests \
|
||||
-Dgit.tags="$GIT_TAG" \
|
||||
-Dgit.commit.time="$GIT_TIME"
|
||||
|
||||
FROM repo.nstart.cloud/library/eclipse-temurin:21-jre
|
||||
FROM repo.nstart.cloud/dockerhub/library/eclipse-temurin:21-jre
|
||||
# Non-root user — security hardening (CSO report 2026-05-27 finding #1).
|
||||
# Eclipse-temurin runtime image не задаёт USER by default → JVM от root.
|
||||
# Compromise через Spring Boot CVE / Jackson deserialization без USER
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
# Liquibase migration image — запускается Helm pre-upgrade Job (1-shot, без Spring Boot)
|
||||
FROM repo.nstart.cloud/liquibase/liquibase:4.27.0
|
||||
FROM repo.nstart.cloud/dockerhub/liquibase/liquibase:4.27.0
|
||||
|
||||
USER root
|
||||
COPY src/main/resources/db/changelog /liquibase/changelog
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
# Multi-stage build для ordinis-projection-writer. См. ordinis-app/Dockerfile
|
||||
# для rationale `COPY . ./` + `.dockerignore` подхода (single-rule,
|
||||
# future-proof на новые Maven modules).
|
||||
FROM repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21 AS build
|
||||
FROM repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21 AS build
|
||||
WORKDIR /build
|
||||
COPY . ./
|
||||
RUN mvn -B -pl ordinis-projection-writer -am package -DskipTests
|
||||
|
||||
FROM repo.nstart.cloud/library/eclipse-temurin:21-jre
|
||||
FROM repo.nstart.cloud/dockerhub/library/eclipse-temurin:21-jre
|
||||
# Non-root user — security hardening (CSO report 2026-05-27 finding #1).
|
||||
# См. ordinis-app/Dockerfile для rationale.
|
||||
RUN groupadd -r -g 10001 app && useradd -r -u 10001 -g app -s /sbin/nologin app
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
# Multi-stage build для ordinis-read-api. См. ordinis-app/Dockerfile для
|
||||
# rationale `COPY . ./` + `.dockerignore` подхода (single-rule, future-proof
|
||||
# на новые Maven modules).
|
||||
FROM repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21 AS build
|
||||
FROM repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21 AS build
|
||||
WORKDIR /build
|
||||
COPY . ./
|
||||
RUN mvn -B -pl ordinis-read-api -am package -DskipTests
|
||||
|
||||
FROM repo.nstart.cloud/library/eclipse-temurin:21-jre
|
||||
FROM repo.nstart.cloud/dockerhub/library/eclipse-temurin:21-jre
|
||||
# Non-root user — security hardening (CSO report 2026-05-27 finding #1).
|
||||
# См. ordinis-app/Dockerfile для rationale (compromise → root в контейнере
|
||||
# = escalation surface на ноду). UID 10001 outside system+distro reserved.
|
||||
|
||||
Reference in New Issue
Block a user