From 9a79b53eb06cedf1761433d07c5e3b8c2b0ee22d Mon Sep 17 00:00:00 2001
From: "Zimin A.N." <snaiperlfc@gmail.com>
Date: Sun, 3 May 2026 18:16:21 +0300
Subject: [PATCH] =?UTF-8?q?ci:=20align=20=D1=81=20altum=20pattern=20?=
 =?UTF-8?q?=E2=80=94=20runner=20mirror'=D0=B8=D1=82=20Docker=20Hub?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Убраны префиксы repo.nstart.cloud/ — runner config (DOCKER_AUTH_CONFIG)
  обрабатывает pull из Docker Hub mirror автоматически
- DinD сервис: alias=docker, --tls=false, DOCKER_HOST=tcp://docker:2375
  (proven pattern из altum/.gitlab/ci/docker.yml)
- IMAGE_TAG = ref-slug + sha (как у altum)
- BUILDKIT_INLINE_CACHE=1 для cache-from optimization
- Dockerfiles: FROM maven/eclipse-temurin/liquibase без префиксов
---
 .gitlab-ci.yml                       | 105 +++++++++++++--------------
 ordinis-app/Dockerfile               |   4 +-
 ordinis-migrations/Dockerfile        |   2 +-
 ordinis-projection-writer/Dockerfile |   4 +-
 ordinis-read-api/Dockerfile          |   4 +-
 5 files changed, 59 insertions(+), 60 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index d4ba64e..3c9b5bc 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,5 +1,9 @@
+# =============================================================
 # Ordinis — build & push images.
-# Helm deploy живёт в terravault/ordinis-infra (downstream pipeline).
+# Runner mirror'ит Docker Hub (DOCKER_AUTH_CONFIG в runner config),
+# поэтому image: maven:... работает напрямую.
+# Internal registry registry.k8s.265.nstart.local — без auth.
+# =============================================================
 
 stages:
   - test
@@ -10,9 +14,10 @@ stages:
 variables:
   MAVEN_OPTS: "-Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
   MAVEN_CLI_OPTS: "-B -ntp --batch-mode"
-  IMAGE_TAG: $CI_COMMIT_SHORT_SHA
-  REGISTRY: registry.k8s.265.nstart.local
+  IMAGE_TAG: $CI_COMMIT_REF_SLUG-$CI_COMMIT_SHORT_SHA
+  INTERNAL_REGISTRY: registry.k8s.265.nstart.local
   IMAGE_REPO: terravault
+  DOCKER_BUILDKIT: "1"
 
 cache:
   key:
@@ -20,10 +25,10 @@ cache:
   paths:
     - .m2/repository
 
-# ---- TEST stage ----
+# ─── TEST ──────────────────────────────────────
 maven-test:
   stage: test
-  image: repo.nstart.cloud/maven:3.9.9-eclipse-temurin-21
+  image: maven:3.9.9-eclipse-temurin-21
   script:
     - mvn $MAVEN_CLI_OPTS verify
   artifacts:
@@ -32,66 +37,72 @@ maven-test:
       junit: '**/target/surefire-reports/TEST-*.xml'
     expire_in: 1 week
 
-# ---- BUILD stage (один общий mvn package для всех 4 jar'ов) ----
+# ─── BUILD (Maven jars) ────────────────────────
 maven-package:
   stage: build
-  image: repo.nstart.cloud/maven:3.9.9-eclipse-temurin-21
+  image: maven:3.9.9-eclipse-temurin-21
   script:
     - mvn $MAVEN_CLI_OPTS package -DskipTests
   artifacts:
     paths:
-      - ordinis-app/target/*.jar
-      - ordinis-read-api/target/*.jar
-      - ordinis-projection-writer/target/*.jar
-      - ordinis-migrations/target/*.jar
+      - "**/target/*.jar"
       - ordinis-migrations/src/main/resources/db/changelog/**
     expire_in: 1 day
 
-# ---- PUBLISH stage (4 image параллельно) ----
-.docker-image-template: &docker-image
+# ─── PUBLISH (Docker images) ───────────────────
+.docker_base: &docker_base
   stage: publish
-  image: repo.nstart.cloud/docker:27
-  services: ["repo.nstart.cloud/docker:27-dind"]
+  image: docker:26
+  services:
+    - name: docker:26-dind
+      alias: docker
+      command: ["--tls=false"]
   variables:
-    DOCKER_TLS_CERTDIR: "/certs"
-    # registry.k8s.265.nstart.local — internal insecure HTTP registry, без auth
-    DOCKER_OPTS: "--insecure-registry=registry.k8s.265.nstart.local"
-  before_script:
-    # Если REGISTRY_USER/PASSWORD заданы — login. Иначе registry без auth (default для internal)
-    - |
-      if [ -n "$REGISTRY_USER" ] && [ -n "$REGISTRY_PASSWORD" ]; then
-        echo "$REGISTRY_PASSWORD" | docker login $REGISTRY -u "$REGISTRY_USER" --password-stdin
-      fi
+    DOCKER_HOST: tcp://docker:2375
+    DOCKER_TLS_CERTDIR: ""
+    DOCKER_BUILDKIT: "1"
 
 docker-app:
-  <<: *docker-image
-  script:
-    - docker build -f ordinis-app/Dockerfile -t $REGISTRY/$IMAGE_REPO/ordinis-app:$IMAGE_TAG -t $REGISTRY/$IMAGE_REPO/ordinis-app:$CI_COMMIT_REF_SLUG .
-    - docker push $REGISTRY/$IMAGE_REPO/ordinis-app --all-tags
+  <<: *docker_base
   needs: [maven-package]
+  script:
+    - IMG=$INTERNAL_REGISTRY/$IMAGE_REPO/ordinis-app
+    - docker build -f ordinis-app/Dockerfile -t $IMG:$IMAGE_TAG -t $IMG:latest -t $IMG:$CI_COMMIT_REF_SLUG --build-arg BUILDKIT_INLINE_CACHE=1 .
+    - docker push $IMG:$IMAGE_TAG
+    - docker push $IMG:latest
+    - docker push $IMG:$CI_COMMIT_REF_SLUG
 
 docker-read-api:
-  <<: *docker-image
-  script:
-    - docker build -f ordinis-read-api/Dockerfile -t $REGISTRY/$IMAGE_REPO/ordinis-read-api:$IMAGE_TAG -t $REGISTRY/$IMAGE_REPO/ordinis-read-api:$CI_COMMIT_REF_SLUG .
-    - docker push $REGISTRY/$IMAGE_REPO/ordinis-read-api --all-tags
+  <<: *docker_base
   needs: [maven-package]
+  script:
+    - IMG=$INTERNAL_REGISTRY/$IMAGE_REPO/ordinis-read-api
+    - docker build -f ordinis-read-api/Dockerfile -t $IMG:$IMAGE_TAG -t $IMG:latest -t $IMG:$CI_COMMIT_REF_SLUG --build-arg BUILDKIT_INLINE_CACHE=1 .
+    - docker push $IMG:$IMAGE_TAG
+    - docker push $IMG:latest
+    - docker push $IMG:$CI_COMMIT_REF_SLUG
 
 docker-projection-writer:
-  <<: *docker-image
-  script:
-    - docker build -f ordinis-projection-writer/Dockerfile -t $REGISTRY/$IMAGE_REPO/ordinis-projection-writer:$IMAGE_TAG -t $REGISTRY/$IMAGE_REPO/ordinis-projection-writer:$CI_COMMIT_REF_SLUG .
-    - docker push $REGISTRY/$IMAGE_REPO/ordinis-projection-writer --all-tags
+  <<: *docker_base
   needs: [maven-package]
+  script:
+    - IMG=$INTERNAL_REGISTRY/$IMAGE_REPO/ordinis-projection-writer
+    - docker build -f ordinis-projection-writer/Dockerfile -t $IMG:$IMAGE_TAG -t $IMG:latest -t $IMG:$CI_COMMIT_REF_SLUG --build-arg BUILDKIT_INLINE_CACHE=1 .
+    - docker push $IMG:$IMAGE_TAG
+    - docker push $IMG:latest
+    - docker push $IMG:$CI_COMMIT_REF_SLUG
 
 docker-migrations:
-  <<: *docker-image
-  script:
-    - docker build -f ordinis-migrations/Dockerfile -t $REGISTRY/$IMAGE_REPO/ordinis-migrations:$IMAGE_TAG -t $REGISTRY/$IMAGE_REPO/ordinis-migrations:$CI_COMMIT_REF_SLUG ordinis-migrations/
-    - docker push $REGISTRY/$IMAGE_REPO/ordinis-migrations --all-tags
+  <<: *docker_base
   needs: [maven-package]
+  script:
+    - IMG=$INTERNAL_REGISTRY/$IMAGE_REPO/ordinis-migrations
+    - docker build -f ordinis-migrations/Dockerfile -t $IMG:$IMAGE_TAG -t $IMG:latest -t $IMG:$CI_COMMIT_REF_SLUG ordinis-migrations/
+    - docker push $IMG:$IMAGE_TAG
+    - docker push $IMG:latest
+    - docker push $IMG:$CI_COMMIT_REF_SLUG
 
-# ---- TRIGGER DEPLOY: запускает downstream pipeline в ordinis-infra ----
+# ─── TRIGGER DEPLOY (downstream pipeline) ──────
 trigger-deploy-dev:
   stage: trigger-deploy
   trigger:
@@ -104,18 +115,6 @@ trigger-deploy-dev:
   rules:
     - if: '$CI_COMMIT_BRANCH == "main"'
 
-trigger-deploy-staging:
-  stage: trigger-deploy
-  trigger:
-    project: 2-6/2-6-4/terravault/ordinis-infra
-    branch: main
-    strategy: depend
-  variables:
-    UPSTREAM_IMAGE_TAG: $IMAGE_TAG
-    DEPLOY_ENV: staging
-  rules:
-    - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+-rc.*/'
-
 trigger-deploy-prod:
   stage: trigger-deploy
   trigger:
diff --git a/ordinis-app/Dockerfile b/ordinis-app/Dockerfile
index 1b80fdb..a1fa1ae 100644
--- a/ordinis-app/Dockerfile
+++ b/ordinis-app/Dockerfile
@@ -1,5 +1,5 @@
 # Multi-stage build для ordinis-app
-FROM repo.nstart.cloud/maven:3.9.9-eclipse-temurin-21 AS build
+FROM maven:3.9.9-eclipse-temurin-21 AS build
 WORKDIR /build
 COPY pom.xml ./
 COPY ordinis-domain ./ordinis-domain
@@ -14,7 +14,7 @@ COPY ordinis-migrations ./ordinis-migrations
 COPY ordinis-app ./ordinis-app
 RUN mvn -B -pl ordinis-app -am package -DskipTests
 
-FROM repo.nstart.cloud/eclipse-temurin:21-jre
+FROM eclipse-temurin:21-jre
 WORKDIR /app
 COPY --from=build /build/ordinis-app/target/*.jar /app/app.jar
 EXPOSE 8080
diff --git a/ordinis-migrations/Dockerfile b/ordinis-migrations/Dockerfile
index b19e765..ec856a2 100644
--- a/ordinis-migrations/Dockerfile
+++ b/ordinis-migrations/Dockerfile
@@ -1,5 +1,5 @@
 # Liquibase migration image — запускается Helm pre-upgrade Job (1-shot, без Spring Boot)
-FROM repo.nstart.cloud/liquibase/liquibase:4.27.0
+FROM liquibase/liquibase:4.27.0
 
 USER root
 COPY src/main/resources/db/changelog /liquibase/changelog
diff --git a/ordinis-projection-writer/Dockerfile b/ordinis-projection-writer/Dockerfile
index b726d47..8450175 100644
--- a/ordinis-projection-writer/Dockerfile
+++ b/ordinis-projection-writer/Dockerfile
@@ -1,4 +1,4 @@
-FROM repo.nstart.cloud/maven:3.9.9-eclipse-temurin-21 AS build
+FROM maven:3.9.9-eclipse-temurin-21 AS build
 WORKDIR /build
 COPY pom.xml ./
 COPY ordinis-domain ./ordinis-domain
@@ -13,7 +13,7 @@ COPY ordinis-migrations ./ordinis-migrations
 COPY ordinis-projection-writer ./ordinis-projection-writer
 RUN mvn -B -pl ordinis-projection-writer -am package -DskipTests
 
-FROM repo.nstart.cloud/eclipse-temurin:21-jre
+FROM eclipse-temurin:21-jre
 WORKDIR /app
 COPY --from=build /build/ordinis-projection-writer/target/*.jar /app/app.jar
 EXPOSE 8082
diff --git a/ordinis-read-api/Dockerfile b/ordinis-read-api/Dockerfile
index 7915d08..eacd80c 100644
--- a/ordinis-read-api/Dockerfile
+++ b/ordinis-read-api/Dockerfile
@@ -1,4 +1,4 @@
-FROM repo.nstart.cloud/maven:3.9.9-eclipse-temurin-21 AS build
+FROM maven:3.9.9-eclipse-temurin-21 AS build
 WORKDIR /build
 COPY pom.xml ./
 COPY ordinis-domain ./ordinis-domain
@@ -13,7 +13,7 @@ COPY ordinis-migrations ./ordinis-migrations
 COPY ordinis-read-api ./ordinis-read-api
 RUN mvn -B -pl ordinis-read-api -am package -DskipTests
 
-FROM repo.nstart.cloud/eclipse-temurin:21-jre
+FROM eclipse-temurin:21-jre
 WORKDIR /app
 COPY --from=build /build/ordinis-read-api/target/*.jar /app/app.jar
 EXPOSE 8081