Zimin A.N.
7c06cf7f71
Runners в кластере не имеют network access к Docker Hub. Заменили все base images: - maven:3.9.9-eclipse-temurin-21 → repo.nstart.cloud/maven:... - eclipse-temurin:21-jre → repo.nstart.cloud/eclipse-temurin:21-jre - liquibase/liquibase:4.27.0 → repo.nstart.cloud/liquibase/... - docker:27 / docker:27-dind → repo.nstart.cloud/docker:...
131 lines
4.1 KiB
YAML
131 lines
4.1 KiB
YAML
# Ordinis — build & push images.
|
|
# Helm deploy живёт в terravault/ordinis-infra (downstream pipeline).
|
|
|
|
stages:
|
|
- test
|
|
- build
|
|
- publish
|
|
- trigger-deploy
|
|
|
|
variables:
|
|
MAVEN_OPTS: "-Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
|
|
MAVEN_CLI_OPTS: "-B -ntp --batch-mode"
|
|
IMAGE_TAG: $CI_COMMIT_SHORT_SHA
|
|
REGISTRY: registry.k8s.265.nstart.local
|
|
IMAGE_REPO: terravault
|
|
|
|
cache:
|
|
key:
|
|
files: ["pom.xml"]
|
|
paths:
|
|
- .m2/repository
|
|
|
|
# ---- TEST stage ----
|
|
maven-test:
|
|
stage: test
|
|
image: repo.nstart.cloud/maven:3.9.9-eclipse-temurin-21
|
|
script:
|
|
- mvn $MAVEN_CLI_OPTS verify
|
|
artifacts:
|
|
when: always
|
|
reports:
|
|
junit: '**/target/surefire-reports/TEST-*.xml'
|
|
expire_in: 1 week
|
|
|
|
# ---- BUILD stage (один общий mvn package для всех 4 jar'ов) ----
|
|
maven-package:
|
|
stage: build
|
|
image: repo.nstart.cloud/maven:3.9.9-eclipse-temurin-21
|
|
script:
|
|
- mvn $MAVEN_CLI_OPTS package -DskipTests
|
|
artifacts:
|
|
paths:
|
|
- ordinis-app/target/*.jar
|
|
- ordinis-read-api/target/*.jar
|
|
- ordinis-projection-writer/target/*.jar
|
|
- ordinis-migrations/target/*.jar
|
|
- ordinis-migrations/src/main/resources/db/changelog/**
|
|
expire_in: 1 day
|
|
|
|
# ---- PUBLISH stage (4 image параллельно) ----
|
|
.docker-image-template: &docker-image
|
|
stage: publish
|
|
image: repo.nstart.cloud/docker:27
|
|
services: ["repo.nstart.cloud/docker:27-dind"]
|
|
variables:
|
|
DOCKER_TLS_CERTDIR: "/certs"
|
|
# registry.k8s.265.nstart.local — internal insecure HTTP registry, без auth
|
|
DOCKER_OPTS: "--insecure-registry=registry.k8s.265.nstart.local"
|
|
before_script:
|
|
# Если REGISTRY_USER/PASSWORD заданы — login. Иначе registry без auth (default для internal)
|
|
- |
|
|
if [ -n "$REGISTRY_USER" ] && [ -n "$REGISTRY_PASSWORD" ]; then
|
|
echo "$REGISTRY_PASSWORD" | docker login $REGISTRY -u "$REGISTRY_USER" --password-stdin
|
|
fi
|
|
|
|
docker-app:
|
|
<<: *docker-image
|
|
script:
|
|
- docker build -f ordinis-app/Dockerfile -t $REGISTRY/$IMAGE_REPO/ordinis-app:$IMAGE_TAG -t $REGISTRY/$IMAGE_REPO/ordinis-app:$CI_COMMIT_REF_SLUG .
|
|
- docker push $REGISTRY/$IMAGE_REPO/ordinis-app --all-tags
|
|
needs: [maven-package]
|
|
|
|
docker-read-api:
|
|
<<: *docker-image
|
|
script:
|
|
- docker build -f ordinis-read-api/Dockerfile -t $REGISTRY/$IMAGE_REPO/ordinis-read-api:$IMAGE_TAG -t $REGISTRY/$IMAGE_REPO/ordinis-read-api:$CI_COMMIT_REF_SLUG .
|
|
- docker push $REGISTRY/$IMAGE_REPO/ordinis-read-api --all-tags
|
|
needs: [maven-package]
|
|
|
|
docker-projection-writer:
|
|
<<: *docker-image
|
|
script:
|
|
- docker build -f ordinis-projection-writer/Dockerfile -t $REGISTRY/$IMAGE_REPO/ordinis-projection-writer:$IMAGE_TAG -t $REGISTRY/$IMAGE_REPO/ordinis-projection-writer:$CI_COMMIT_REF_SLUG .
|
|
- docker push $REGISTRY/$IMAGE_REPO/ordinis-projection-writer --all-tags
|
|
needs: [maven-package]
|
|
|
|
docker-migrations:
|
|
<<: *docker-image
|
|
script:
|
|
- docker build -f ordinis-migrations/Dockerfile -t $REGISTRY/$IMAGE_REPO/ordinis-migrations:$IMAGE_TAG -t $REGISTRY/$IMAGE_REPO/ordinis-migrations:$CI_COMMIT_REF_SLUG ordinis-migrations/
|
|
- docker push $REGISTRY/$IMAGE_REPO/ordinis-migrations --all-tags
|
|
needs: [maven-package]
|
|
|
|
# ---- TRIGGER DEPLOY: запускает downstream pipeline в ordinis-infra ----
|
|
trigger-deploy-dev:
|
|
stage: trigger-deploy
|
|
trigger:
|
|
project: 2-6/2-6-4/terravault/ordinis-infra
|
|
branch: main
|
|
strategy: depend
|
|
variables:
|
|
UPSTREAM_IMAGE_TAG: $IMAGE_TAG
|
|
DEPLOY_ENV: dev
|
|
rules:
|
|
- if: '$CI_COMMIT_BRANCH == "main"'
|
|
|
|
trigger-deploy-staging:
|
|
stage: trigger-deploy
|
|
trigger:
|
|
project: 2-6/2-6-4/terravault/ordinis-infra
|
|
branch: main
|
|
strategy: depend
|
|
variables:
|
|
UPSTREAM_IMAGE_TAG: $IMAGE_TAG
|
|
DEPLOY_ENV: staging
|
|
rules:
|
|
- if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+-rc.*/'
|
|
|
|
trigger-deploy-prod:
|
|
stage: trigger-deploy
|
|
trigger:
|
|
project: 2-6/2-6-4/terravault/ordinis-infra
|
|
branch: main
|
|
strategy: depend
|
|
variables:
|
|
UPSTREAM_IMAGE_TAG: $IMAGE_TAG
|
|
DEPLOY_ENV: prod
|
|
rules:
|
|
- if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/'
|
|
when: manual
|