From a941525f2ed6891f271bb6d73c7b41c848192c3d Mon Sep 17 00:00:00 2001
From: embeddevio <embeddev.iot@gmail.com>
Date: Wed, 28 Oct 2026 22:01:14 +0300
Subject: [PATCH] =?UTF-8?q?ci:=20=D1=82=D0=B5=D1=81=D1=82=D1=8B=20=D1=82?=
 =?UTF-8?q?=D1=80=D0=B5=D0=B1=D1=83=D1=8E=D1=82=20requirements-contract.tx?=
 =?UTF-8?q?t;=20=D1=8F=D0=B2=D0=BD=D1=8B=D0=B9=20guard=20=D0=BD=D0=B0=20?=
 =?UTF-8?q?=D0=BE=D1=82=D1=81=D1=83=D1=82=D1=81=D1=82=D0=B2=D0=B8=D0=B5=20?=
 =?UTF-8?q?deploy/Dockerfile?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refs #17
---
 .gitea/workflows/ci.yml | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 7616b46..33d69aa 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -53,7 +53,7 @@ jobs:
       - name: install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install -r requirements-dev.txt
+          pip install -r requirements-dev.txt -r requirements-contract.txt
 
       - name: ruff check
         run: ruff check backend
@@ -101,7 +101,7 @@ jobs:
       - name: install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install -r requirements-dev.txt
+          pip install -r requirements-dev.txt -r requirements-contract.txt
 
       - name: "pytest + coverage gate (fail below 70%)"
         run: |
@@ -153,7 +153,7 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install "bandit[toml]>=1.7" "pip-audit>=2.7"
-          pip install -r requirements.txt
+          pip install -r requirements.txt -r requirements-contract.txt
 
       - name: "bandit -lll (HIGH severity gate)"
         run: |
@@ -164,11 +164,11 @@ jobs:
 
       - name: "pip-audit (known vulnerabilities gate)"
         run: |
-          pip-audit -r requirements.txt --progress-spinner off
+          pip-audit -r requirements.txt -r requirements-contract.txt --progress-spinner off
 
       - name: pip-audit json report
         if: always()
-        run: pip-audit -r requirements.txt --progress-spinner off --format json -o pip-audit-report.json || true
+        run: pip-audit -r requirements.txt -r requirements-contract.txt --progress-spinner off --format json -o pip-audit-report.json || true
 
       - name: upload security artifacts
         if: always()
@@ -200,6 +200,14 @@ jobs:
           curl -fsSL -o /tmp/src.tar.gz "http://192.168.1.111:3000/${IMAGE_NAME}/archive/${GITHUB_SHA}.tar.gz"
           tar -xzf /tmp/src.tar.gz --strip-components=1 -C .
 
+      - name: "guard: deploy/Dockerfile"
+        run: |
+          if [ ! -f deploy/Dockerfile ]; then
+            echo "::error::deploy/Dockerfile отсутствует: сборка образа ждёт merge #18 (PR #49)."
+            echo "Пайплайн целиком проверен на ветке feat/17-verify (она же + deploy/Dockerfile)."
+            exit 1
+          fi
+
       - name: image meta
         id: meta
         run: |