Sprint 0 / #17: CI-пайплайн с гейтами (lint, unit+coverage>=70%, security, build, image-scan, push) #60

Merged
embeddevio merged 8 commits from feat/17-ci into main 2026-10-29 21:09:27 +03:00

8 Commits

Author SHA1 Message Date
embeddevio 0f2a646df2 Merge branch 'main' into feat/17-ci
ci / lint (push) Successful in 41s
ci / lint (pull_request) Successful in 43s
contract-openapi / openapi-contract (push) Successful in 55s
contract-openapi / ts-client-is-current (push) Successful in 46s
contract-openapi / openapi-contract (pull_request) Successful in 53s
contract-openapi / ts-client-is-current (pull_request) Successful in 40s
ci / unit (push) Successful in 48s
ci / security (push) Successful in 1m16s
ci / unit (pull_request) Successful in 46s
ci / security (pull_request) Successful in 1m20s
ci / build (push) Has been skipped
ci / image-scan (push) Has been skipped
ci / build (pull_request) Has been skipped
ci / push (push) Has been skipped
ci / image-scan (pull_request) Has been skipped
ci / push (pull_request) Has been skipped
2026-10-29 20:58:45 +03:00
embeddevio 80b33d5132 docs(ci): дефекты 6.4 (артефакты, #62) и 6.5 (contract-openapi checkout, #59)
ci / lint (push) Successful in 47s
ci / lint (pull_request) Successful in 1m29s
contract-openapi / openapi-contract (push) Failing after 35s
contract-openapi / ts-client-is-current (push) Failing after 35s
contract-openapi / openapi-contract (pull_request) Failing after 33s
contract-openapi / ts-client-is-current (pull_request) Failing after 36s
ci / unit (push) Successful in 57s
ci / security (push) Successful in 7m12s
ci / unit (pull_request) Successful in 46s
ci / security (pull_request) Successful in 4m25s
ci / build (push) Has been skipped
ci / image-scan (push) Has been skipped
ci / build (pull_request) Has been skipped
ci / push (push) Has been skipped
ci / image-scan (pull_request) Has been skipped
ci / push (pull_request) Has been skipped
Refs #17, Refs #59, Refs #62
2026-10-28 23:40:43 +03:00
embeddevio bbe0886342 docs(ci): runbook пайплайна и отчёт проверки runner'а (#17)
ci / lint (push) Successful in 42s
contract-openapi / openapi-contract (push) Failing after 48s
contract-openapi / ts-client-is-current (push) Failing after 50s
ci / lint (pull_request) Successful in 42s
contract-openapi / openapi-contract (pull_request) Failing after 40s
contract-openapi / ts-client-is-current (pull_request) Failing after 28s
ci / unit (push) Successful in 49s
ci / security (push) Successful in 3m10s
ci / unit (pull_request) Successful in 48s
ci / security (pull_request) Successful in 2m22s
ci / build (push) Has been skipped
ci / image-scan (push) Has been skipped
ci / build (pull_request) Has been skipped
ci / push (push) Has been skipped
ci / image-scan (pull_request) Has been skipped
ci / push (pull_request) Has been skipped
Refs #17, Refs #15
2026-10-28 23:12:17 +03:00
embeddevio aac82e6d23 ci: токен для registry — secret REGISTRY_TOKEN с fallback на GITHUB_TOKEN
ci / lint (push) Successful in 48s
contract-openapi / openapi-contract (push) Failing after 38s
contract-openapi / ts-client-is-current (push) Failing after 33s
ci / unit (push) Successful in 56s
ci / security (push) Successful in 1m8s
ci / build (push) Has been skipped
ci / image-scan (push) Has been skipped
ci / push (push) Has been skipped
Refs #17
2026-10-28 22:32:41 +03:00
embeddevio 336df50ca0 ci: trivy через образ aquasec/trivy (сокет) + кэш БД на хосте; бинарь через github releases качается слишком медленно
ci / lint (push) Successful in 53s
contract-openapi / openapi-contract (push) Failing after 35s
contract-openapi / ts-client-is-current (push) Failing after 36s
ci / unit (push) Successful in 47s
ci / security (push) Successful in 1m23s
ci / build (push) Has been skipped
ci / image-scan (push) Has been skipped
ci / push (push) Has been skipped
Refs #17
2026-10-28 22:31:45 +03:00
embeddevio 88bdaf7d3a ci: trivy ставим из релизного tarball (install.sh + v0.57.1 → 404), версия 0.76.1
ci / lint (push) Successful in 46s
contract-openapi / openapi-contract (push) Failing after 35s
contract-openapi / ts-client-is-current (push) Failing after 32s
ci / unit (push) Successful in 56s
ci / security (push) Successful in 1m13s
ci / build (push) Has been skipped
ci / image-scan (push) Has been skipped
ci / push (push) Has been skipped
Refs #17
2026-10-28 22:21:04 +03:00
embeddevio a941525f2e ci: тесты требуют requirements-contract.txt; явный guard на отсутствие deploy/Dockerfile
ci / lint (push) Successful in 42s
contract-openapi / openapi-contract (push) Failing after 41s
contract-openapi / ts-client-is-current (push) Failing after 31s
ci / unit (push) Successful in 41s
ci / security (push) Successful in 1m19s
ci / build (push) Has been skipped
ci / image-scan (push) Has been skipped
ci / push (push) Has been skipped
Refs #17
2026-10-28 22:01:14 +03:00
embeddevio b13f5e8ac5 ci: пайплайн с гейтами (lint, unit+coverage>=70%, security, build, image-scan, push staging-<sha>)
contract-openapi / openapi-contract (push) Failing after 0s
contract-openapi / ts-client-is-current (push) Failing after 1s
ci / lint (push) Successful in 7m38s
ci / unit (push) Failing after 1m3s
ci / security (push) Successful in 2m19s
ci / build (push) Has been skipped
ci / image-scan (push) Has been skipped
ci / push (push) Has been skipped
Refs #17, Refs #15

- lint: ruff check/format + mypy strict
- unit: pytest с --cov-fail-under=70, артефакты coverage.xml + htmlcov
- security: bandit -lll (HIGH) + pip-audit, артефакты bandit/pip-audit
- build: docker build deploy/Dockerfile -> staging-<sha> (активируется после merge #18)
- image-scan: trivy HIGH/CRITICAL --exit-code 1
- push: docker login + push в registry 192.168.1.111:3000

Обход дефекта Gitea git-http (upload-pack отдаёт пустой pack): fallback
на archive/<sha>.tar.gz, actions/checkout остаётся основным путём.
2026-10-28 21:47:05 +03:00