feat(backend): build identity в health, VERSION bake и auto stage по sha-*

.gitea/workflows/ci.yml

@@ -54,11 +54,17 @@ jobs:
       - name: Build eventhub image
         run: |
           set -euo pipefail
+          APP_VERSION="$(tr -d '[:space:]' < VERSION 2>/dev/null || echo 0.0)"
+          GIT_SHA="${GITHUB_SHA:0:12}"
+          BUILT_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
           bash scripts/retry-docker-build.sh 5 60 -- \
             docker buildx build \
               --network=host \
               --pull \
               --file docker/Dockerfile \
+              --build-arg "EVENTHUB_VERSION=${APP_VERSION}" \
+              --build-arg "EVENTHUB_GIT_SHA=${GIT_SHA}" \
+              --build-arg "EVENTHUB_BUILT_AT=${BUILT_AT}" \
               --tag eventhub:latest \
               --load \
               --provenance=false \

.gitea/workflows/deploy-stage.yml

@@ -1,40 +1,45 @@
 name: Deploy stage (core)
 
+# Auto после успешного CI на master: тот же sha-*, плюс floating :stage.
 on:
-  push:
-    tags:
-      - 'v*'
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [master, main]
   workflow_dispatch:
-    inputs:
-      release_tag:
-        description: 'Release tag (например v0.1.1)'
-        required: true
-        default: 'v0.1.1'
-      sha_tag:
-        description: 'Образ sha-* (например sha-3f5dde498652)'
-        required: true
-        default: 'sha-3f5dde498652'
+
+concurrency:
+  group: eventhub-back-deploy-stage
+  cancel-in-progress: false
 
 env:
   REGISTRY: git.sabilin.com/eventhub
+  BUILDKIT_PROGRESS: quiet
+  DOCKER_BUILDKIT: 1
 
 jobs:
   deploy-stage-core:
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
     runs-on: ubuntu-latest
+    timeout-minutes: 90
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
+          fetch-depth: 2
 
-      - name: Compute image tags
+      - name: Compute image tag
         id: meta
         run: |
           set -euo pipefail
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            echo "sha_tag=${{ github.event.inputs.sha_tag }}" >> "$GITHUB_OUTPUT"
-            echo "release_tag=${{ github.event.inputs.release_tag }}" >> "$GITHUB_OUTPUT"
+          if [ "${{ github.event_name }}" = "workflow_run" ]; then
+            SHA="${{ github.event.workflow_run.head_sha }}"
           else
-            echo "sha_tag=sha-${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
-            echo "release_tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
+            SHA="${GITHUB_SHA}"
           fi
+          echo "tag=sha-${SHA:0:12}" >> "$GITHUB_OUTPUT"
 
       - name: Wait for Docker daemon
         run: bash scripts/ensure-docker-daemon.sh 240
@@ -49,14 +54,24 @@ jobs:
           username: ${{ secrets.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
-      - name: Promote images (no rebuild)
+      - name: Verify core image from CI
+        run: |
+          set -euo pipefail
+          TAG="${{ steps.meta.outputs.tag }}"
+          if ! docker buildx imagetools inspect "${REGISTRY}/eventhub:${TAG}" >/dev/null 2>&1; then
+            echo "Образ eventhub:${TAG} не найден — CI push не завершился."
+            exit 1
+          fi
+          echo "OK: eventhub:${TAG}"
+
+      - name: Promote sha → :stage (no rebuild)
         env:
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
           bash scripts/clone-devops-run.sh scripts/promote-images.sh \
-            "${{ steps.meta.outputs.sha_tag }}" \
-            "${{ steps.meta.outputs.release_tag }}" \
+            "${{ steps.meta.outputs.tag }}" \
+            "${{ steps.meta.outputs.tag }}" \
             stage \
             eventhub traefik-coraza fallback bot-emulator-users observer-web logrotate
 
@@ -69,7 +84,7 @@ jobs:
           script: |
             export REGISTRY_USER='${{ secrets.REGISTRY_USER }}'
             export REGISTRY_PASSWORD='${{ secrets.REGISTRY_PASSWORD }}'
-            bash /opt/eventhub-stage/devops/scripts/deploy-service.sh stage core ${{ steps.meta.outputs.release_tag }}
+            bash /opt/eventhub-stage/devops/scripts/deploy-service.sh stage core ${{ steps.meta.outputs.tag }}
 
       - name: Prune old registry images
         continue-on-error: true