From 3b6c20ac34f27b3dac9ec6c0bd82293a87739bc2 Mon Sep 17 00:00:00 2001
From: Aleksey Sabilin <aleksey@sabilin.com>
Date: Sat, 11 Jul 2026 15:41:35 +0300
Subject: [PATCH] Co-authored-by:

---
 .gitea/workflows/deploy-stage.yml | 34 +++++++----------------------
 scripts/run-promote-images.sh     | 36 +++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 26 deletions(-)
 create mode 100644 scripts/run-promote-images.sh

diff --git a/.gitea/workflows/deploy-stage.yml b/.gitea/workflows/deploy-stage.yml
index 99a8b62..f707af9 100644
--- a/.gitea/workflows/deploy-stage.yml
+++ b/.gitea/workflows/deploy-stage.yml
@@ -35,33 +35,15 @@ jobs:
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Promote images (no rebuild)
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
-          set -euo pipefail
-          SHA="${{ steps.meta.outputs.sha_tag }}"
-          REL="${{ steps.meta.outputs.release_tag }}"
-          IMAGES="eventhub traefik-coraza fallback bot-emulator-users observer-web logrotate"
-          missing=""
-          for img in ${IMAGES}; do
-            if ! docker buildx imagetools inspect "${REGISTRY}/${img}:${SHA}" >/dev/null 2>&1; then
-              missing="${missing} ${img}"
-            fi
-          done
-          if [[ -n "${missing}" ]]; then
-            echo "Образы sha:${SHA} не найдены:${missing}"
-            echo "Сначала прогоните IFT deploy для этого коммита (push в master)."
-            exit 1
-          fi
-          for img in ${IMAGES}; do
-            if docker buildx imagetools inspect "${REGISTRY}/${img}:stage" >/dev/null 2>&1; then
-              docker buildx imagetools create \
-                -t "${REGISTRY}/${img}:stage-previous" \
-                "${REGISTRY}/${img}:stage"
-            fi
-            docker buildx imagetools create \
-              -t "${REGISTRY}/${img}:${REL}" \
-              -t "${REGISTRY}/${img}:stage" \
-              "${REGISTRY}/${img}:${SHA}"
-          done
+          bash scripts/run-promote-images.sh \
+            "${{ steps.meta.outputs.sha_tag }}" \
+            "${{ steps.meta.outputs.release_tag }}" \
+            stage \
+            eventhub traefik-coraza fallback bot-emulator-users observer-web logrotate
 
       - name: Prune old registry images
         env:
diff --git a/scripts/run-promote-images.sh b/scripts/run-promote-images.sh
new file mode 100644
index 0000000..86f240d
--- /dev/null
+++ b/scripts/run-promote-images.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# CI: clone EventHubDevOps и promote-images.sh
+# Usage: run-promote-images.sh <sha-tag> <release-tag> [stand-alias] [image...]
+set -euo pipefail
+
+SHA_TAG="${1:?sha-tag}"
+RELEASE_TAG="${2:?release-tag}"
+STAND_ALIAS="${3:?stand-alias}"
+shift 3
+EXTRA_IMAGES=("$@")
+
+DEVOPS_REPO="${DEVOPS_REPO:-https://git.sabilin.com/EventHub/EventHubDevOps.git}"
+DEVOPS_REF="${DEVOPS_REF:-master}"
+
+if [[ -z "${REGISTRY_USER:-}" || -z "${REGISTRY_PASSWORD:-}" ]]; then
+  echo "REGISTRY_USER/PASSWORD required"
+  exit 1
+fi
+
+WORKDIR="$(mktemp -d)"
+trap 'rm -rf "${WORKDIR}"' EXIT
+
+repo_path="${DEVOPS_REPO#https://}"
+git clone --depth 1 --branch "${DEVOPS_REF}" \
+  "https://${REGISTRY_USER}:${REGISTRY_PASSWORD}@${repo_path}" \
+  "${WORKDIR}/devops"
+
+args=("${SHA_TAG}" "${RELEASE_TAG}")
+if [[ -n "${STAND_ALIAS}" ]]; then
+  args+=("${STAND_ALIAS}")
+fi
+if ((${#EXTRA_IMAGES[@]} > 0)); then
+  args+=("${EXTRA_IMAGES[@]}")
+fi
+
+bash "${WORKDIR}/devops/scripts/promote-images.sh" "${args[@]}"