refactor(ci): единый ci.yml; удалены legacy deploy/e2e/build-and-test workflows.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-16 16:19:20 +03:00
parent 77a53c77cd
commit 6dc06ccdf4
6 changed files with 277 additions and 381 deletions
@@ -1,11 +1,27 @@
 name: CI

+# PR / push: test (+ push образа на push).
+# push master/main: test → deploy IFT → E2E IFT → deploy stage → E2E stage (один run).
+# workflow_dispatch: выбор фазы (см. input pipeline).
 on:
  push:
    branches: [master, main]
  pull_request:
+  workflow_dispatch:
+    inputs:
+      pipeline:
+        description: "Режим (push master = full автоматически)"
+        required: false
+        default: full
+        type: choice
+        options:
+          - full
+          - test-only
+          - deploy-ift
+          - e2e-ift
+          - deploy-stage
+          - e2e-stage

-# Один runner (DESKTOP-SIR8B3R): параллельные workflow ломают кэш act/actions.
 concurrency:
  group: eventhub-back-${{ github.ref }}
  cancel-in-progress: false
@@ -17,8 +33,14 @@ env:

 jobs:
  test:
+    if: |
+      github.event_name == 'pull_request' ||
+      github.event_name == 'push' ||
+      (github.event_name == 'workflow_dispatch' && (github.event.inputs.pipeline == 'full' || github.event.inputs.pipeline == 'test-only'))
    runs-on: ubuntu-latest
    timeout-minutes: 60
+    outputs:
+      ci_test_ok: ${{ steps.mark_test.outputs.ok }}
    steps:
      - uses: actions/checkout@v4

@@ -106,3 +128,257 @@ jobs:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: bash scripts/run-registry-prune.sh
+
+      - name: Mark test complete
+        id: mark_test
+        if: success()
+        run: echo "ok=1" >> "$GITHUB_OUTPUT"
+
+  deploy-ift:
+    needs: test
+    if: |
+      always() && (
+        (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'deploy-ift') ||
+        (
+          needs.test.result == 'success' &&
+          (
+            (github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')) ||
+            (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'full')
+          )
+        )
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: Compute image tag
+        id: meta
+        run: echo "tag=sha-${GITHUB_SHA:0:12}" >> "$GITHUB_OUTPUT"
+
+      - name: Wait for Docker daemon
+        run: bash scripts/ensure-docker-daemon.sh 240
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to registry
+        uses: docker/login-action@v2
+        with:
+          registry: git.sabilin.com
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Verify eventhub image from CI
+        run: |
+          set -euo pipefail
+          TAG="${{ steps.meta.outputs.tag }}"
+          if ! docker buildx imagetools inspect "${REGISTRY}/eventhub:${TAG}" >/dev/null 2>&1; then
+            echo "Образ eventhub:${TAG} не найден — сначала должен пройти test (build + push)."
+            exit 1
+          fi
+          echo "OK: eventhub:${TAG}"
+
+      - name: Publish auxiliary images
+        run: |
+          set -euo pipefail
+          TAG="${{ steps.meta.outputs.tag }}"
+          FILES="$(git diff --name-only HEAD^ HEAD 2>/dev/null || git show --pretty="" --name-only HEAD)"
+          bash scripts/publish-ift-aux-images.sh "${REGISTRY}" "${TAG}" "${FILES}"
+
+      - name: Bootstrap optional aux images on IFT server
+        uses: appleboy/ssh-action@v0.1.5
+        with:
+          host: ${{ secrets.IFT_SSH_HOST }}
+          username: ${{ secrets.IFT_SSH_USER }}
+          key: ${{ secrets.IFT_SSH_PRIVATE_KEY }}
+          script: |
+            export REGISTRY_USER='${{ secrets.REGISTRY_USER }}'
+            export REGISTRY_PASSWORD='${{ secrets.REGISTRY_PASSWORD }}'
+            echo "${REGISTRY_PASSWORD}" | docker login git.sabilin.com -u "${REGISTRY_USER}" --password-stdin
+            COMMIT="${GITHUB_SHA}"
+            WORKDIR="$(mktemp -d)"
+            git clone --depth 1 "https://${REGISTRY_USER}:${REGISTRY_PASSWORD}@git.sabilin.com/EventHub/EventHubBack.git" "${WORKDIR}/back"
+            git -C "${WORKDIR}/back" fetch --depth 1 origin "${COMMIT}"
+            git -C "${WORKDIR}/back" checkout "${COMMIT}"
+            BACK_DIR="${WORKDIR}/back" bash "${WORKDIR}/back/scripts/build-optional-aux-on-server.sh" "${REGISTRY}" "${{ steps.meta.outputs.tag }}" "${COMMIT}"
+            rm -rf "${WORKDIR}"
+
+      - name: Deploy core on IFT via SSH
+        uses: appleboy/ssh-action@v0.1.5
+        with:
+          host: ${{ secrets.IFT_SSH_HOST }}
+          username: ${{ secrets.IFT_SSH_USER }}
+          key: ${{ secrets.IFT_SSH_PRIVATE_KEY }}
+          script: |
+            export REGISTRY_USER='${{ secrets.REGISTRY_USER }}'
+            export REGISTRY_PASSWORD='${{ secrets.REGISTRY_PASSWORD }}'
+            bash /opt/eventhub-ift/devops/scripts/deploy-service.sh ift core ${{ steps.meta.outputs.tag }}
+
+      - name: Prune old registry images
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: bash scripts/run-registry-prune.sh
+
+  e2e-ift:
+    needs: deploy-ift
+    if: |
+      always() && (
+        (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'e2e-ift') ||
+        (
+          needs.deploy-ift.result == 'success' &&
+          (
+            (github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')) ||
+            (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'full')
+          )
+        )
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Wait for Docker daemon
+        run: bash scripts/ensure-docker-daemon.sh 240
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Load API test credentials from IFT .env
+        env:
+          SSH_HOST: ${{ secrets.IFT_SSH_HOST }}
+          SSH_USER: ${{ secrets.IFT_SSH_USER }}
+          SSH_KEY: ${{ secrets.IFT_SSH_PRIVATE_KEY }}
+        run: bash scripts/load-stand-api-env.sh ift
+
+      - name: E2E IFT (full API suite)
+        env:
+          SSH_HOST: ${{ secrets.IFT_SSH_HOST }}
+          SSH_USER: ${{ secrets.IFT_SSH_USER }}
+          SSH_KEY: ${{ secrets.IFT_SSH_PRIVATE_KEY }}
+          API_HOST: ${{ secrets.E2E_IFT_API_HOST }}
+          ADMIN_API_HOST: ${{ secrets.E2E_IFT_ADMIN_API_HOST }}
+          WS_HOST: ${{ secrets.E2E_IFT_WS_HOST }}
+          ADMIN_WS_HOST: ${{ secrets.E2E_IFT_ADMIN_WS_HOST }}
+        run: bash scripts/run-stand-api-tests.sh ift
+
+  deploy-stage:
+    needs: e2e-ift
+    if: |
+      always() && (
+        (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'deploy-stage') ||
+        (
+          needs.e2e-ift.result == 'success' &&
+          (
+            (github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')) ||
+            (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'full')
+          )
+        )
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: Compute image tag
+        id: meta
+        run: echo "tag=sha-${GITHUB_SHA:0:12}" >> "$GITHUB_OUTPUT"
+
+      - name: Wait for Docker daemon
+        run: bash scripts/ensure-docker-daemon.sh 240
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to registry
+        uses: docker/login-action@v2
+        with:
+          registry: git.sabilin.com
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Verify core image from CI
+        run: |
+          set -euo pipefail
+          TAG="${{ steps.meta.outputs.tag }}"
+          if ! docker buildx imagetools inspect "${REGISTRY}/eventhub:${TAG}" >/dev/null 2>&1; then
+            echo "Образ eventhub:${TAG} не найден — test push не завершился."
+            exit 1
+          fi
+          echo "OK: eventhub:${TAG}"
+
+      - name: Promote sha → :stage (no rebuild)
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          bash scripts/clone-devops-run.sh scripts/promote-images.sh \
+            "${{ steps.meta.outputs.tag }}" \
+            "${{ steps.meta.outputs.tag }}" \
+            stage \
+            eventhub traefik-coraza fallback bot-emulator-users observer-web logrotate
+
+      - name: Deploy core on stage via SSH
+        uses: appleboy/ssh-action@v0.1.5
+        with:
+          host: ${{ secrets.STAGE_SSH_HOST }}
+          username: ${{ secrets.STAGE_SSH_USER }}
+          key: ${{ secrets.STAGE_SSH_PRIVATE_KEY }}
+          script: |
+            export REGISTRY_USER='${{ secrets.REGISTRY_USER }}'
+            export REGISTRY_PASSWORD='${{ secrets.REGISTRY_PASSWORD }}'
+            bash /opt/eventhub-stage/devops/scripts/deploy-service.sh stage core ${{ steps.meta.outputs.tag }}
+
+      - name: Prune old registry images
+        continue-on-error: true
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: bash scripts/clone-devops-run.sh scripts/prune-registry-images.sh
+
+  e2e-stage:
+    needs: deploy-stage
+    if: |
+      always() && (
+        (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'e2e-stage') ||
+        (
+          needs.deploy-stage.result == 'success' &&
+          (
+            (github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')) ||
+            (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'full')
+          )
+        )
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Wait for Docker daemon
+        run: bash scripts/ensure-docker-daemon.sh 240
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Load API test credentials from stage .env
+        env:
+          SSH_HOST: ${{ secrets.STAGE_SSH_HOST }}
+          SSH_USER: ${{ secrets.STAGE_SSH_USER }}
+          SSH_KEY: ${{ secrets.STAGE_SSH_PRIVATE_KEY }}
+        run: bash scripts/load-stand-api-env.sh stage
+
+      - name: E2E stage (full API suite)
+        env:
+          SSH_HOST: ${{ secrets.STAGE_SSH_HOST }}
+          SSH_USER: ${{ secrets.STAGE_SSH_USER }}
+          SSH_KEY: ${{ secrets.STAGE_SSH_PRIVATE_KEY }}
+          API_HOST: ${{ secrets.E2E_STAGE_API_HOST }}
+          ADMIN_API_HOST: ${{ secrets.E2E_STAGE_ADMIN_API_HOST }}
+          WS_HOST: ${{ secrets.E2E_STAGE_WS_HOST }}
+          ADMIN_WS_HOST: ${{ secrets.E2E_STAGE_ADMIN_WS_HOST }}
+        run: bash scripts/run-stand-api-tests.sh stage