feat(admin): VERSION+sha в UI, bake CI и auto stage по sha-*

.gitea/workflows/ci.yml

@@ -30,6 +30,19 @@ jobs:
         with:
           node-version: '22'
 
+      - name: Bake build identity
+        id: build_meta
+        run: |
+          set -euo pipefail
+          APP_VERSION="$(tr -d '[:space:]' < VERSION 2>/dev/null || echo 0.0)"
+          GIT_SHA="${GITHUB_SHA:0:12}"
+          BUILT_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+          echo "VITE_APP_VERSION=${APP_VERSION}" >> "$GITHUB_ENV"
+          echo "VITE_GIT_SHA=${GIT_SHA}" >> "$GITHUB_ENV"
+          echo "VITE_BUILT_AT=${BUILT_AT}" >> "$GITHUB_ENV"
+          echo "version=${APP_VERSION}" >> "$GITHUB_OUTPUT"
+          echo "git_sha=${GIT_SHA}" >> "$GITHUB_OUTPUT"
+
       - run: npm ci
       - run: npm run lint
       - run: npm run build

.gitea/workflows/deploy-stage.yml

@@ -1,40 +1,46 @@
 name: Deploy stage (admin)
 
+# Auto после успешного CI на master: тот же sha-*, плюс floating :stage.
+# Product version (VERSION) не бампается — только sha в рантайме/registry.
 on:
-  push:
-    tags:
-      - 'v*'
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [master, main]
   workflow_dispatch:
-    inputs:
-      release_tag:
-        description: 'Release tag (например v0.1.1)'
-        required: true
-        default: 'v0.1.1'
-      sha_tag:
-        description: 'Образ sha-* (например sha-3f5dde498652)'
-        required: true
-        default: 'sha-3f5dde498652'
+
+concurrency:
+  group: eventhub-frontadmin-deploy-stage
+  cancel-in-progress: false
 
 env:
   REGISTRY: git.sabilin.com/eventhub
 
 jobs:
   deploy-stage-admin:
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
 
-      - name: Compute image tags
+      - name: Compute image tag
         id: meta
         run: |
           set -euo pipefail
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            echo "sha_tag=${{ github.event.inputs.sha_tag }}" >> "$GITHUB_OUTPUT"
-            echo "release_tag=${{ github.event.inputs.release_tag }}" >> "$GITHUB_OUTPUT"
+          if [ "${{ github.event_name }}" = "workflow_run" ]; then
+            SHA="${{ github.event.workflow_run.head_sha }}"
           else
-            echo "sha_tag=sha-${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
-            echo "release_tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
+            SHA="${GITHUB_SHA}"
           fi
+          echo "tag=sha-${SHA:0:12}" >> "$GITHUB_OUTPUT"
+
+      - name: Wait for Docker daemon
+        run: bash scripts/ensure-docker-daemon.sh 240
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -46,14 +52,24 @@ jobs:
           username: ${{ secrets.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
-      - name: Promote admin-ui image (no rebuild)
+      - name: Verify admin-ui image from CI
+        run: |
+          set -euo pipefail
+          TAG="${{ steps.meta.outputs.tag }}"
+          if ! docker buildx imagetools inspect "${REGISTRY}/eventhub-admin-ui:${TAG}" >/dev/null 2>&1; then
+            echo "Образ eventhub-admin-ui:${TAG} не найден — CI push не завершился."
+            exit 1
+          fi
+          echo "OK: eventhub-admin-ui:${TAG}"
+
+      - name: Promote sha → :stage (no rebuild)
         env:
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
           bash scripts/clone-devops-run.sh scripts/promote-images.sh \
-            "${{ steps.meta.outputs.sha_tag }}" \
-            "${{ steps.meta.outputs.release_tag }}" \
+            "${{ steps.meta.outputs.tag }}" \
+            "${{ steps.meta.outputs.tag }}" \
             stage \
             eventhub-admin-ui
 
@@ -66,7 +82,7 @@ jobs:
           script: |
             export REGISTRY_USER='${{ secrets.REGISTRY_USER }}'
             export REGISTRY_PASSWORD='${{ secrets.REGISTRY_PASSWORD }}'
-            bash /opt/eventhub-stage/devops/scripts/deploy-service.sh stage admin ${{ steps.meta.outputs.release_tag }}
+            bash /opt/eventhub-stage/devops/scripts/deploy-service.sh stage admin ${{ steps.meta.outputs.tag }}
 
       - name: Prune old registry images
         continue-on-error: true