refactor(ci): единый ci.yml — test через E2E stage в одном run.

Удалены deploy/e2e workflow_run; workflow_dispatch input pipeline.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/ci.yml

@@ -1,14 +1,29 @@
 name: CI
 
+# PR / push: test + push образа (на push).
+# push master/main: test → push-image → deploy IFT → E2E IFT → deploy stage → E2E stage (один run).
+# workflow_dispatch: выбор фазы (см. input pipeline).
 on:
   push:
     branches: [master, main]
   pull_request:
   workflow_dispatch:
+    inputs:
+      pipeline:
+        description: "Режим (push master = full автоматически)"
+        required: false
+        default: full
+        type: choice
+        options:
+          - full
+          - test-only
+          - deploy-ift
+          - e2e-ift
+          - deploy-stage
+          - e2e-stage
 
-# Один runner (DESKTOP-SIR8B3R): параллельные workflow ломают кэш act/actions.
 concurrency:
-  group: eventhub-frontadmin-ci-${{ github.ref }}
+  group: eventhub-frontadmin-${{ github.ref }}
   cancel-in-progress: false
 
 env:
@@ -18,6 +33,10 @@ env:
 
 jobs:
   test:
+    if: |
+      github.event_name == 'pull_request' ||
+      github.event_name == 'push' ||
+      (github.event_name == 'workflow_dispatch' && (github.event.inputs.pipeline == 'full' || github.event.inputs.pipeline == 'test-only'))
     runs-on: ubuntu-latest
     timeout-minutes: 20
     outputs:
@@ -25,7 +44,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # Без cache: npm — act_runner отменяет шаг на распаковке ~546MB (exit -1).
       - uses: actions/setup-node@v4
         with:
           node-version: '22'
@@ -40,8 +58,6 @@ jobs:
           echo "VITE_APP_VERSION=${APP_VERSION}" >> "$GITHUB_ENV"
           echo "VITE_GIT_SHA=${GIT_SHA}" >> "$GITHUB_ENV"
           echo "VITE_BUILT_AT=${BUILT_AT}" >> "$GITHUB_ENV"
-          echo "version=${APP_VERSION}" >> "$GITHUB_OUTPUT"
-          echo "git_sha=${GIT_SHA}" >> "$GITHUB_OUTPUT"
 
       - run: npm ci
       - run: npm run lint
@@ -54,7 +70,7 @@ jobs:
         run: npm run test:e2e
 
       - name: Upload dist for docker job
-        if: github.event_name == 'push'
+        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'full')
         uses: actions/upload-artifact@v3
         with:
           name: admin-ui-dist
@@ -76,7 +92,14 @@ jobs:
 
   push-image:
     needs: test
-    if: github.event_name == 'push' && needs.test.outputs.ci_test_ok == '1'
+    if: |
+      always() &&
+      needs.test.result == 'success' &&
+      needs.test.outputs.ci_test_ok == '1' &&
+      (
+        github.event_name == 'push' ||
+        (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'full')
+      )
     runs-on: ubuntu-latest
     timeout-minutes: 30
     outputs:
@@ -139,27 +162,254 @@ jobs:
         if: success()
         run: echo "ok=1" >> "$GITHUB_OUTPUT"
 
+  deploy-ift:
+    needs: push-image
+    if: |
+      always() && (
+        (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'deploy-ift') ||
+        (
+          needs.push-image.result == 'success' &&
+          (
+            (github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')) ||
+            (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'full')
+          )
+        )
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Compute image tag
+        id: meta
+        run: echo "tag=sha-${GITHUB_SHA:0:12}" >> "$GITHUB_OUTPUT"
+
+      - name: Wait for Docker daemon
+        run: bash scripts/ensure-docker-daemon.sh 240
+
+      - name: Login to registry
+        uses: docker/login-action@v2
+        with:
+          registry: git.sabilin.com
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Verify admin-ui image from CI
+        run: |
+          set -euo pipefail
+          TAG="${{ steps.meta.outputs.tag }}"
+          if ! docker buildx imagetools inspect "${REGISTRY}/eventhub-admin-ui:${TAG}" >/dev/null 2>&1; then
+            echo "Образ eventhub-admin-ui:${TAG} не найден — test/push-image не завершились."
+            exit 1
+          fi
+          echo "OK: eventhub-admin-ui:${TAG}"
+
+      - name: Deploy admin on IFT via SSH
+        uses: appleboy/ssh-action@v0.1.5
+        with:
+          host: ${{ secrets.IFT_SSH_HOST }}
+          username: ${{ secrets.IFT_SSH_USER }}
+          key: ${{ secrets.IFT_SSH_PRIVATE_KEY }}
+          script: |
+            export REGISTRY_USER='${{ secrets.REGISTRY_USER }}'
+            export REGISTRY_PASSWORD='${{ secrets.REGISTRY_PASSWORD }}'
+            bash /opt/eventhub-ift/devops/scripts/deploy-service.sh ift admin ${{ steps.meta.outputs.tag }}
+
+  e2e-ift:
+    needs: deploy-ift
+    if: |
+      always() && (
+        (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'e2e-ift') ||
+        (
+          needs.deploy-ift.result == 'success' &&
+          (
+            (github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')) ||
+            (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'full')
+          )
+        )
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - run: npm ci
+
+      - name: Install Playwright browser
+        run: bash scripts/install-playwright-chromium.sh
+
+      - name: Load smoke credentials from IFT .env
+        env:
+          SSH_HOST: ${{ secrets.IFT_SSH_HOST }}
+          SSH_USER: ${{ secrets.IFT_SSH_USER }}
+          SSH_KEY: ${{ secrets.IFT_SSH_PRIVATE_KEY }}
+        run: bash scripts/load-stand-smoke-env.sh ift
+
+      - name: E2E IFT (integration, live API)
+        env:
+          E2E_TARGET: ift
+          E2E_IFT_BASE_URL: ${{ secrets.E2E_IFT_BASE_URL }}
+        run: npm run test:e2e:ift
+
+      - name: Upload Playwright report
+        if: failure()
+        uses: actions/upload-artifact@v3
+        with:
+          name: playwright-ift-report
+          path: playwright-report/
+          retention-days: 7
+
+  deploy-stage:
+    needs: e2e-ift
+    if: |
+      always() && (
+        (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'deploy-stage') ||
+        (
+          needs.e2e-ift.result == 'success' &&
+          (
+            (github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')) ||
+            (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'full')
+          )
+        )
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Compute image tag
+        id: meta
+        run: echo "tag=sha-${GITHUB_SHA:0:12}" >> "$GITHUB_OUTPUT"
+
+      - name: Wait for Docker daemon
+        run: bash scripts/ensure-docker-daemon.sh 240
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to registry
+        uses: docker/login-action@v2
+        with:
+          registry: git.sabilin.com
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Verify admin-ui image from CI
+        run: |
+          set -euo pipefail
+          TAG="${{ steps.meta.outputs.tag }}"
+          if ! docker buildx imagetools inspect "${REGISTRY}/eventhub-admin-ui:${TAG}" >/dev/null 2>&1; then
+            echo "Образ eventhub-admin-ui:${TAG} не найден — test push не завершился."
+            exit 1
+          fi
+          echo "OK: eventhub-admin-ui:${TAG}"
+
+      - name: Promote sha → :stage (no rebuild)
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          bash scripts/clone-devops-run.sh scripts/promote-images.sh \
+            "${{ steps.meta.outputs.tag }}" \
+            "${{ steps.meta.outputs.tag }}" \
+            stage \
+            eventhub-admin-ui
+
+      - name: Deploy admin on stage via SSH
+        uses: appleboy/ssh-action@v0.1.5
+        with:
+          host: ${{ secrets.STAGE_SSH_HOST }}
+          username: ${{ secrets.STAGE_SSH_USER }}
+          key: ${{ secrets.STAGE_SSH_PRIVATE_KEY }}
+          script: |
+            export REGISTRY_USER='${{ secrets.REGISTRY_USER }}'
+            export REGISTRY_PASSWORD='${{ secrets.REGISTRY_PASSWORD }}'
+            bash /opt/eventhub-stage/devops/scripts/deploy-service.sh stage admin ${{ steps.meta.outputs.tag }}
+
+      - name: Prune old registry images
+        continue-on-error: true
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: bash scripts/clone-devops-run.sh scripts/prune-registry-images.sh
+
+  e2e-stage:
+    needs: deploy-stage
+    if: |
+      always() && (
+        (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'e2e-stage') ||
+        (
+          needs.deploy-stage.result == 'success' &&
+          (
+            (github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')) ||
+            (github.event_name == 'workflow_dispatch' && github.event.inputs.pipeline == 'full')
+          )
+        )
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - run: npm ci
+
+      - name: Install Playwright browser
+        run: bash scripts/install-playwright-chromium.sh
+
+      - name: Load smoke credentials from stage .env
+        env:
+          SSH_HOST: ${{ secrets.STAGE_SSH_HOST }}
+          SSH_USER: ${{ secrets.STAGE_SSH_USER }}
+          SSH_KEY: ${{ secrets.STAGE_SSH_PRIVATE_KEY }}
+        run: bash scripts/load-stand-smoke-env.sh stage
+
+      - name: E2E stage (integration, live API)
+        env:
+          E2E_TARGET: stage
+          E2E_STAGE_BASE_URL: ${{ secrets.E2E_STAGE_BASE_URL }}
+        run: npm run test:e2e:stage
+
+      - name: Upload Playwright report
+        if: failure()
+        uses: actions/upload-artifact@v3
+        with:
+          name: playwright-stage-report
+          path: playwright-report/
+          retention-days: 7
+
   ci-done:
     needs: [test, push-image]
-    if: always()
+    if: |
+      always() && (
+        github.event_name == 'pull_request' ||
+        github.event_name == 'push' ||
+        (github.event_name == 'workflow_dispatch' && (github.event.inputs.pipeline == 'full' || github.event.inputs.pipeline == 'test-only'))
+      )
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - name: Enforce CI completion
+      - name: Enforce CI gate (test / push on push & PR)
         run: |
           set -euo pipefail
-          TEST_OK="${{ needs.test.outputs.ci_test_ok }}"
-          if [ "${TEST_OK}" != "1" ]; then
-            echo "::error::test job incomplete (runner reported success without output)"
+          if [ "${{ needs.test.outputs.ci_test_ok }}" != "1" ]; then
+            echo "::error::test job incomplete"
             exit 1
           fi
-          if [ "${{ github.event_name }}" = "push" ]; then
+          if [ "${{ github.event_name }}" = "push" ] || ( [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ github.event.inputs.pipeline }}" = "full" ] ); then
             if [ "${{ needs.push-image.result }}" != "success" ]; then
               echo "::error::push-image must succeed, got: ${{ needs.push-image.result }}"
               exit 1
             fi
             if [ "${{ needs.push-image.outputs.ci_push_ok }}" != "1" ]; then
-              echo "::error::push-image incomplete (output missing)"
+              echo "::error::push-image incomplete"
               exit 1
             fi
           fi

.gitea/workflows/deploy-ift.yml

@@ -1,66 +0,0 @@
-name: Deploy IFT (admin)
-
-on:
-  workflow_run:
-    workflows: [CI]
-    types: [completed]
-    branches: [master, main]
-  workflow_dispatch:
-
-concurrency:
-  group: eventhub-frontadmin-deploy-ift
-  cancel-in-progress: false
-
-env:
-  REGISTRY: git.sabilin.com/eventhub
-
-jobs:
-  deploy-ift-admin:
-    # Gitea: workflow_run.conclusion часто пустой → job skipped. Проверка образа ниже.
-    if: github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_run'
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Compute image tag
-        id: meta
-        run: |
-          set -euo pipefail
-          if [ "${{ github.event_name }}" = "workflow_run" ]; then
-            SHA="${{ github.event.workflow_run.head_sha }}"
-          else
-            SHA="${GITHUB_SHA}"
-          fi
-          echo "tag=sha-${SHA:0:12}" >> "$GITHUB_OUTPUT"
-
-      - name: Wait for Docker daemon
-        run: bash scripts/ensure-docker-daemon.sh 240
-
-      - name: Login to registry
-        uses: docker/login-action@v2
-        with:
-          registry: git.sabilin.com
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
-
-      - name: Verify admin-ui image from CI
-        run: |
-          set -euo pipefail
-          TAG="${{ steps.meta.outputs.tag }}"
-          if ! docker buildx imagetools inspect "${REGISTRY}/eventhub-admin-ui:${TAG}" >/dev/null 2>&1; then
-            echo "Образ eventhub-admin-ui:${TAG} не найден — CI push не завершился (ложный success runner?)."
-            exit 1
-          fi
-          echo "OK: eventhub-admin-ui:${TAG}"
-
-      - name: Deploy admin on IFT via SSH
-        uses: appleboy/ssh-action@v0.1.5
-        with:
-          host: ${{ secrets.IFT_SSH_HOST }}
-          username: ${{ secrets.IFT_SSH_USER }}
-          key: ${{ secrets.IFT_SSH_PRIVATE_KEY }}
-          script: |
-            export REGISTRY_USER='${{ secrets.REGISTRY_USER }}'
-            export REGISTRY_PASSWORD='${{ secrets.REGISTRY_PASSWORD }}'
-            bash /opt/eventhub-ift/devops/scripts/deploy-service.sh ift admin ${{ steps.meta.outputs.tag }}

.gitea/workflows/deploy-stage.yml

@@ -1,92 +0,0 @@
-name: Deploy stage (admin)
-
-# Auto после успешного E2E IFT на master: promote sha-* → :stage и SSH deploy.
-# Product version (VERSION) не бампается — только sha в рантайме/registry.
-on:
-  workflow_run:
-    workflows: ["E2E IFT (admin)"]
-    types: [completed]
-    branches: [master, main]
-  workflow_dispatch:
-
-concurrency:
-  group: eventhub-frontadmin-deploy-stage
-  cancel-in-progress: false
-
-env:
-  REGISTRY: git.sabilin.com/eventhub
-
-jobs:
-  deploy-stage-admin:
-    if: |
-      github.event_name == 'workflow_dispatch' ||
-      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
-
-      - name: Compute image tag
-        id: meta
-        run: |
-          set -euo pipefail
-          if [ "${{ github.event_name }}" = "workflow_run" ]; then
-            SHA="${{ github.event.workflow_run.head_sha }}"
-          else
-            SHA="${GITHUB_SHA}"
-          fi
-          echo "tag=sha-${SHA:0:12}" >> "$GITHUB_OUTPUT"
-
-      - name: Wait for Docker daemon
-        run: bash scripts/ensure-docker-daemon.sh 240
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to registry
-        uses: docker/login-action@v2
-        with:
-          registry: git.sabilin.com
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
-
-      - name: Verify admin-ui image from CI
-        run: |
-          set -euo pipefail
-          TAG="${{ steps.meta.outputs.tag }}"
-          if ! docker buildx imagetools inspect "${REGISTRY}/eventhub-admin-ui:${TAG}" >/dev/null 2>&1; then
-            echo "Образ eventhub-admin-ui:${TAG} не найден — CI push не завершился."
-            exit 1
-          fi
-          echo "OK: eventhub-admin-ui:${TAG}"
-
-      - name: Promote sha → :stage (no rebuild)
-        env:
-          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
-          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-        run: |
-          bash scripts/clone-devops-run.sh scripts/promote-images.sh \
-            "${{ steps.meta.outputs.tag }}" \
-            "${{ steps.meta.outputs.tag }}" \
-            stage \
-            eventhub-admin-ui
-
-      - name: Deploy admin on stage via SSH
-        uses: appleboy/ssh-action@v0.1.5
-        with:
-          host: ${{ secrets.STAGE_SSH_HOST }}
-          username: ${{ secrets.STAGE_SSH_USER }}
-          key: ${{ secrets.STAGE_SSH_PRIVATE_KEY }}
-          script: |
-            export REGISTRY_USER='${{ secrets.REGISTRY_USER }}'
-            export REGISTRY_PASSWORD='${{ secrets.REGISTRY_PASSWORD }}'
-            bash /opt/eventhub-stage/devops/scripts/deploy-service.sh stage admin ${{ steps.meta.outputs.tag }}
-
-      - name: Prune old registry images
-        continue-on-error: true
-        env:
-          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
-          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-        run: bash scripts/clone-devops-run.sh scripts/prune-registry-images.sh

.gitea/workflows/e2e-ift.yml

@@ -1,55 +0,0 @@
-name: E2E IFT (admin)
-
-# После успешного Deploy IFT — интеграционный UI-сьют против живого admin-api (без mocks).
-# Учётки smoke — из /opt/eventhub-ift/.env по SSH (SMOKE_ADMIN_* / ADMIN_SUPER_*).
-on:
-  workflow_run:
-    workflows: ["Deploy IFT (admin)"]
-    types: [completed]
-  workflow_dispatch:
-
-concurrency:
-  group: eventhub-frontadmin-e2e-ift
-  cancel-in-progress: false
-
-jobs:
-  ift-e2e:
-    if: |
-      github.event_name == 'workflow_dispatch' ||
-      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-
-      - run: npm ci
-
-      - name: Install Playwright browser
-        run: bash scripts/install-playwright-chromium.sh
-
-      - name: Load smoke credentials from IFT .env
-        env:
-          SSH_HOST: ${{ secrets.IFT_SSH_HOST }}
-          SSH_USER: ${{ secrets.IFT_SSH_USER }}
-          SSH_KEY: ${{ secrets.IFT_SSH_PRIVATE_KEY }}
-        run: bash scripts/load-stand-smoke-env.sh ift
-
-      - name: E2E IFT (integration, live API)
-        env:
-          E2E_TARGET: ift
-          E2E_IFT_BASE_URL: ${{ secrets.E2E_IFT_BASE_URL }}
-        run: npm run test:e2e:ift
-
-      - name: Upload Playwright report
-        if: failure()
-        uses: actions/upload-artifact@v3
-        with:
-          name: playwright-ift-report
-          path: playwright-report/
-          retention-days: 7

.gitea/workflows/e2e-stage.yml

@@ -1,55 +0,0 @@
-name: E2E stage (admin)
-
-# После успешного Deploy stage — интеграционный UI-сьют против живого admin-api (без mocks).
-# Учётки smoke — из /opt/eventhub-stage/.env по SSH (SMOKE_ADMIN_* / ADMIN_SUPER_*).
-on:
-  workflow_run:
-    workflows: ["Deploy stage (admin)"]
-    types: [completed]
-  workflow_dispatch:
-
-concurrency:
-  group: eventhub-frontadmin-e2e-stage
-  cancel-in-progress: false
-
-jobs:
-  stage-e2e:
-    if: |
-      github.event_name == 'workflow_dispatch' ||
-      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-
-      - run: npm ci
-
-      - name: Install Playwright browser
-        run: bash scripts/install-playwright-chromium.sh
-
-      - name: Load smoke credentials from stage .env
-        env:
-          SSH_HOST: ${{ secrets.STAGE_SSH_HOST }}
-          SSH_USER: ${{ secrets.STAGE_SSH_USER }}
-          SSH_KEY: ${{ secrets.STAGE_SSH_PRIVATE_KEY }}
-        run: bash scripts/load-stand-smoke-env.sh stage
-
-      - name: E2E stage (integration, live API)
-        env:
-          E2E_TARGET: stage
-          E2E_STAGE_BASE_URL: ${{ secrets.E2E_STAGE_BASE_URL }}
-        run: npm run test:e2e:stage
-
-      - name: Upload Playwright report
-        if: failure()
-        uses: actions/upload-artifact@v3
-        with:
-          name: playwright-stage-report
-          path: playwright-report/
-          retention-days: 7