Merge pull request 'Fix customer deploy transport authentication' (#36) from feature/customer-deploy-transport-fix-20260722 into main

.gitea/workflows/deploy-customer-main.yml

@@ -57,8 +57,8 @@ jobs:
         run: |
           set -euo pipefail
 
-          registry_user="${REGISTRY_USER:-${REGISTRY_USERNAME:-${GITHUB_ACTOR:-}}}"
-          registry_password="${REGISTRY_TOKEN:-${REGISTRY_PASSWORD:-${GITEA_TOKEN:-}}}"
+          registry_user="${REGISTRY_USERNAME:-${REGISTRY_USER:-${GITHUB_ACTOR:-}}}"
+          registry_password="${REGISTRY_PASSWORD:-${REGISTRY_TOKEN:-${GITEA_TOKEN:-}}}"
           home_dir="${HOME:-/root}"
 
           if [ -z "${registry_user}" ]; then
@@ -98,8 +98,8 @@ jobs:
         run: |
           set -euo pipefail
 
-          registry_user="${REGISTRY_USER:-${REGISTRY_USERNAME:-${GITHUB_ACTOR:-}}}"
-          registry_password="${REGISTRY_TOKEN:-${REGISTRY_PASSWORD:-${GITEA_TOKEN:-}}}"
+          registry_user="${REGISTRY_USERNAME:-${REGISTRY_USER:-${GITHUB_ACTOR:-}}}"
+          registry_password="${REGISTRY_PASSWORD:-${REGISTRY_TOKEN:-${GITEA_TOKEN:-}}}"
           sha_short="$(printf '%s' "${GITHUB_SHA}" | cut -c1-12)"
           registry_path="${CUSTOMER_REGISTRY_HOST}/${CUSTOMER_REGISTRY_NAMESPACE}"
           web_ref="${registry_path}/${CUSTOMER_WEB_IMAGE}"
@@ -132,25 +132,42 @@ jobs:
 
       - name: Deploy customer stack
         env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+          GITEA_TOKEN: ${{ gitea.token }}
           CUSTOMER_DEPLOY_SSH_KEY: ${{ secrets.CUSTOMER_DEPLOY_SSH_KEY }}
           CUSTOMER_DEPLOY_SSH_KEY_B64: ${{ secrets.CUSTOMER_DEPLOY_SSH_KEY_B64 }}
           DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
         run: |
           set -euo pipefail
 
+          registry_user="${REGISTRY_USERNAME:-${REGISTRY_USER:-${GITHUB_ACTOR:-}}}"
+          registry_password="${REGISTRY_PASSWORD:-${REGISTRY_TOKEN:-${GITEA_TOKEN:-}}}"
+          case "${registry_user}" in
+            *[!A-Za-z0-9._@-]*)
+              echo "Registry user contains unsupported characters" >&2
+              exit 1
+              ;;
+          esac
+
           home_dir="${HOME:-/root}"
           mkdir -p "${home_dir}/.ssh"
           key_path="${home_dir}/.ssh/customer_deploy_key"
-          if [ -n "${CUSTOMER_DEPLOY_SSH_KEY_B64:-}" ]; then
+          if [ -f "/root/.ssh/ci-key" ]; then
+            cp "/root/.ssh/ci-key" "${key_path}"
+          elif [ -f "${home_dir}/.ssh/ci-key" ]; then
+            cp "${home_dir}/.ssh/ci-key" "${key_path}"
+          elif [ -n "${CUSTOMER_DEPLOY_SSH_KEY_B64:-}" ]; then
             printf '%s' "${CUSTOMER_DEPLOY_SSH_KEY_B64}" | base64 -d > "${key_path}"
           elif [ -n "${DEPLOY_SSH_KEY:-}" ]; then
             printf '%s' "${DEPLOY_SSH_KEY}" | base64 -d > "${key_path}"
           elif [ -n "${CUSTOMER_DEPLOY_SSH_KEY:-}" ]; then
             printf '%s\n' "${CUSTOMER_DEPLOY_SSH_KEY}" > "${key_path}"
-          elif [ -f "${home_dir}/.ssh/ci-key" ]; then
-            cp "${home_dir}/.ssh/ci-key" "${key_path}"
           else
-            cp "/root/.ssh/ci-key" "${key_path}"
+            echo "Customer deploy SSH key is unavailable" >&2
+            exit 1
           fi
           chmod 600 "${key_path}"
 
@@ -169,4 +186,7 @@ jobs:
              flock -w 1800 /tmp/ecos-customer-deploy.lock /bin/sh -c 'cd /ecos && FORCE_PULL=1 COMPOSE_FILE=\"${CUSTOMER_COMPOSE_FILE}\" \"${CUSTOMER_DEPLOY_SCRIPT}\" && docker image prune -f'"
 
           ssh "${ssh_common[@]}" -o "ProxyCommand=${proxy_command}" "${CUSTOMER_DEPLOY_USER}@${CUSTOMER_DEPLOY_HOST}" "true"
+          printf '%s' "${registry_password}" \
+            | ssh "${ssh_common[@]}" -o "ProxyCommand=${proxy_command}" "${CUSTOMER_DEPLOY_USER}@${CUSTOMER_DEPLOY_HOST}" \
+                "docker login '${CUSTOMER_REGISTRY_HOST}' -u '${registry_user}' --password-stdin"
           ssh "${ssh_common[@]}" -o "ProxyCommand=${proxy_command}" "${CUSTOMER_DEPLOY_USER}@${CUSTOMER_DEPLOY_HOST}" "${remote_command}"

src/apps/exchange/state_corp_services.py

@@ -35,6 +35,7 @@ from django.conf import settings
 from django.db.models import Q
 from django.utils import timezone
 from organizations.models import Organization, OrganizationSourceRecord
+from organizations.test_companies import TestCompanyDatasetService
 
 
 class StateCorpExchangeError(ValueError):
@@ -289,7 +290,9 @@ class StateCorpExchangeService:
 
     @classmethod
     def _rosatom_roscosmos_queryset(cls):
-        queryset = Organization.objects.exclude(inn="")
+        queryset = Organization.objects.exclude(inn="").exclude(
+            uid__in=TestCompanyDatasetService.company_uids()
+        )
         name_query = Q()
         for keyword in cls.ROSATOM_ROSCOSMOS_GK_NAME_KEYWORDS:
             name_query |= Q(gk_name__icontains=keyword)

tests/apps/exchange/test_state_corp_services.py

@@ -23,6 +23,7 @@ from apps.parsers.models import (
 from cryptography.hazmat.primitives.ciphers.aead import AESGCM
 from django.test import TestCase, override_settings
 from organizations.models import Organization
+from organizations.test_companies import TestCompanyDatasetService
 
 from tests.apps.parsers.factories import (
     IndustrialCertificateRecordFactory,
@@ -67,6 +68,30 @@ TEST_STATE_CORP_TOKEN = "state-corp-test-exchange-token"  # noqa: S105
 class StateCorpExchangeServiceTest(TestCase):
     """Verify package compatibility with state-corp receiver contract."""
 
+    def test_default_package_excludes_deterministic_test_companies(self):
+        real_organization = Organization.objects.create(
+            rn=1001,
+            name="Реальная организация",
+            inn="7707083893",
+            gk_name="Росатом",
+        )
+        Organization.objects.create(
+            uid=TestCompanyDatasetService.company_uids()[0],
+            rn=9001,
+            name="Тестовая компания 1",
+            inn="7700000001",
+            gk_name="Росатом",
+        )
+
+        package = StateCorpExchangeService.build_package()
+        payload = _decode_package_payload(package)
+
+        self.assertEqual(package.payload_counts["organizations"], 1)
+        self.assertEqual(
+            [row["mostovik_uid"] for row in payload["data"]["organizations"]],
+            [str(real_organization.uid)],
+        )
+
     def test_build_package_contains_expected_payload(self):
         organization = Organization.objects.create(
             rn=1001,

tests/apps/organizations/test_test_companies_commands.py

@@ -133,7 +133,7 @@ class TestCompaniesCommandsTest(TestCase):
         self.assertEqual(OrganizationSourceRecord.objects.count(), 20 * 15)
 
     @override_settings(STATE_CORP_EXCHANGE_TOKEN=TEST_EXCHANGE_TOKEN)
-    def test_created_source_records_are_exported_to_state_corp_package(self):
+    def test_created_source_records_are_excluded_from_state_corp_package(self):
         call_command("create_test_companies", stdout=StringIO())
 
         company_inns = list(
@@ -146,18 +146,18 @@ class TestCompaniesCommandsTest(TestCase):
         self.assertEqual(
             package.payload_counts,
             {
-                "organizations": 20,
-                "industrial_certificates": 20,
-                "manufacturers": 20,
-                "industrial_products": 20,
-                "prosecutor_checks": 20,
-                "public_procurements": 60,
-                "financial_reports": 20,
-                "arbitration_cases": 20,
-                "bankruptcy_procedures": 20,
-                "defense_unreliable_suppliers": 40,
-                "information_security_registries": 20,
-                "labor_vacancies": 20,
+                "organizations": 0,
+                "industrial_certificates": 0,
+                "manufacturers": 0,
+                "industrial_products": 0,
+                "prosecutor_checks": 0,
+                "public_procurements": 0,
+                "financial_reports": 0,
+                "arbitration_cases": 0,
+                "bankruptcy_procedures": 0,
+                "defense_unreliable_suppliers": 0,
+                "information_security_registries": 0,
+                "labor_vacancies": 0,
             },
         )