Merge dev into main

Pin customer deploy workflow to backend runner.

.gitea/workflows/deploy-customer-main.yml

@@ -11,7 +11,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  CUSTOMER_REGISTRY_HOST: registry.dev.nii-ecos.ru:80
+  CUSTOMER_REGISTRY_HOST: registry.dev.nii-ecos.ru
   CUSTOMER_REGISTRY_NAMESPACE: avm
   CUSTOMER_WEB_IMAGE: state-corp-backend-web
   CUSTOMER_CELERY_IMAGE: state-corp-backend-celery
@@ -24,7 +24,7 @@ env:
 jobs:
   deploy:
     name: Build, Push, Deploy
-    runs-on: ubuntu-latest
+    runs-on: [backend-docker]
     timeout-minutes: 90
 
     steps:
@@ -50,14 +50,16 @@ jobs:
           REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+          GITEA_TOKEN: ${{ gitea.token }}
           CUSTOMER_DEPLOY_SSH_KEY: ${{ secrets.CUSTOMER_DEPLOY_SSH_KEY }}
           CUSTOMER_DEPLOY_SSH_KEY_B64: ${{ secrets.CUSTOMER_DEPLOY_SSH_KEY_B64 }}
           DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
         run: |
           set -euo pipefail
 
-          registry_user="${REGISTRY_USER:-${REGISTRY_USERNAME:-}}"
+          registry_user="${REGISTRY_USER:-${REGISTRY_USERNAME:-${GITHUB_ACTOR:-}}}"
-          registry_password="${REGISTRY_TOKEN:-${REGISTRY_PASSWORD:-}}"
+          registry_password="${REGISTRY_TOKEN:-${REGISTRY_PASSWORD:-${GITEA_TOKEN:-}}}"
+          home_dir="${HOME:-/root}"
 
           if [ -z "${registry_user}" ]; then
             echo "Missing registry user secret: set REGISTRY_USER or REGISTRY_USERNAME" >&2
@@ -70,18 +72,21 @@ jobs:
           if [ -z "${CUSTOMER_DEPLOY_SSH_KEY:-}" ] \
             && [ -z "${CUSTOMER_DEPLOY_SSH_KEY_B64:-}" ] \
             && [ -z "${DEPLOY_SSH_KEY:-}" ] \
-            && [ ! -f "${HOME}/.ssh/ci-key" ] \
+            && [ ! -f "${home_dir}/.ssh/ci-key" ] \
             && [ ! -f "/root/.ssh/ci-key" ]; then
             echo "Missing customer SSH key: set CUSTOMER_DEPLOY_SSH_KEY_B64, CUSTOMER_DEPLOY_SSH_KEY, DEPLOY_SSH_KEY, or install ~/.ssh/ci-key on the runner" >&2
             exit 1
           fi
 
-      - name: Install crane
+      - name: Setup Docker Buildx
         run: |
           set -euo pipefail
-          curl -fsSL https://github.com/google/go-containerregistry/releases/download/v0.19.0/go-containerregistry_Linux_x86_64.tar.gz \
+          if ! docker buildx inspect customer-builder >/dev/null 2>&1; then
-            | tar xz crane
+            docker buildx create --name customer-builder --driver docker-container --use
-          chmod +x crane
+          else
+            docker buildx use customer-builder
+          fi
+          docker buildx inspect --bootstrap
 
       - name: Build and push customer images
         env:
@@ -89,42 +94,41 @@ jobs:
           REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+          GITEA_TOKEN: ${{ gitea.token }}
         run: |
           set -euo pipefail
 
-          registry_user="${REGISTRY_USER:-${REGISTRY_USERNAME:-}}"
+          registry_user="${REGISTRY_USER:-${REGISTRY_USERNAME:-${GITHUB_ACTOR:-}}}"
-          registry_password="${REGISTRY_TOKEN:-${REGISTRY_PASSWORD:-}}"
+          registry_password="${REGISTRY_TOKEN:-${REGISTRY_PASSWORD:-${GITEA_TOKEN:-}}}"
           sha_short="$(printf '%s' "${GITHUB_SHA}" | cut -c1-12)"
           registry_path="${CUSTOMER_REGISTRY_HOST}/${CUSTOMER_REGISTRY_NAMESPACE}"
           web_ref="${registry_path}/${CUSTOMER_WEB_IMAGE}"
           celery_ref="${registry_path}/${CUSTOMER_CELERY_IMAGE}"
 
           printf '%s' "${registry_password}" \
-            | ./crane auth login --insecure "${CUSTOMER_REGISTRY_HOST}" \
+            | docker login "${CUSTOMER_REGISTRY_HOST}" \
               -u "${registry_user}" \
               --password-stdin
 
-          docker build \
+          docker buildx build \
             --platform linux/amd64 \
             -f ./docker/Dockerfile \
             --target runtime-web \
             --build-arg INSTALL_DEV=false \
-            -t customer-state-corp-backend-web:local \
+            --push \
+            -t "${web_ref}:latest" \
+            -t "${web_ref}:${sha_short}" \
             .
-          docker save customer-state-corp-backend-web:local -o /tmp/customer-state-corp-backend-web.tar
-          ./crane push --insecure /tmp/customer-state-corp-backend-web.tar "${web_ref}:latest"
-          ./crane push --insecure /tmp/customer-state-corp-backend-web.tar "${web_ref}:${sha_short}"
 
-          docker build \
+          docker buildx build \
             --platform linux/amd64 \
             -f ./docker/Dockerfile \
             --target runtime-celery \
             --build-arg INSTALL_DEV=false \
-            -t customer-state-corp-backend-celery:local \
+            --push \
+            -t "${celery_ref}:latest" \
+            -t "${celery_ref}:${sha_short}" \
             .
-          docker save customer-state-corp-backend-celery:local -o /tmp/customer-state-corp-backend-celery.tar
-          ./crane push --insecure /tmp/customer-state-corp-backend-celery.tar "${celery_ref}:latest"
-          ./crane push --insecure /tmp/customer-state-corp-backend-celery.tar "${celery_ref}:${sha_short}"
 
       - name: Deploy customer stack
         env:
@@ -134,16 +138,17 @@ jobs:
         run: |
           set -euo pipefail
 
-          mkdir -p "${HOME}/.ssh"
+          home_dir="${HOME:-/root}"
-          key_path="${HOME}/.ssh/customer_deploy_key"
+          mkdir -p "${home_dir}/.ssh"
+          key_path="${home_dir}/.ssh/customer_deploy_key"
           if [ -n "${CUSTOMER_DEPLOY_SSH_KEY_B64:-}" ]; then
             printf '%s' "${CUSTOMER_DEPLOY_SSH_KEY_B64}" | base64 -d > "${key_path}"
           elif [ -n "${DEPLOY_SSH_KEY:-}" ]; then
             printf '%s' "${DEPLOY_SSH_KEY}" | base64 -d > "${key_path}"
           elif [ -n "${CUSTOMER_DEPLOY_SSH_KEY:-}" ]; then
             printf '%s\n' "${CUSTOMER_DEPLOY_SSH_KEY}" > "${key_path}"
-          elif [ -f "${HOME}/.ssh/ci-key" ]; then
+          elif [ -f "${home_dir}/.ssh/ci-key" ]; then
-            cp "${HOME}/.ssh/ci-key" "${key_path}"
+            cp "${home_dir}/.ssh/ci-key" "${key_path}"
           else
             cp "/root/.ssh/ci-key" "${key_path}"
           fi
@@ -161,9 +166,7 @@ jobs:
           )
           proxy_command="ssh -i ${key_path} -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o GlobalKnownHostsFile=/dev/null -o LogLevel=ERROR -o ConnectTimeout=15 -W %h:%p ${CUSTOMER_SSH_PROXY_HOST}"
           remote_command="set -euo pipefail
-             cd /ecos
+             flock -w 1800 /tmp/ecos-customer-deploy.lock /bin/sh -c 'cd /ecos && FORCE_PULL=1 COMPOSE_FILE=\"${CUSTOMER_COMPOSE_FILE}\" \"${CUSTOMER_DEPLOY_SCRIPT}\" && docker image prune -f'"
-             FORCE_PULL=1 COMPOSE_FILE='${CUSTOMER_COMPOSE_FILE}' '${CUSTOMER_DEPLOY_SCRIPT}'
-             docker image prune -f"
 
           ssh "${ssh_common[@]}" -o "ProxyCommand=${proxy_command}" "${CUSTOMER_DEPLOY_USER}@${CUSTOMER_DEPLOY_HOST}" "true"
           ssh "${ssh_common[@]}" -o "ProxyCommand=${proxy_command}" "${CUSTOMER_DEPLOY_USER}@${CUSTOMER_DEPLOY_HOST}" "${remote_command}"