fix(werf-deploy): pass NPM_TOKEN into Docker build-args

Reusable workflow callers set env/secrets that never reached `werf
converge`. Accept optional NPM_TOKEN, fall back to Vault, export
WERF_BUILD_ARG_NPM_TOKEN before converge.

.gitea/actions/plugin/build-achievements/action.yml

@@ -0,0 +1,65 @@
+name: build
+description: Build plugin via yarn & make
+
+inputs:
+  go_version:
+    required: false
+    description: 'GO version'
+  go_cache:
+    required: false
+    description: 'For direct disable go-cache if needed'
+  node_version:
+    required: false
+    description: 'Node.js version'
+
+runs:
+  using: composite
+  steps:
+    - name: ci/setup-go
+      uses: actions/setup-go@v4
+      if: ${{ inputs.go_version && inputs.go_cache != 'false' }}
+      with:
+        go-version: "${{ inputs.go_version }}"
+        cache-dependency-path: |
+          go.sum
+          server/go.sum
+
+    - name: ci/setup-go-wo-cache
+      uses: actions/setup-go@v4
+      if: ${{ inputs.go_version && inputs.go_cache == 'false' }}
+      with:
+        go-version: "${{ inputs.go_version }}"
+        cache: false
+
+    - name: Setup pnpm
+      uses: pnpm/action-setup@v4
+      with:
+        version: 10.6.3
+
+    - name: ci/setup-node
+      uses: actions/setup-node@v4
+      if: ${{ inputs.node_version }}
+      with:
+        node-version: "${{ inputs.node_version }}"
+# TODO cache yarn
+#        cache: "yarn"
+#        cache-dependency-path: yarn.lock
+
+# TODO tests
+#    - name: ci/plugin-test
+
+    - name: ci/install-deps
+      if: ${{ inputs.node_version }}
+      shell: bash
+      run: |
+        echo "::group::yarn"
+        cd webapp
+        yarn install
+        echo "::endgroup::"
+
+    - name: ci/plugin-build
+      shell: bash
+      run: |
+        echo "::group::dist"
+        make dist
+        echo "::endgroup::"

.gitea/actions/plugin/build-channel-export/action.yml

@@ -0,0 +1,45 @@
+name: build-channel-export
+description: Build plugin via make
+
+inputs:
+  go_version:
+    required: false
+    description: 'GO version'
+  go_cache:
+    required: false
+    description: 'For direct disable go-cache if needed'
+  node_version:
+    required: false
+    description: 'Node.js version'
+
+runs:
+  using: composite
+  steps:
+    - name: ci/setup-go
+      uses: actions/setup-go@v4
+      if: ${{ inputs.go_version && inputs.go_cache != 'false' }}
+      with:
+        go-version: "${{ inputs.go_version }}"
+        cache-dependency-path: |
+          go.sum
+          server/go.sum
+
+    - name: ci/setup-go-wo-cache
+      uses: actions/setup-go@v4
+      if: ${{ inputs.go_version && inputs.go_cache == 'false' }}
+      with:
+        go-version: "${{ inputs.go_version }}"
+        cache: false
+
+    - name: ci/setup-node
+      uses: actions/setup-node@v4
+      if: ${{ inputs.node_version }}
+      with:
+        node-version: "${{ inputs.node_version }}"
+
+    - name: ci/plugin-build
+      shell: bash
+      run: |
+        echo "::group::dist"
+        make dist
+        echo "::endgroup::"

.gitea/actions/plugin/build/action.yml

@@ -31,6 +31,11 @@ runs:
         go-version: "${{ inputs.go_version }}"
         cache: false
 
+    - name: Setup pnpm
+      uses: pnpm/action-setup@v4
+      with:
+        version: 10.6.3
+
     - name: ci/setup-node
       uses: actions/setup-node@v4
       if: ${{ inputs.node_version }}
@@ -48,6 +53,7 @@ runs:
       shell: bash
       run: |
         echo "::group::yarn"
+        corepack enable
         cd webapp
         yarn install
         echo "::endgroup::"

.gitea/workflows/java-pull-request-check-template.yml

@@ -42,12 +42,12 @@ env:
 jobs:
   check:
     name: check and test
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - uses: https://github.com/actions/checkout@v3
       - uses: https://github.com/actions/setup-java@v3
         with:
-          distribution: 'temurin'
+          distribution: 'zulu'
           java-version: 21
           check-latest: "false"
       - uses: https://github.com/gradle/gradle-build-action@v2
@@ -138,4 +138,4 @@ jobs:
 
       - name: loop fail notification
         if: ${{ inputs.notification_enabled && job.status == 'failure' }}
-        uses: https://github.com/mattermost/action-mattermost-notify@master
+        uses: https://github.com/mattermost/action-mattermost-notify@1.1.0

.gitea/workflows/loop-plugin-achievements-template.yml

@@ -0,0 +1,161 @@
+name: Build and sign plugin with marketplace json formation
+on:
+  workflow_call:
+    inputs:
+      go_version:
+        required: false
+        description: 'GO version'
+      go_cache:
+        required: false
+        description: 'For direct disable go-cache if needed'
+      node_version:
+        required: false
+        description: 'Node.js version'
+      vault_secrets_base_path:
+        required: true
+        description: 'Base vault secret path'
+      artifacts_url:
+        required: true
+        description: 'Artifacts URL'
+      artifacts_repository:
+        required: true
+        description: 'Artifacts repository'
+    secrets:
+      VAULT_ROLE_ID:
+        required: true
+      VAULT_SECRET_ID:
+        required: true
+
+jobs:
+  release:
+    name: release
+    runs-on: ubuntu-22.04-slim
+    steps:
+      - name: ci/checkout-repo
+        uses: actions/checkout@v3
+
+      - name: ci/setup-node
+        uses: actions/setup-node@v4
+        if: ${{ inputs.node_version }}
+        with:
+          node-version: "${{ inputs.node_version }}"
+
+      - name: Setup yarn
+        run: npm install -g yarn
+
+      - name: ci/setup-go
+        uses: actions/setup-go@v4
+        if: ${{ inputs.go_version && inputs.go_cache != 'false' }}
+        with:
+          go-version: "${{ inputs.go_version }}"
+          cache-dependency-path: |
+            go.sum
+            server/go.sum
+
+      - name: ci/setup-go-wo-cache
+        uses: actions/setup-go@v4
+        if: ${{ inputs.go_version && inputs.go_cache == 'false' }}
+        with:
+          go-version: "${{ inputs.go_version }}"
+          cache: false
+
+      - id: publish-secrets
+        name: ci/publish-secrets
+        uses: https://github.com/hashicorp/vault-action@v2
+        with:
+          url: https://vault.wilix.dev
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets: |
+            ${{ inputs.vault_secrets_base_path }} ARTIFACTS_USERNAME ;
+            ${{ inputs.vault_secrets_base_path }} ARTIFACTS_PASSWORD ;
+
+      - id: key
+        name: ci/key
+        uses: https://github.com/hashicorp/vault-action@v2
+        with:
+          url: https://vault.wilix.dev
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets: |
+            ${{ inputs.vault_secrets_base_path }} SIGN_PRIVATE_KEY_EXPORTED ;
+            ${{ inputs.vault_secrets_base_path }} SIGN_PRIVATE_KEY_ID ;
+            ${{ inputs.vault_secrets_base_path }} SIGN_PRIVATE_KEY_PASSPHRASE ;
+
+      - id: plugin-meta
+        name: ci/plugin-meta
+        shell: bash
+        run: |
+          apt-get update
+          apt-get install -y jq
+          echo "PLUGIN=$(jq -r '.id + "-" + .version + ".tar.gz"' plugin.json)" >> "$GITHUB_OUTPUT"
+          echo "PLUGIN_ID=$(jq -r '.id' plugin.json)" >> "$GITHUB_OUTPUT"
+          echo "PLUGIN_VERSION=$(jq -r '.version' plugin.json)" >> "$GITHUB_OUTPUT" 
+          echo "ENTERPRISE=$(jq -r '.props.enterprise == true' plugin.json)" >> "$GITHUB_OUTPUT" 
+          echo "BETA=$(jq -r '.version | contains("SNAPSHOT")' plugin.json)" >> "$GITHUB_OUTPUT" 
+          echo "EXPERIMENTAL=$(jq -r '.props.experimental == true' plugin.json)" >> "$GITHUB_OUTPUT"
+
+      - name: ci/plugin-build
+        uses: https://git.wilix.dev/wilix-infra/actions/.gitea/actions/plugin/build-achievements@master
+        with:
+          go_version: ${{ inputs.go_version }}
+          go_cache: ${{ inputs.go_cache }}
+          node_version: ${{ inputs.node_version }}
+          ssh_key: ${{ secrets.AI_DEPLOY_KEY }}
+
+      - name: ci/plugin-sign
+        uses: https://git.wilix.dev/wilix-infra/actions/.gitea/actions/file-sign@master
+        with:
+          private_key: ${{ steps.key.outputs.SIGN_PRIVATE_KEY_EXPORTED }}
+          private_key_id: ${{ steps.key.outputs.SIGN_PRIVATE_KEY_ID }}
+          private_key_passphrase: ${{ steps.key.outputs.SIGN_PRIVATE_KEY_PASSPHRASE }}
+          filepath: ${{ gitea.workspace }}/dist/${{ steps.plugin-meta.outputs.PLUGIN }}
+
+      - name: ci/push-plugin
+        uses: sonatype-nexus-community/nexus-repo-github-action@master
+        with:
+          serverUrl: ${{ inputs.artifacts_url }}
+          username: ${{ steps.publish-secrets.outputs.ARTIFACTS_USERNAME }}
+          password: ${{ steps.publish-secrets.outputs.ARTIFACTS_PASSWORD }}
+          format: raw
+          repository: ${{ inputs.artifacts_repository }}
+          coordinates: directory=plugins/${{ steps.plugin-meta.outputs.PLUGIN_ID }}/${{ steps.plugin-meta.outputs.PLUGIN_VERSION }}
+          assets: filename=${{ steps.plugin-meta.outputs.PLUGIN }}
+          filename: dist/${{ steps.plugin-meta.outputs.PLUGIN }}
+
+      - name: ci/push-plugin-sign
+        uses: sonatype-nexus-community/nexus-repo-github-action@master
+        with:
+          serverUrl: ${{ inputs.artifacts_url }}
+          username: ${{ steps.publish-secrets.outputs.ARTIFACTS_USERNAME }}
+          password: ${{ steps.publish-secrets.outputs.ARTIFACTS_PASSWORD }}
+          format: raw
+          repository: ${{ inputs.artifacts_repository }}
+          coordinates: directory=plugins/${{ steps.plugin-meta.outputs.PLUGIN_ID }}/${{ steps.plugin-meta.outputs.PLUGIN_VERSION }}
+          assets: filename=${{ steps.plugin-meta.outputs.PLUGIN }}.sig
+          filename: dist/${{ steps.plugin-meta.outputs.PLUGIN }}.sig
+
+      - name: ci/plugin-json
+        uses: https://git.wilix.dev/wilix-infra/actions/.gitea/actions/plugin/json@master
+        with:
+          plugin_id: ${{ steps.plugin-meta.outputs.PLUGIN_ID }}
+          plugin_version: ${{ steps.plugin-meta.outputs.PLUGIN_VERSION }}
+          enterprise: ${{ steps.plugin-meta.outputs.ENTERPRISE }}
+          beta: ${{ steps.plugin-meta.outputs.BETA }}
+          experimental: ${{ steps.plugin-meta.outputs.EXPERIMENTAL }}
+          artifacts_url: ${{ inputs.artifacts_url }}
+          artifacts_repository: ${{ inputs.artifacts_repository }}
+
+      - name: ci/push-plugin-json
+        uses: sonatype-nexus-community/nexus-repo-github-action@master
+        with:
+          serverUrl: ${{ inputs.artifacts_url }}
+          username: ${{ steps.publish-secrets.outputs.ARTIFACTS_USERNAME }}
+          password: ${{ steps.publish-secrets.outputs.ARTIFACTS_PASSWORD }}
+          format: raw
+          repository: ${{ inputs.artifacts_repository }}
+          coordinates: directory=plugins/${{ steps.plugin-meta.outputs.PLUGIN_ID }}/${{ steps.plugin-meta.outputs.PLUGIN_VERSION }}
+          assets: filename=${{ steps.plugin-meta.outputs.PLUGIN }}.json
+          filename: dist/${{ steps.plugin-meta.outputs.PLUGIN }}.json

.gitea/workflows/loop-plugin-channel-export-template.yml

@@ -0,0 +1,136 @@
+name: Build and sign plugin with marketplace json formation
+on:
+  workflow_call:
+    inputs:
+      go_version:
+        required: false
+        description: 'GO version'
+      go_cache:
+        required: false
+        description: 'For direct disable go-cache if needed'
+      node_version:
+        required: false
+        description: 'Node.js version'
+      vault_secrets_base_path:
+        required: true
+        description: 'Base vault secret path'
+      artifacts_url:
+        required: true
+        description: 'Artifacts URL'
+      artifacts_repository:
+        required: true
+        description: 'Artifacts repository'
+    secrets:
+      VAULT_ROLE_ID:
+        required: true
+      VAULT_SECRET_ID:
+        required: true
+
+jobs:
+  release:
+    name: release
+    runs-on: ubuntu-22.04
+    steps:
+      - name: ci/checkout-repo
+        uses: actions/checkout@v3
+
+      - id: publish-secrets
+        name: ci/publish-secrets
+        uses: https://github.com/hashicorp/vault-action@v2
+        with:
+          url: https://vault.wilix.dev
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets: |
+            ${{ inputs.vault_secrets_base_path }} ARTIFACTS_USERNAME ;
+            ${{ inputs.vault_secrets_base_path }} ARTIFACTS_PASSWORD ;
+
+      - id: key
+        name: ci/key
+        uses: https://github.com/hashicorp/vault-action@v2
+        with:
+          url: https://vault.wilix.dev
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets: |
+            ${{ inputs.vault_secrets_base_path }} SIGN_PRIVATE_KEY_EXPORTED ;
+            ${{ inputs.vault_secrets_base_path }} SIGN_PRIVATE_KEY_ID ;
+            ${{ inputs.vault_secrets_base_path }} SIGN_PRIVATE_KEY_PASSPHRASE ;
+
+      - id: plugin-meta
+        name: ci/plugin-meta
+        shell: bash
+        run: |
+          apt-get update
+          apt-get install -y jq
+          echo "PLUGIN=$(jq -r '.id + "-" + .version + ".tar.gz"' plugin.json)" >> "$GITHUB_OUTPUT"
+          echo "PLUGIN_ID=$(jq -r '.id' plugin.json)" >> "$GITHUB_OUTPUT"
+          echo "PLUGIN_VERSION=$(jq -r '.version' plugin.json)" >> "$GITHUB_OUTPUT" 
+          echo "ENTERPRISE=$(jq -r '.props.enterprise == true' plugin.json)" >> "$GITHUB_OUTPUT" 
+          echo "BETA=$(jq -r '.version | contains("SNAPSHOT")' plugin.json)" >> "$GITHUB_OUTPUT" 
+          echo "EXPERIMENTAL=$(jq -r '.props.experimental == true' plugin.json)" >> "$GITHUB_OUTPUT"
+
+      - name: ci/plugin-build
+        uses: https://git.wilix.dev/wilix-infra/actions/.gitea/actions/plugin/build-channel-export@master
+        with:
+          go_version: ${{ inputs.go_version }}
+          go_cache: ${{ inputs.go_cache }}
+          node_version: ${{ inputs.node_version }}
+          ssh_key: ${{ secrets.AI_DEPLOY_KEY }}
+
+      - name: ci/plugin-sign
+        uses: https://git.wilix.dev/wilix-infra/actions/.gitea/actions/file-sign@master
+        with:
+          private_key: ${{ steps.key.outputs.SIGN_PRIVATE_KEY_EXPORTED }}
+          private_key_id: ${{ steps.key.outputs.SIGN_PRIVATE_KEY_ID }}
+          private_key_passphrase: ${{ steps.key.outputs.SIGN_PRIVATE_KEY_PASSPHRASE }}
+          filepath: ${{ gitea.workspace }}/dist/${{ steps.plugin-meta.outputs.PLUGIN }}
+
+      - name: ci/push-plugin
+        uses: sonatype-nexus-community/nexus-repo-github-action@master
+        with:
+          serverUrl: ${{ inputs.artifacts_url }}
+          username: ${{ steps.publish-secrets.outputs.ARTIFACTS_USERNAME }}
+          password: ${{ steps.publish-secrets.outputs.ARTIFACTS_PASSWORD }}
+          format: raw
+          repository: ${{ inputs.artifacts_repository }}
+          coordinates: directory=plugins/${{ steps.plugin-meta.outputs.PLUGIN_ID }}/${{ steps.plugin-meta.outputs.PLUGIN_VERSION }}
+          assets: filename=${{ steps.plugin-meta.outputs.PLUGIN }}
+          filename: dist/${{ steps.plugin-meta.outputs.PLUGIN }}
+
+      - name: ci/push-plugin-sign
+        uses: sonatype-nexus-community/nexus-repo-github-action@master
+        with:
+          serverUrl: ${{ inputs.artifacts_url }}
+          username: ${{ steps.publish-secrets.outputs.ARTIFACTS_USERNAME }}
+          password: ${{ steps.publish-secrets.outputs.ARTIFACTS_PASSWORD }}
+          format: raw
+          repository: ${{ inputs.artifacts_repository }}
+          coordinates: directory=plugins/${{ steps.plugin-meta.outputs.PLUGIN_ID }}/${{ steps.plugin-meta.outputs.PLUGIN_VERSION }}
+          assets: filename=${{ steps.plugin-meta.outputs.PLUGIN }}.sig
+          filename: dist/${{ steps.plugin-meta.outputs.PLUGIN }}.sig
+
+      - name: ci/plugin-json
+        uses: https://git.wilix.dev/wilix-infra/actions/.gitea/actions/plugin/json@master
+        with:
+          plugin_id: ${{ steps.plugin-meta.outputs.PLUGIN_ID }}
+          plugin_version: ${{ steps.plugin-meta.outputs.PLUGIN_VERSION }}
+          enterprise: ${{ steps.plugin-meta.outputs.ENTERPRISE }}
+          beta: ${{ steps.plugin-meta.outputs.BETA }}
+          experimental: ${{ steps.plugin-meta.outputs.EXPERIMENTAL }}
+          artifacts_url: ${{ inputs.artifacts_url }}
+          artifacts_repository: ${{ inputs.artifacts_repository }}
+
+      - name: ci/push-plugin-json
+        uses: sonatype-nexus-community/nexus-repo-github-action@master
+        with:
+          serverUrl: ${{ inputs.artifacts_url }}
+          username: ${{ steps.publish-secrets.outputs.ARTIFACTS_USERNAME }}
+          password: ${{ steps.publish-secrets.outputs.ARTIFACTS_PASSWORD }}
+          format: raw
+          repository: ${{ inputs.artifacts_repository }}
+          coordinates: directory=plugins/${{ steps.plugin-meta.outputs.PLUGIN_ID }}/${{ steps.plugin-meta.outputs.PLUGIN_VERSION }}
+          assets: filename=${{ steps.plugin-meta.outputs.PLUGIN }}.json
+          filename: dist/${{ steps.plugin-meta.outputs.PLUGIN }}.json

.gitea/workflows/loop-plugin-with-marketplace-template.yml

@@ -29,7 +29,7 @@ on:
 jobs:
   release:
     name: release
-    runs-on: ubuntu-22.04
+    runs-on: node-22
     steps:
       - name: ci/checkout-repo
         uses: actions/checkout@v3
@@ -57,7 +57,8 @@ jobs:
           secrets: |
             ${{ inputs.vault_secrets_base_path }} SIGN_PRIVATE_KEY_EXPORTED ;
             ${{ inputs.vault_secrets_base_path }} SIGN_PRIVATE_KEY_ID ;
-            ${{ inputs.vault_secrets_base_path }} SIGN_PRIVATE_KEY_PASSPHRASE ; 
+            ${{ inputs.vault_secrets_base_path }} SIGN_PRIVATE_KEY_PASSPHRASE ;
+            ${{ inputs.vault_secrets_base_path }} AI_DEPLOY_KEY ;
 
       - id: plugin-meta
         name: ci/plugin-meta
@@ -65,13 +66,18 @@ jobs:
         run: |
           apt-get update
           apt-get install -y jq
-          echo "PLUGIN=$(jq -r '.id + "-" + .version + ".tar.gz"' plugin.json)" >> "$GITHUB_OUTPUT" 
+          echo "PLUGIN=$(jq -r '.id + "-" + .version + ".tar.gz"' plugin.json)" >> "$GITHUB_OUTPUT"
-          echo "PLUGIN_ID=$(jq -r '.id' plugin.json)" >> "$GITHUB_OUTPUT" 
+          echo "PLUGIN_ID=$(jq -r '.id' plugin.json)" >> "$GITHUB_OUTPUT"
           echo "PLUGIN_VERSION=$(jq -r '.version' plugin.json)" >> "$GITHUB_OUTPUT" 
           echo "ENTERPRISE=$(jq -r '.props.enterprise == true' plugin.json)" >> "$GITHUB_OUTPUT" 
           echo "BETA=$(jq -r '.version | contains("SNAPSHOT")' plugin.json)" >> "$GITHUB_OUTPUT" 
           echo "EXPERIMENTAL=$(jq -r '.props.experimental == true' plugin.json)" >> "$GITHUB_OUTPUT"
 
+      - name: Decode Base64 secret
+        run: |
+          echo "${{ steps.key.outputs.AI_DEPLOY_KEY }}" | base64 --decode > /tmp/ssh_key
+          chmod 400 /tmp/ssh_key
+
       - name: ci/plugin-build
         uses: https://git.wilix.dev/wilix-infra/actions/.gitea/actions/plugin/build@master
         with:
@@ -87,17 +93,25 @@ jobs:
           private_key_passphrase: ${{ steps.key.outputs.SIGN_PRIVATE_KEY_PASSPHRASE }}
           filepath: ${{ gitea.workspace }}/dist/${{ steps.plugin-meta.outputs.PLUGIN }}
 
+      #- name: ci/push-plugin
+      #  uses: sonatype-nexus-community/nexus-repo-github-action@master
+      #  with:
+      #    serverUrl: ${{ inputs.artifacts_url }}
+      #    username: ${{ steps.publish-secrets.outputs.ARTIFACTS_USERNAME }}
+      #    password: ${{ steps.publish-secrets.outputs.ARTIFACTS_PASSWORD }}
+      #    format: raw
+      #    repository: ${{ inputs.artifacts_repository }}
+      #    coordinates: directory=plugins/${{ steps.plugin-meta.outputs.PLUGIN_ID }}/${{ steps.plugin-meta.outputs.PLUGIN_VERSION }}
+      #    assets: filename=${{ steps.plugin-meta.outputs.PLUGIN }}
+      #    filename: dist/${{ steps.plugin-meta.outputs.PLUGIN }}
+
       - name: ci/push-plugin
-        uses: sonatype-nexus-community/nexus-repo-github-action@master
+        run: |
-        with:
+          curl -u "${{ steps.publish-secrets.outputs.ARTIFACTS_USERNAME }}:${{ steps.publish-secrets.outputs.ARTIFACTS_PASSWORD }}" \
-          serverUrl: ${{ inputs.artifacts_url }}
+            -X POST "${{ inputs.artifacts_url }}/service/rest/v1/components?repository=${{ inputs.artifacts_repository }}" \
-          username: ${{ steps.publish-secrets.outputs.ARTIFACTS_USERNAME }}
+            -F "raw.directory=/plugins/${{ steps.plugin-meta.outputs.PLUGIN_ID }}/${{ steps.plugin-meta.outputs.PLUGIN_VERSION }}" \
-          password: ${{ steps.publish-secrets.outputs.ARTIFACTS_PASSWORD }}
+            -F "raw.asset1=@dist/${{ steps.plugin-meta.outputs.PLUGIN }}" \
-          format: raw
+            -F "raw.asset1.filename=${{ steps.plugin-meta.outputs.PLUGIN }}"
-          repository: ${{ inputs.artifacts_repository }}
-          coordinates: directory=plugins/${{ steps.plugin-meta.outputs.PLUGIN_ID }}/${{ steps.plugin-meta.outputs.PLUGIN_VERSION }}
-          assets: filename=${{ steps.plugin-meta.outputs.PLUGIN }}
-          filename: dist/${{ steps.plugin-meta.outputs.PLUGIN }}
 
       - name: ci/push-plugin-sign
         uses: sonatype-nexus-community/nexus-repo-github-action@master

.gitea/workflows/mobile-pull-request-check-template.yml

@@ -0,0 +1,115 @@
+name: Mobile pull request check
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        description: "Set node version"
+        default: 20
+        type: string
+      notification_enabled:
+        description: "Включение оповещений о разворачивании, требуется иметь url для оповещений в vault"
+        default: false
+        required: false
+        type: boolean
+      custom_notification_hook_enabled:
+        description: "Использовать ли кастомный url хук для оповещений (должен лежать в vault секрете проекта)"
+        default: false
+        required: false
+        type: boolean
+      notification_channel:
+        description: "Канал для оповещений о результатах деплоя"
+        default: internal_projects_notifications
+        required: false
+        type: string
+      vault_secrets_base_path:
+        description: 'Базовый путь для секретов проекта в vault'
+        required: false
+        type: string
+    secrets:
+      VAULT_ROLE_ID:
+        required: true
+      VAULT_SECRET_ID:
+        required: true
+
+env:
+  vault_main_base_path: dev/wilix/main/data/ci
+
+jobs:
+  check:
+    name: mobile check and test
+    runs-on: ubuntu-latest
+    steps:
+      - name: ci/checkout-repo
+        uses: actions/checkout@v3
+
+      - name: Use Node.js ${{ inputs.node-version }}
+        uses: https://github.com/actions/setup-node@v3
+        with:
+          node-version: ${{ inputs.node-version }}
+
+      - name: ci/prepare-node-deps
+        uses: ./.gitea/actions/prepare-node-deps
+
+      - name: ci/check-styles
+        shell: bash
+        run: |
+          echo "::group::check-styles"
+          npm run check
+          echo "::endgroup::"
+
+      - name: ci/run-tests
+        shell: bash
+        run: |
+          echo "::group::run-tests"
+          npm run test:ci
+          echo "::endgroup::"
+
+      - name: Get general notification url
+        if: ${{ inputs.notification_enabled && ! inputs.custom_notification_hook_enabled && (job.status == 'success' || job.status == 'failure') }}
+        uses: https://github.com/hashicorp/vault-action@v2
+        with:
+          url: https://vault.wilix.dev
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets: |
+            ${{ env.vault_main_base_path }} notification_url | MATTERMOST_WEBHOOK_URL ;
+
+      - name: Get custom notification url
+        if: ${{ inputs.notification_enabled && inputs.custom_notification_hook_enabled && (job.status == 'success' || job.status == 'failure') }}
+        uses: https://github.com/hashicorp/vault-action@v2
+        with:
+          url: https://vault.wilix.dev
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets: |
+            ${{ inputs.vault_secrets_base_path }} notification_url | MATTERMOST_WEBHOOK_URL ;
+
+      - name: prepare failed notification body
+        if: ${{ inputs.notification_enabled && job.status == 'failure' }}
+        uses: https://github.com/finnp/create-file-action@master
+        env:
+          FILE_NAME: "mattermost.json"
+          FILE_DATA: |
+            {
+              "channel": "${{ inputs.notification_channel }}",
+              "attachments": [
+                {
+                  "fallback": "Проверка упала ${{ gitea.repository }}",
+                  "text": "@${{ gitea.actor }} упала тестовая сборка",
+                  "color": "#FF0000",
+                  "fields": [
+                    {
+                      "short": true,
+                      "title": "Сборка",
+                      "value": "https://git.wilix.dev/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}"
+                    }
+                  ]
+                }
+              ]
+            }
+
+      - name: loop fail notification
+        if: ${{ inputs.notification_enabled && job.status == 'failure' }}
+        uses: https://github.com/mattermost/action-mattermost-notify@1.1.0

.gitea/workflows/node-pull-request-check-template.yml

@@ -0,0 +1,112 @@
+name: Pull request check
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        description: "Set node version"
+        default: 20
+        type: string
+      yarn-commands:
+        description: "yarn-commands"
+        default: |-
+          yarn install
+          yarn test
+        type: string
+      notification_enabled:
+        description: "Включение оповещений о разворачивании, требуется иметь url для оповещений в vault"
+        default: false
+        required: false
+        type: boolean
+      custom_notification_hook_enabled:
+        description: "Использовать ли кастомный url хук для оповещений (должен лежать в vault секрете проекта)"
+        default: false
+        required: false
+        type: boolean
+      notification_channel:
+        description: "Канал для оповещений о результатах деплоя"
+        default: internal_projects_notifications
+        required: false
+        type: string
+      vault_secrets_base_path:
+        description: 'Базовый путь для секретов проекта в vault'
+        required: false
+        type: string
+      sonar_enabled:
+        default: false
+        required: false
+        type: boolean
+    secrets:
+      VAULT_ROLE_ID:
+        required: true
+      VAULT_SECRET_ID:
+        required: true
+
+env:
+  vault_main_base_path: dev/wilix/main/data/ci
+
+jobs:
+  check:
+    name: check and test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://github.com/actions/checkout@v3
+      - name: Use Node.js ${{ inputs.node-version }}
+        uses: https://github.com/actions/setup-node@v3
+        with:
+          node-version: ${{ inputs.node-version }}
+      - run: ${{ inputs.yarn-commands }}
+
+      - name: dockerfile lint check
+        uses: https://github.com/hadolint/hadolint-action@v3.1.0
+        with:
+          dockerfile: Dockerfile
+
+      - name: Get general notification url
+        if: ${{ inputs.notification_enabled && ! inputs.custom_notification_hook_enabled && (job.status == 'success' || job.status == 'failure') }}
+        uses: https://github.com/hashicorp/vault-action@v2
+        with:
+          url: https://vault.wilix.dev
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets: |
+            ${{ env.vault_main_base_path }} notification_url | MATTERMOST_WEBHOOK_URL ;
+
+      - name: Get custom notification url
+        if: ${{ inputs.notification_enabled && inputs.custom_notification_hook_enabled && (job.status == 'success' || job.status == 'failure') }}
+        uses: https://github.com/hashicorp/vault-action@v2
+        with:
+          url: https://vault.wilix.dev
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets: |
+            ${{ inputs.vault_secrets_base_path }} notification_url | MATTERMOST_WEBHOOK_URL ;
+
+      - name: prepare failed notification body
+        if: ${{ inputs.notification_enabled && job.status == 'failure' }}
+        uses: https://github.com/finnp/create-file-action@master
+        env:
+          FILE_NAME: "mattermost.json"
+          FILE_DATA: |
+            {
+              "channel": "${{ inputs.notification_channel }}",
+              "attachments": [
+                {
+                  "fallback": "Проверка упала ${{ gitea.repository }}",
+                  "text": "@${{ gitea.actor }} упала тестовая сборка",
+                  "color": "#FF0000",
+                  "fields": [
+                    {
+                      "short": true,
+                      "title": "Сборка",
+                      "value": "https://git.wilix.dev/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}"
+                    }
+                  ]
+                }
+              ]
+            }
+
+      - name: loop fail notification
+        if: ${{ inputs.notification_enabled && job.status == 'failure' }}
+        uses: https://github.com/mattermost/action-mattermost-notify@1.1.0

.gitea/workflows/werf-cleanup-template.yml

@@ -26,7 +26,7 @@ env:
 jobs:
   cleanup:
     name: Cleanup
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - uses: https://github.com/actions/checkout@v3
       - name: Fetch all history for all tags and branches

.gitea/workflows/werf-deploy-template.yml

@@ -55,6 +55,10 @@ on:
         required: true
       VAULT_SECRET_ID:
         required: true
+      # Optional: Docker/npm private registry token (passed as WERF_BUILD_ARG_NPM_TOKEN).
+      # Callers that build images needing @scope packages from Nexus should pass this.
+      NPM_TOKEN:
+        required: false
 
 env:
   vault_main_base_path: dev/wilix/main/data/ci
@@ -62,7 +66,7 @@ env:
 jobs:
   converge:
     name: Deploy stand
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
 
       - name: Checkout code
@@ -117,6 +121,36 @@ jobs:
         if: ${{ inputs.werf_debug }}
         run: echo "WERF_LOG_DEBUG=true" >> "$GITHUB_ENV"
 
+      # Prefer Gitea secret; fall back to Vault project CI secret (same base path as werf key).
+      - id: import-npm-token
+        name: Get NPM_TOKEN from vault (fallback)
+        continue-on-error: true
+        uses: https://github.com/hashicorp/vault-action@v2
+        with:
+          url: https://vault.wilix.dev
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets: |
+            ${{ inputs.vault_secrets_base_path }} NPM_TOKEN | VAULT_NPM_TOKEN ;
+
+      - name: Resolve NPM_TOKEN for Docker build-args
+        id: resolve-npm-token
+        run: |
+          TOKEN="${{ secrets.NPM_TOKEN }}"
+          if [ -z "$TOKEN" ]; then
+            TOKEN="${{ steps.import-npm-token.outputs.VAULT_NPM_TOKEN }}"
+          fi
+          if [ -z "$TOKEN" ]; then
+            echo "NPM_TOKEN is empty. Set Gitea Actions secret NPM_TOKEN or Vault key" >&2
+            echo "  ${{ inputs.vault_secrets_base_path }} → NPM_TOKEN" >&2
+            exit 1
+          fi
+          # Mask + export for werf (WERF_BUILD_ARG_* → docker --build-arg)
+          echo "::add-mask::$TOKEN"
+          echo "NPM_TOKEN=$TOKEN" >> "$GITHUB_ENV"
+          echo "WERF_BUILD_ARG_NPM_TOKEN=$TOKEN" >> "$GITHUB_ENV"
+
       - name: Deploy
         run: werf converge
         env:
@@ -197,5 +231,5 @@ jobs:
             }
 
       - name: loop fail notification
-        uses: https://github.com/mattermost/action-mattermost-notify@master
+        uses: https://github.com/mattermost/action-mattermost-notify@1.1.0
         if: ${{ inputs.notification_enabled && (job.status == 'success' || job.status == 'failure') }}

.gitea/workflows/werf-yonote-cleanup-template.yml

@@ -0,0 +1,68 @@
+name: Cleanup Yonote Docker registry
+on:
+  workflow_call:
+    inputs:
+      docker_repo_path:
+        default: private.docker.wilix.dev
+        required: false
+        type: string
+      docker_images_path:
+        description: 'Относительный путь для образов проекта'
+        required: true
+        type: string
+      werf_debug:
+        default: false
+        required: false
+        type: boolean
+    secrets:
+      VAULT_ROLE_ID:
+        required: true
+      VAULT_SECRET_ID:
+        required: true
+
+env:
+  vault_main_base_path: dev/wilix/main/data/ci
+
+jobs:
+  cleanup:
+    name: Cleanup
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://github.com/actions/checkout@v3
+      - name: Fetch all history for all tags and branches
+        run: git fetch --prune --unshallow
+
+      # FIXME Эти секреты нужно будет сделать полностью различными для проектов, идеально - краткосрочные генерируемые vault
+      - id: import-secrets
+        uses: https://github.com/hashicorp/vault-action@v2
+        with:
+          url: https://vault.wilix.dev
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets: |
+            ${{ env.vault_main_base_path }} local_cluster_kube_config_base64 ;
+            ${{ env.vault_main_base_path }} docker_registry_username ;
+            ${{ env.vault_main_base_path }} docker_registry_password ;
+            dev/wilix/yonote/data/ci/yonote NPM_AUTH_TOKEN ;
+        
+      - name: Login to wilix nexus Container Registry
+        uses: https://github.com/docker/login-action@v2
+        with:
+          registry: ${{ inputs.docker_repo_path }}
+          username: ${{ steps.import-secrets.outputs.docker_registry_username }}
+          password: ${{ steps.import-secrets.outputs.docker_registry_password }}
+
+      - name: Install werf
+        uses: https://github.com/werf/actions/install@v1.2
+
+      - name: Setup debug if need
+        if: ${{ inputs.werf_debug }}
+        run: echo "WERF_LOG_DEBUG=true" >> "$GITHUB_ENV"
+
+      - name: Cleanup
+        run: werf cleanup
+        env:
+          WERF_REPO: ${{ inputs.docker_repo_path }}/${{ inputs.docker_images_path }}
+          WERF_KUBECONFIG_BASE64: ${{ steps.import-secrets.outputs.local_cluster_kube_config_base64 }}
+          NPM_AUTH_TOKEN: ${{ steps.import-secrets.outputs.NPM_AUTH_TOKEN }}

.gitea/workflows/yonote-node-pull-request-check-template.yml

@@ -0,0 +1,107 @@
+name: Pull request check
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        description: "Set node version"
+        default: 20
+        type: string
+      yarn-commands:
+        description: "yarn-commands"
+        default: |-
+          yarn install
+          yarn test
+        type: string
+      notification_enabled:
+        description: "Включение оповещений о разворачивании, требуется иметь url для оповещений в vault"
+        default: false
+        required: false
+        type: boolean
+      custom_notification_hook_enabled:
+        description: "Использовать ли кастомный url хук для оповещений (должен лежать в vault секрете проекта)"
+        default: false
+        required: false
+        type: boolean
+      notification_channel:
+        description: "Канал для оповещений о результатах деплоя"
+        default: internal_projects_notifications
+        required: false
+        type: string
+      vault_secrets_base_path:
+        description: 'Базовый путь для секретов проекта в vault'
+        required: false
+        type: string
+      sonar_enabled:
+        default: false
+        required: false
+        type: boolean
+    secrets:
+      VAULT_ROLE_ID:
+        required: true
+      VAULT_SECRET_ID:
+        required: true
+
+env:
+  vault_main_base_path: dev/wilix/main/data/ci
+
+jobs:
+  check:
+    name: check and test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://github.com/actions/checkout@v3
+      - name: Use Node.js ${{ inputs.node-version }}
+        uses: https://github.com/actions/setup-node@v3
+        with:
+          node-version: ${{ inputs.node-version }}
+      - run: ${{ inputs.yarn-commands }}
+
+      - name: Get general notification url
+        if: ${{ inputs.notification_enabled && ! inputs.custom_notification_hook_enabled && (job.status == 'success' || job.status == 'failure') }}
+        uses: https://github.com/hashicorp/vault-action@v2
+        with:
+          url: https://vault.wilix.dev
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets: |
+            ${{ env.vault_main_base_path }} notification_url | MATTERMOST_WEBHOOK_URL ;
+
+      - name: Get custom notification url
+        if: ${{ inputs.notification_enabled && inputs.custom_notification_hook_enabled && (job.status == 'success' || job.status == 'failure') }}
+        uses: https://github.com/hashicorp/vault-action@v2
+        with:
+          url: https://vault.wilix.dev
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets: |
+            ${{ inputs.vault_secrets_base_path }} notification_url | MATTERMOST_WEBHOOK_URL ;
+
+      - name: prepare failed notification body
+        if: ${{ inputs.notification_enabled && job.status == 'failure' }}
+        uses: https://github.com/finnp/create-file-action@master
+        env:
+          FILE_NAME: "mattermost.json"
+          FILE_DATA: |
+            {
+              "channel": "${{ inputs.notification_channel }}",
+              "attachments": [
+                {
+                  "fallback": "Проверка упала ${{ gitea.repository }}",
+                  "text": "@${{ gitea.actor }} упала тестовая сборка",
+                  "color": "#FF0000",
+                  "fields": [
+                    {
+                      "short": true,
+                      "title": "Сборка",
+                      "value": "https://git.wilix.dev/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}"
+                    }
+                  ]
+                }
+              ]
+            }
+
+      - name: loop fail notification
+        if: ${{ inputs.notification_enabled && job.status == 'failure' }}
+        uses: https://github.com/mattermost/action-mattermost-notify@1.1.0