feat(ci): enhance caching strategy and update workflows for pnpm and Go

- Updated CI workflows to export cache paths for pnpm and Go, improving cache efficiency and reducing package download times.
- Replaced corepack enable step with cache path exports in multiple workflows.
- Adjusted cache paths to utilize environment variables for better flexibility and clarity.
- Enhanced README documentation to reflect changes in caching mechanisms and runner configurations.

.gitea/README.md

@@ -14,7 +14,11 @@ Job **changes** вычисляет флаги по путям в diff. Полн
 
 На **pull request** — **commitlint**. При изменении `deploy/docker/**` — job **docker-check** (`bake --print`, bake без `--push` если есть доступ к registry).
 
-Кэш зависимостей: `actions/cache` с ключом `sha256sum` lockfile (`go.sum` / `pnpm-lock.yaml`). `hashFiles` в Gitea не используем.
+Кэш зависимостей — нативный `actions/cache` (cache server act_runner), ключ `sha256sum` lockfile (не `hashFiles`). Пути **абсолютные** (`$HOME/.pnpm-store`, `go env GOMODCACHE` / `GOCACHE`): тильда `~` на Gitea часто не раскрывается и даёт вечный miss.
+
+Кэшируется целиком: pnpm store + `node_modules` + corepack; Go modules + GOCACHE + `golangci-lint` в `GOBIN`. При hit: `pnpm install --offline`, `go mod download` без сети. `setup-go cache:` и `golangci-lint-action` не используем — они завязаны на `hashFiles`.
+
+Если restore пишет `connect ECONNREFUSED` / `cache server not configured` — на runner включите cache server (см. ниже). Иначе каждый job снова качает пакеты (~минуты).
 
 Runner: `ubuntu-latest`, **bird2** из apt, Docker для **docker-check** (PR) и **publish** (CD).
 
@@ -24,7 +28,7 @@ Runner: `ubuntu-latest`, **bird2** из apt, Docker для **docker-check** (PR)
 
 1. `pnpm exec semantic-release` — тег `vX.Y.Z` на **текущий commit** (без дополнительного commit в main).
 2. Gitea Release + `CHANGELOG.md` как attachment (не в git).
-3. Зеркало base-образов в `evobgp-buildcache:base-*` (`deploy/docker/mirror-base-images.sh`).
+3. Зеркало base-образов в `evobgp-buildcache:base-*` (`deploy/docker/mirror-base-images.sh`; skip существующих тегов, `linux/amd64`, retry при 429).
 4. `docker buildx bake default --push` с `VERSION=X.Y.Z`, `pull=false`, named builder `evobgp` (`cleanup: false`).
 
 Если releasable-коммитов нет — semantic-release no-op, образы не публикуются.
@@ -58,3 +62,21 @@ docker pull git.shx.one/myuser/evobgp-api:1.2.3
 ```
 
 См. [deploy/docker/README.md](../deploy/docker/README.md), [docs/quickstart.md](../docs/quickstart.md).
+
+## act_runner: cache server
+
+`actions/cache` ходит в **встроенный cache server** runner (не GitHub `type=gha`). Кэш локален для этого runner.
+
+В `config.yaml` runner:
+
+```yaml
+cache:
+  enabled: true
+  dir: ""          # по умолчанию $HOME/.cache/actcache
+  host: ""         # IP, доступный из job-контейнера (не 0.0.0.0)
+  port: 8088
+```
+
+Если runner в Docker, а jobs — отдельные контейнеры: пробросьте порт и задайте `host` (LAN IP хоста) или `external_server: "http://<host>:8088/"`. Иначе restore — timeout/ECONNREFUSED и пакеты качаются снова.
+
+Не делайте `docker system prune -a` по cron: сотрётся и Docker-кэш FROM, и пользы от `cleanup: false` у buildx не будет.

.gitea/workflows/cd.yaml

@@ -39,18 +39,26 @@ jobs:
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
-      - name: Enable pnpm via corepack
+      - name: Export cache paths
-        run: corepack enable
+        run: sh scripts/ci/export-cache-env.sh
       - id: pnpm-hash
         run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      - id: pnpm-cache
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
-          path: ~/.local/share/pnpm/store
+          path: |
+            ${{ env.PNPM_STORE_DIR }}
+            ${{ env.COREPACK_HOME }}
+            node_modules
+            apps/web/node_modules
+            packages/ui/node_modules
           key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
           restore-keys: |
             pnpm-${{ runner.os }}-
       - name: Install release tooling
-        run: pnpm install --frozen-lockfile
+        env:
+          PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
+        run: sh scripts/ci/pnpm-ci.sh
       - name: Verify releasable commit messages
         run: pnpm exec node scripts/commit/verify-release-commits.mjs
       - name: Semantic release
@@ -108,10 +116,9 @@ jobs:
           password: ${{ secrets.ACTIONS_PAT }}
       - name: Mirror base images into buildcache
         if: steps.rel.outputs.released == 'true'
-        id: mirror
-        continue-on-error: true
         env:
           REGISTRY: git.shx.one/${{ steps.meta.outputs.owner_lc }}
+          MIRROR_ENV_FILE: ${{ runner.temp }}/mirror-base.env
         run: sh deploy/docker/mirror-base-images.sh
       - name: Build and push images (bake)
         if: steps.rel.outputs.released == 'true'
@@ -126,16 +133,16 @@ jobs:
           CACHE_REF_WEB: git.shx.one/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:web-buildcache
           CACHE_REF_BIRDC: git.shx.one/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:birdc-buildcache
           BUILDX_BAKE_ENTITLEMENTS_FS: "0"
+          BUILDX_BAKE_FILE_RELATIVE_PATHS: "1"
+          MIRROR_ENV_FILE: ${{ runner.temp }}/mirror-base.env
+        working-directory: deploy/docker
         run: |
           set -euxo pipefail
-          cache="git.shx.one/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache"
+          if [ -f "${MIRROR_ENV_FILE}" ]; then
-          if [ "${{ steps.mirror.outcome }}" = "success" ]; then
+            set -a
-            export BASE_GOLANG="${cache}:base-golang-1.24-alpine"
+            # shellcheck disable=SC1090
-            export BASE_DEBIAN="${cache}:base-debian-bookworm-slim"
+            . "${MIRROR_ENV_FILE}"
-            export BASE_NODE="${cache}:base-node-22-alpine"
+            set +a
-            export BASE_NGINX="${cache}:base-nginx-1.27-alpine"
-            export BASE_UBUNTU="${cache}:base-ubuntu-noble"
-            export BASE_DISTROLESS="${cache}:base-distroless-static-debian12-nonroot"
           fi
           docker buildx bake --allow=fs.read="${{ github.workspace }}" \
-            -f deploy/docker/docker-bake.hcl default --push
+            -f docker-bake.hcl default --push

.gitea/workflows/quality.yaml

@@ -183,20 +183,28 @@ jobs:
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
-      - name: Enable pnpm via corepack
+      - name: Export cache paths
-        run: corepack enable
+        run: sh scripts/ci/export-cache-env.sh
       - id: pnpm-hash
         run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      - id: pnpm-cache
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
-          path: ~/.local/share/pnpm/store
+          path: |
+            ${{ env.PNPM_STORE_DIR }}
+            ${{ env.COREPACK_HOME }}
+            node_modules
+            apps/web/node_modules
+            packages/ui/node_modules
           key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
           restore-keys: |
             pnpm-${{ runner.os }}-
       - name: pnpm install, Redocly, codegen check
+        env:
+          PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
         run: |
           set -euxo pipefail
-          pnpm install --frozen-lockfile
+          sh scripts/ci/pnpm-ci.sh
           pnpm exec redocly lint docs/openapi.yaml
           chmod +x scripts/check-openapi-gen.sh
           sh scripts/check-openapi-gen.sh
@@ -210,20 +218,28 @@ jobs:
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
-      - name: Enable pnpm via corepack
+      - name: Export cache paths
-        run: corepack enable
+        run: sh scripts/ci/export-cache-env.sh
       - id: pnpm-hash
         run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      - id: pnpm-cache
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
-          path: ~/.local/share/pnpm/store
+          path: |
+            ${{ env.PNPM_STORE_DIR }}
+            ${{ env.COREPACK_HOME }}
+            node_modules
+            apps/web/node_modules
+            packages/ui/node_modules
           key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
           restore-keys: |
             pnpm-${{ runner.os }}-
       - name: pnpm install, typecheck, lint, test, build
+        env:
+          PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
         run: |
           set -euxo pipefail
-          pnpm install --frozen-lockfile
+          sh scripts/ci/pnpm-ci.sh
           pnpm --filter @evobgp/web run typecheck
           pnpm --filter @evobgp/web run lint
           pnpm --filter @evobgp/web run test
@@ -239,17 +255,29 @@ jobs:
         with:
           go-version: "1.24"
           cache: false
+      - name: Export cache paths
+        run: sh scripts/ci/export-cache-env.sh
       - id: go-hash
         run: echo "key=$(sha256sum go.sum | awk '{print $1}')" >> "$GITHUB_OUTPUT"
       - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: |
-            ~/go/pkg/mod
+            ${{ env.GOMODCACHE }}
-            ~/.cache/go-build
+            ${{ env.GOCACHE }}
-          key: go-${{ runner.os }}-${{ steps.go-hash.outputs.key }}
+            ${{ env.GOBIN }}
+            ${{ env.GOLANGCI_LINT_CACHE }}
+          key: go-${{ runner.os }}-1.24-gl1.64.8-${{ steps.go-hash.outputs.key }}
           restore-keys: |
-            go-${{ runner.os }}-
+            go-${{ runner.os }}-1.24-gl1.64.8-
+            go-${{ runner.os }}-1.24-
+      - name: Download modules
+        env:
+          GOMODCACHE: ${{ env.GOMODCACHE }}
+          GOCACHE: ${{ env.GOCACHE }}
+        run: go mod download
       - name: Vet
+        env:
+          GOFLAGS: -mod=readonly
         run: go vet ./...
       - name: Lint httpapi (ERR-01 / ARCH-01)
         run: sh scripts/lint-httpapi.sh
@@ -258,13 +286,20 @@ jobs:
       - name: Validate remote speaker compose
         run: sh scripts/validate-remote-speaker-compose.sh
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2
+        env:
-        with:
+          GOLANGCI_LINT_VERSION: v1.64.8
-          version: v1.64.8
+        run: sh scripts/ci/golangci-lint.sh
-          skip-cache: true
       - name: Test
+        env:
+          GOFLAGS: -mod=readonly
+          GOMODCACHE: ${{ env.GOMODCACHE }}
+          GOCACHE: ${{ env.GOCACHE }}
         run: go test ./... -race -count=1
       - name: Build all commands
+        env:
+          GOFLAGS: -mod=readonly
+          GOMODCACHE: ${{ env.GOMODCACHE }}
+          GOCACHE: ${{ env.GOCACHE }}
         run: |
           set -euxo pipefail
           out="${RUNNER_TEMP}/evobgp-bin"
@@ -321,13 +356,19 @@ jobs:
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
-      - name: Enable pnpm via corepack
+      - name: Export cache paths
-        run: corepack enable
+        run: sh scripts/ci/export-cache-env.sh
       - id: pnpm-hash
         run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      - id: pnpm-cache
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
-          path: ~/.local/share/pnpm/store
+          path: |
+            ${{ env.PNPM_STORE_DIR }}
+            ${{ env.COREPACK_HOME }}
+            node_modules
+            apps/web/node_modules
+            packages/ui/node_modules
           key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
           restore-keys: |
             pnpm-${{ runner.os }}-
@@ -335,9 +376,10 @@ jobs:
         env:
           BASE_SHA: ${{ inputs.base_sha }}
           HEAD_SHA: ${{ inputs.head_sha }}
+          PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
         run: |
           set -euxo pipefail
-          pnpm install --frozen-lockfile
+          sh scripts/ci/pnpm-ci.sh
           pnpm exec commitlint --from "$BASE_SHA" --to "$HEAD_SHA"
 
   docker-check:
@@ -366,12 +408,14 @@ jobs:
         working-directory: deploy/docker
         env:
           BUILDX_BAKE_ENTITLEMENTS_FS: "0"
+          BUILDX_BAKE_FILE_RELATIVE_PATHS: "1"
         run: docker buildx bake --allow=fs.read="${{ github.workspace }}" -f docker-bake.hcl --print default
       - name: bake (no push)
         if: inputs.allow_registry_login
         working-directory: deploy/docker
         env:
           BUILDX_BAKE_ENTITLEMENTS_FS: "0"
+          BUILDX_BAKE_FILE_RELATIVE_PATHS: "1"
           CACHE_REF_GO: git.shx.one/${{ github.repository_owner }}/evobgp-buildcache:go-buildcache
           CACHE_REF_WEB: git.shx.one/${{ github.repository_owner }}/evobgp-buildcache:web-buildcache
           CACHE_REF_BIRDC: git.shx.one/${{ github.repository_owner }}/evobgp-buildcache:birdc-buildcache

deploy/docker/README.md

@@ -27,7 +27,7 @@ BuildKit кэширует `/go/pkg/mod`, `~/.cache/go-build` и pnpm store че
 - `git.shx.one/<owner>/evobgp-buildcache:go-buildcache` — **запись** только из `go-build-all`
 - `git.shx.one/<owner>/evobgp-buildcache:web-buildcache` — **запись** только из `web-build`
 - `git.shx.one/<owner>/evobgp-buildcache:birdc-buildcache` — **запись** только из `go-birdc`
-- `git.shx.one/<owner>/evobgp-buildcache:base-*` — зеркало FROM-образов (`mirror-base-images.sh`), без rebuild
+- `git.shx.one/<owner>/evobgp-buildcache:base-*` — зеркало FROM с **Docker Hub** (`docker.io/library/…`; distroless — `gcr.io`). Только `linux/amd64`; skip если тег уже в Gitea. Неуспешный copy не валит CD — bake берёт Docker Hub FROM для этой базы.
 
 `pull = false` в bake: не перекачивать FROM, если слой уже в builder. Не запускайте `docker system prune -a` на runner.
 
@@ -56,7 +56,7 @@ docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl web-images
 docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl --print default
 ```
 
-В `docker-bake.hcl`: `context = "../.."` (корень репо), `dockerfile = "deploy/docker/…"` (путь от корня репо).
+В `docker-bake.hcl`: `context = "../.."` резолвится **от cwd** (каталог `deploy/docker/`). `dockerfile` — путь от этого context (корень репо). Из корня репо не вызывать bake с `-f deploy/docker/docker-bake.hcl`: получится `lstat ../../deploy`. Можно задать `BUILDX_BAKE_FILE_RELATIVE_PATHS=1`.
 
 Один образ (legacy, target `build-all`):
 

deploy/docker/bird2/Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1.7
 # BIRD из репозитория Ubuntu (Noble 24.04 LTS) — актуальнее пакета Debian bookworm.
 # Stage bird2-base общий с evobgp-agent (одинаковые слои на speaker-VPS).
-ARG BASE_UBUNTU=public.ecr.aws/docker/library/ubuntu:noble
+ARG BASE_UBUNTU=docker.io/library/ubuntu:noble
 
 FROM ${BASE_UBUNTU} AS bird2-base
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \

deploy/docker/docker-bake.hcl

@@ -1,5 +1,6 @@
 # Единая сборка образов EvoBGP (buildx bake: -f deploy/docker/docker-bake.hcl).
-# context = "../.." — корень репозитория (относительно этого файла).
+# context = "../.." — корень репо. Bake резолвит context от cwd (не от HCL),
+# поэтому вызов из deploy/docker/ либо BUILDX_BAKE_FILE_RELATIVE_PATHS=1.
 # Переменные Bake читаются из окружения (см. docs.docker.com/build/bake/variables/).
 
 variable "REGISTRY" {
@@ -39,11 +40,11 @@ variable "CACHE_REF_BIRDC" {
 }
 
 variable "BASE_GOLANG" {
-  default = "public.ecr.aws/docker/library/golang:1.24-alpine"
+  default = "docker.io/library/golang:1.24-alpine"
 }
 
 variable "BASE_DEBIAN" {
-  default = "public.ecr.aws/docker/library/debian:bookworm-slim"
+  default = "docker.io/library/debian:bookworm-slim"
 }
 
 variable "BASE_DISTROLESS" {
@@ -51,15 +52,15 @@ variable "BASE_DISTROLESS" {
 }
 
 variable "BASE_NODE" {
-  default = "public.ecr.aws/docker/library/node:22-alpine"
+  default = "docker.io/library/node:22-alpine"
 }
 
 variable "BASE_NGINX" {
-  default = "public.ecr.aws/docker/library/nginx:1.27-alpine"
+  default = "docker.io/library/nginx:1.27-alpine"
 }
 
 variable "BASE_UBUNTU" {
-  default = "public.ecr.aws/docker/library/ubuntu:noble"
+  default = "docker.io/library/ubuntu:noble"
 }
 
 function "go-cache-from" {

deploy/docker/evobgp-web/Dockerfile

@@ -1,8 +1,8 @@
 # syntax=docker/dockerfile:1.7
 # React + Vite статическая панель EvoBGP + nginx.
 # Финальный stage `web` ожидает bake-контекст web-artifacts (= target:web-build).
-ARG BASE_NODE=public.ecr.aws/docker/library/node:22-alpine
+ARG BASE_NODE=docker.io/library/node:22-alpine
-ARG BASE_NGINX=public.ecr.aws/docker/library/nginx:1.27-alpine
+ARG BASE_NGINX=docker.io/library/nginx:1.27-alpine
 
 FROM ${BASE_NODE} AS deps
 WORKDIR /repo

deploy/docker/gobinary/Dockerfile

@@ -2,8 +2,8 @@
 # Универсальная сборка бинарей cmd/* (ARG BIN) или всех сразу (target build-all).
 # Воркеры (runtime): distroless static. api/all (runtime-birdc): debian-slim + birdc.
 # CI: docker buildx bake -f deploy/docker/docker-bake.hcl
-ARG BASE_GOLANG=public.ecr.aws/docker/library/golang:1.24-alpine
+ARG BASE_GOLANG=docker.io/library/golang:1.24-alpine
-ARG BASE_DEBIAN=public.ecr.aws/docker/library/debian:bookworm-slim
+ARG BASE_DEBIAN=docker.io/library/debian:bookworm-slim
 ARG BASE_DISTROLESS=gcr.io/distroless/static-debian12:nonroot
 
 FROM ${BASE_GOLANG} AS deps

deploy/docker/mirror-base-images.sh

@@ -2,27 +2,81 @@
 # Copy-by-digest зеркало базовых образов в Gitea Container Registry (без rebuild).
 # Требует: docker login в REGISTRY host, docker buildx.
 # REGISTRY=git.shx.one/<owner>  (без суффикса /evobgp-buildcache)
+#
+# Источник library-образов — Docker Hub (docker.io), не public.ecr.aws (429 Too Many Requests).
+# Если тег уже есть в Gitea — skip (без повторного pull).
+# Копируем только linux/amd64 — bake platforms совпадает, multi-arch индекс не нужен.
+# Шаг CD не должен падать: неуспешный copy оставляет bake на Docker Hub FROM для этой базы.
 set -eu
 REGISTRY="${REGISTRY:?REGISTRY required (git.shx.one/<owner>)}"
 CACHE_REPO="${REGISTRY}/evobgp-buildcache"
+ENV_FILE="${MIRROR_ENV_FILE:-}"
+PLATFORM="${MIRROR_PLATFORM:-linux/amd64}"
+RETRIES="${MIRROR_RETRIES:-4}"
+
+tmp="$(mktemp)"
+cleanup() { rm -f "$tmp"; }
+trap cleanup EXIT
+
+dest_exists() {
+  docker buildx imagetools inspect "$1" >/dev/null 2>&1
+}
+
+copy_retry() {
+  src="$1"
+  dest="$2"
+  n=0
+  while [ "$n" -lt "$RETRIES" ]; do
+    n=$((n + 1))
+    if docker buildx imagetools create --platform "$PLATFORM" --tag "$dest" "$src"; then
+      return 0
+    fi
+    delay=$((n * 25))
+    echo "mirror retry ${n}/${RETRIES}, sleep ${delay}s: ${dest}"
+    sleep "$delay"
+  done
+  return 1
+}
 
 mirror() {
   src="$1"
   tag="$2"
-  echo "mirror ${src} -> ${CACHE_REPO}:${tag}"
+  var="$3"
-  docker buildx imagetools create --tag "${CACHE_REPO}:${tag}" "${src}"
+  dest="${CACHE_REPO}:${tag}"
+  if dest_exists "$dest"; then
+    echo "skip (already in registry): ${dest}"
+    printf '%s=%s\n' "$var" "$dest" >>"$tmp"
+    return 0
+  fi
+  echo "mirror ${src} -> ${dest} (${PLATFORM})"
+  if copy_retry "$src" "$dest"; then
+    printf '%s=%s\n' "$var" "$dest" >>"$tmp"
+    return 0
+  fi
+  echo "warn: ${dest} not mirrored — bake uses Docker Hub FROM for ${var}"
+  return 0
 }
 
-mirror "public.ecr.aws/docker/library/golang:1.24-alpine" "base-golang-1.24-alpine"
+mirror "docker.io/library/golang:1.24-alpine" "base-golang-1.24-alpine" BASE_GOLANG
-mirror "public.ecr.aws/docker/library/debian:bookworm-slim" "base-debian-bookworm-slim"
+sleep 8
-mirror "public.ecr.aws/docker/library/node:22-alpine" "base-node-22-alpine"
+mirror "docker.io/library/debian:bookworm-slim" "base-debian-bookworm-slim" BASE_DEBIAN
-mirror "public.ecr.aws/docker/library/nginx:1.27-alpine" "base-nginx-1.27-alpine"
+sleep 8
-mirror "public.ecr.aws/docker/library/ubuntu:noble" "base-ubuntu-noble"
+mirror "docker.io/library/node:22-alpine" "base-node-22-alpine" BASE_NODE
-mirror "gcr.io/distroless/static-debian12:nonroot" "base-distroless-static-debian12-nonroot"
+sleep 8
+mirror "docker.io/library/nginx:1.27-alpine" "base-nginx-1.27-alpine" BASE_NGINX
+sleep 8
+mirror "docker.io/library/ubuntu:noble" "base-ubuntu-noble" BASE_UBUNTU
+sleep 8
+mirror "gcr.io/distroless/static-debian12:nonroot" "base-distroless-static-debian12-nonroot" BASE_DISTROLESS
 
-echo "BASE_GOLANG=${CACHE_REPO}:base-golang-1.24-alpine"
+echo "----- mirrored BASE_* -----"
-echo "BASE_DEBIAN=${CACHE_REPO}:base-debian-bookworm-slim"
+cat "$tmp"
-echo "BASE_NODE=${CACHE_REPO}:base-node-22-alpine"
+if [ -n "$ENV_FILE" ]; then
-echo "BASE_NGINX=${CACHE_REPO}:base-nginx-1.27-alpine"
+  env_dir="$(dirname "$ENV_FILE")"
-echo "BASE_UBUNTU=${CACHE_REPO}:base-ubuntu-noble"
+  if [ -d "$env_dir" ]; then
-echo "BASE_DISTROLESS=${CACHE_REPO}:base-distroless-static-debian12-nonroot"
+    cp "$tmp" "$ENV_FILE"
+    echo "wrote ${ENV_FILE}"
+  else
+    echo "warn: MIRROR_ENV_FILE dir missing (${env_dir}) — skip write"
+  fi
+fi

scripts/ci/export-cache-env.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env sh
+# Абсолютные пути для actions/cache: на act_runner «~» часто не раскрывается → cache miss.
+set -eu
+: "${GITHUB_ENV:?GITHUB_ENV required (Gitea/GitHub Actions)}"
+
+HOME_DIR="${HOME:-}"
+if [ -z "$HOME_DIR" ]; then
+  HOME_DIR="$(getent passwd "$(id -u)" 2>/dev/null | cut -d: -f6 || true)"
+fi
+HOME_DIR="${HOME_DIR:-/root}"
+
+if command -v go >/dev/null 2>&1; then
+  GOMODCACHE="$(go env GOMODCACHE)"
+  GOCACHE="$(go env GOCACHE)"
+  GOPATH="$(go env GOPATH)"
+else
+  GOMODCACHE="${HOME_DIR}/go/pkg/mod"
+  GOCACHE="${HOME_DIR}/.cache/go-build"
+  GOPATH="${HOME_DIR}/go"
+fi
+
+PNPM_STORE_DIR="${HOME_DIR}/.pnpm-store"
+COREPACK_HOME="${HOME_DIR}/.cache/node/corepack"
+GOBIN="${GOPATH}/bin"
+GOLANGCI_LINT_CACHE="${HOME_DIR}/.cache/golangci-lint"
+
+mkdir -p "$PNPM_STORE_DIR" "$COREPACK_HOME" "$GOMODCACHE" "$GOCACHE" "$GOBIN" "$GOLANGCI_LINT_CACHE"
+
+{
+  echo "HOME_DIR=${HOME_DIR}"
+  echo "PNPM_STORE_DIR=${PNPM_STORE_DIR}"
+  echo "COREPACK_HOME=${COREPACK_HOME}"
+  echo "GOMODCACHE=${GOMODCACHE}"
+  echo "GOCACHE=${GOCACHE}"
+  echo "GOPATH=${GOPATH}"
+  echo "GOBIN=${GOBIN}"
+  echo "GOLANGCI_LINT_CACHE=${GOLANGCI_LINT_CACHE}"
+} >> "$GITHUB_ENV"
+
+echo "cache-env HOME_DIR=${HOME_DIR}"
+echo "cache-env PNPM_STORE_DIR=${PNPM_STORE_DIR}"
+echo "cache-env GOMODCACHE=${GOMODCACHE}"
+echo "cache-env GOCACHE=${GOCACHE}"
+echo "cache-env GOBIN=${GOBIN}"

scripts/ci/golangci-lint.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env sh
+# Бинарь golangci-lint в GOBIN (кэш actions/cache), без goinstall и без hashFiles.
+set -eu
+VER="${GOLANGCI_LINT_VERSION:-v1.64.8}"
+: "${GOBIN:?GOBIN required — run scripts/ci/export-cache-env.sh after setup-go}"
+
+mkdir -p "$GOBIN"
+export PATH="${GOBIN}:${PATH}"
+if [ -n "${GOLANGCI_LINT_CACHE:-}" ]; then
+  mkdir -p "$GOLANGCI_LINT_CACHE"
+  export GOLANGCI_LINT_CACHE
+fi
+
+if [ ! -x "${GOBIN}/golangci-lint" ]; then
+  echo "install golangci-lint ${VER} -> ${GOBIN}"
+  curl -sSfL "https://raw.githubusercontent.com/golangci/golangci-lint/${VER}/install.sh" \
+    | sh -s -- -b "$GOBIN" "$VER"
+fi
+golangci-lint version
+golangci-lint run

scripts/ci/pnpm-ci.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env sh
+# pnpm install из кэша Gitea (store + node_modules). Без повторного download при hit.
+set -eu
+: "${PNPM_STORE_DIR:?PNPM_STORE_DIR required — run scripts/ci/export-cache-env.sh first}"
+
+export COREPACK_HOME="${COREPACK_HOME:-${HOME:-/root}/.cache/node/corepack}"
+mkdir -p "$PNPM_STORE_DIR" "$COREPACK_HOME"
+corepack enable
+pnpm config set store-dir "$PNPM_STORE_DIR"
+
+echo "pnpm store: $(pnpm store path)"
+echo "PNPM_CACHE_HIT=${PNPM_CACHE_HIT:-}"
+
+if [ "${PNPM_CACHE_HIT:-}" = "true" ]; then
+  if pnpm install --frozen-lockfile --offline; then
+    echo "pnpm install --offline (cache hit)"
+    exit 0
+  fi
+  echo "offline install failed — prefer-offline"
+fi
+pnpm install --frozen-lockfile --prefer-offline