fix(tests): improve concurrency handling in worker tests and enhance module cloning

- Added environment variable `EVOBGP_JOB_MAX_CONCURRENT` to control job concurrency in tests.
- Modified worker test to ensure proper synchronization of job processing by holding workers until both jobs are enqueued.
- Updated memory store methods to return cloned module instances, preventing unintended mutations of original modules during operations.

.gitea/README.md

@@ -14,7 +14,11 @@ Job **changes** вычисляет флаги по путям в diff. Полн
 
 На **pull request** — **commitlint**. При изменении `deploy/docker/**` — job **docker-check** (`bake --print`, bake без `--push` если есть доступ к registry).
 
-Кэш зависимостей: `actions/cache` с ключом `sha256sum` lockfile (`go.sum` / `pnpm-lock.yaml`). `hashFiles` в Gitea не используем.
+Кэш зависимостей — нативный `actions/cache` (cache server act_runner), ключ `sha256sum` lockfile (не `hashFiles`). Пути **абсолютные** (`$HOME/.pnpm-store`, `go env GOMODCACHE` / `GOCACHE`): тильда `~` на Gitea часто не раскрывается и даёт вечный miss.
+
+Кэшируется целиком: pnpm store + `node_modules` + corepack; Go modules + GOCACHE + `golangci-lint` в `GOBIN`. При hit: `pnpm install --offline`, `go mod download` без сети. `setup-go cache:` и `golangci-lint-action` не используем — они завязаны на `hashFiles`.
+
+Если restore пишет `connect ECONNREFUSED` / `cache server not configured` — на runner включите cache server (см. ниже). Иначе каждый job снова качает пакеты (~минуты).
 
 Runner: `ubuntu-latest`, **bird2** из apt, Docker для **docker-check** (PR) и **publish** (CD).
 
@@ -58,3 +62,21 @@ docker pull git.shx.one/myuser/evobgp-api:1.2.3
 ```
 
 См. [deploy/docker/README.md](../deploy/docker/README.md), [docs/quickstart.md](../docs/quickstart.md).
+
+## act_runner: cache server
+
+`actions/cache` ходит в **встроенный cache server** runner (не GitHub `type=gha`). Кэш локален для этого runner.
+
+В `config.yaml` runner:
+
+```yaml
+cache:
+  enabled: true
+  dir: ""          # по умолчанию $HOME/.cache/actcache
+  host: ""         # IP, доступный из job-контейнера (не 0.0.0.0)
+  port: 8088
+```
+
+Если runner в Docker, а jobs — отдельные контейнеры: пробросьте порт и задайте `host` (LAN IP хоста) или `external_server: "http://<host>:8088/"`. Иначе restore — timeout/ECONNREFUSED и пакеты качаются снова.
+
+Не делайте `docker system prune -a` по cron: сотрётся и Docker-кэш FROM, и пользы от `cleanup: false` у buildx не будет.

.gitea/workflows/cd.yaml

@@ -39,18 +39,26 @@ jobs:
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
-      - name: Enable pnpm via corepack
-        run: corepack enable
+      - name: Export cache paths
+        run: sh scripts/ci/export-cache-env.sh
       - id: pnpm-hash
         run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      - id: pnpm-cache
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
-          path: ~/.local/share/pnpm/store
+          path: |
+            ${{ env.PNPM_STORE_DIR }}
+            ${{ env.COREPACK_HOME }}
+            node_modules
+            apps/web/node_modules
+            packages/ui/node_modules
           key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
           restore-keys: |
             pnpm-${{ runner.os }}-
       - name: Install release tooling
-        run: pnpm install --frozen-lockfile
+        env:
+          PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
+        run: sh scripts/ci/pnpm-ci.sh
       - name: Verify releasable commit messages
         run: pnpm exec node scripts/commit/verify-release-commits.mjs
       - name: Semantic release

.gitea/workflows/quality.yaml

@@ -183,20 +183,28 @@ jobs:
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
-      - name: Enable pnpm via corepack
-        run: corepack enable
+      - name: Export cache paths
+        run: sh scripts/ci/export-cache-env.sh
       - id: pnpm-hash
         run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      - id: pnpm-cache
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
-          path: ~/.local/share/pnpm/store
+          path: |
+            ${{ env.PNPM_STORE_DIR }}
+            ${{ env.COREPACK_HOME }}
+            node_modules
+            apps/web/node_modules
+            packages/ui/node_modules
           key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
           restore-keys: |
             pnpm-${{ runner.os }}-
       - name: pnpm install, Redocly, codegen check
+        env:
+          PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
         run: |
           set -euxo pipefail
-          pnpm install --frozen-lockfile
+          sh scripts/ci/pnpm-ci.sh
           pnpm exec redocly lint docs/openapi.yaml
           chmod +x scripts/check-openapi-gen.sh
           sh scripts/check-openapi-gen.sh
@@ -210,20 +218,28 @@ jobs:
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
-      - name: Enable pnpm via corepack
-        run: corepack enable
+      - name: Export cache paths
+        run: sh scripts/ci/export-cache-env.sh
       - id: pnpm-hash
         run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      - id: pnpm-cache
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
-          path: ~/.local/share/pnpm/store
+          path: |
+            ${{ env.PNPM_STORE_DIR }}
+            ${{ env.COREPACK_HOME }}
+            node_modules
+            apps/web/node_modules
+            packages/ui/node_modules
           key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
           restore-keys: |
             pnpm-${{ runner.os }}-
       - name: pnpm install, typecheck, lint, test, build
+        env:
+          PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
         run: |
           set -euxo pipefail
-          pnpm install --frozen-lockfile
+          sh scripts/ci/pnpm-ci.sh
           pnpm --filter @evobgp/web run typecheck
           pnpm --filter @evobgp/web run lint
           pnpm --filter @evobgp/web run test
@@ -239,17 +255,29 @@ jobs:
         with:
           go-version: "1.24"
           cache: false
+      - name: Export cache paths
+        run: sh scripts/ci/export-cache-env.sh
       - id: go-hash
         run: echo "key=$(sha256sum go.sum | awk '{print $1}')" >> "$GITHUB_OUTPUT"
       - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: go-${{ runner.os }}-${{ steps.go-hash.outputs.key }}
+            ${{ env.GOMODCACHE }}
+            ${{ env.GOCACHE }}
+            ${{ env.GOBIN }}
+            ${{ env.GOLANGCI_LINT_CACHE }}
+          key: go-${{ runner.os }}-1.24-gl1.64.8-${{ steps.go-hash.outputs.key }}
           restore-keys: |
-            go-${{ runner.os }}-
+            go-${{ runner.os }}-1.24-gl1.64.8-
+            go-${{ runner.os }}-1.24-
+      - name: Download modules
+        env:
+          GOMODCACHE: ${{ env.GOMODCACHE }}
+          GOCACHE: ${{ env.GOCACHE }}
+        run: go mod download
       - name: Vet
+        env:
+          GOFLAGS: -mod=readonly
         run: go vet ./...
       - name: Lint httpapi (ERR-01 / ARCH-01)
         run: sh scripts/lint-httpapi.sh
@@ -258,13 +286,20 @@ jobs:
       - name: Validate remote speaker compose
         run: sh scripts/validate-remote-speaker-compose.sh
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2
-        with:
-          version: v1.64.8
-          skip-cache: true
+        env:
+          GOLANGCI_LINT_VERSION: v1.64.8
+        run: sh scripts/ci/golangci-lint.sh
       - name: Test
+        env:
+          GOFLAGS: -mod=readonly
+          GOMODCACHE: ${{ env.GOMODCACHE }}
+          GOCACHE: ${{ env.GOCACHE }}
         run: go test ./... -race -count=1
       - name: Build all commands
+        env:
+          GOFLAGS: -mod=readonly
+          GOMODCACHE: ${{ env.GOMODCACHE }}
+          GOCACHE: ${{ env.GOCACHE }}
         run: |
           set -euxo pipefail
           out="${RUNNER_TEMP}/evobgp-bin"
@@ -321,13 +356,19 @@ jobs:
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
-      - name: Enable pnpm via corepack
-        run: corepack enable
+      - name: Export cache paths
+        run: sh scripts/ci/export-cache-env.sh
       - id: pnpm-hash
         run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      - id: pnpm-cache
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
-          path: ~/.local/share/pnpm/store
+          path: |
+            ${{ env.PNPM_STORE_DIR }}
+            ${{ env.COREPACK_HOME }}
+            node_modules
+            apps/web/node_modules
+            packages/ui/node_modules
           key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
           restore-keys: |
             pnpm-${{ runner.os }}-
@@ -335,9 +376,10 @@ jobs:
         env:
           BASE_SHA: ${{ inputs.base_sha }}
           HEAD_SHA: ${{ inputs.head_sha }}
+          PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
         run: |
           set -euxo pipefail
-          pnpm install --frozen-lockfile
+          sh scripts/ci/pnpm-ci.sh
           pnpm exec commitlint --from "$BASE_SHA" --to "$HEAD_SHA"
 
   docker-check:

deploy/docker/README.md

@@ -14,8 +14,8 @@ BuildKit кэширует `/go/pkg/mod`, `~/.cache/go-build` и pnpm store че
 
 | Образ | Runtime base | Заметка |
 |-------|----------------|---------|
-| scheduler, ingest, render, deploy, node | `gcr.io/distroless/static-debian12:nonroot` | static Go (`CGO_ENABLED=0`), без shell |
-| api, all | `debian:bookworm-slim` + `birdc` | только клиент birdc, без демона `bird` |
+| scheduler, ingest, render | `gcr.io/distroless/static-debian12:nonroot` | static Go (`CGO_ENABLED=0`), без shell |
+| api, all, deploy, node | `debian:bookworm-slim` + `bird` + `birdc` | `bird -p` (parse-check) и `birdc`; демон не запускается |
 | agent | тот же Ubuntu+bird2, что bird2 | общие слои с `evobgp-bird2` |
 | bird2 | Ubuntu Noble + пакет bird2 | |
 | web, web-all | `nginx:1.27-alpine` | `worker_processes 1` |

deploy/docker/docker-bake.hcl

@@ -236,13 +236,13 @@ target "evobgp-render" {
 }
 
 target "evobgp-deploy" {
-  inherits = ["_go-runtime"]
+  inherits = ["_go-runtime-birdc"]
   args     = { BIN = "evobgp-deploy" }
   tags     = image-tags("evobgp-deploy")
 }
 
 target "evobgp-node" {
-  inherits = ["_go-runtime"]
+  inherits = ["_go-runtime-birdc"]
   args     = { BIN = "evobgp-node" }
   tags     = image-tags("evobgp-node")
 }

deploy/docker/gobinary/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.7
 # Универсальная сборка бинарей cmd/* (ARG BIN) или всех сразу (target build-all).
-# Воркеры (runtime): distroless static. api/all (runtime-birdc): debian-slim + birdc.
+# Воркеры (runtime): distroless static. api/all/deploy/node (runtime-birdc): debian-slim + bird + birdc.
 # CI: docker buildx bake -f deploy/docker/docker-bake.hcl
 ARG BASE_GOLANG=docker.io/library/golang:1.24-alpine
 ARG BASE_DEBIAN=docker.io/library/debian:bookworm-slim
@@ -57,14 +57,15 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     && BIRD_VERSION="${BIRD_VERSION}" /tmp/bird-from-source.sh \
     && rm -f /tmp/bird-from-source.sh
 
-# scheduler / ingest / render / deploy / node — static Go, без shell.
+# scheduler / ingest / render — static Go, без shell.
 FROM ${BASE_DISTROLESS} AS runtime
 ARG BIN=evobgp-api
 COPY --from=build-all /out/${BIN} /usr/local/bin/evobgp
 EXPOSE 8080
 ENTRYPOINT ["/usr/local/bin/evobgp"]
 
-# api / all — birdc (readline + ncurses). Только клиент birdc, без демона bird.
+# api / all / deploy / node — bird -p (parse-check) + birdc configure.
+# Демон BIRD в этом контейнере не запускается; процесс bird — в образе evobgp-bird2.
 FROM ${BASE_DEBIAN} AS runtime-birdc
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
@@ -74,6 +75,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     && rm -rf /var/lib/apt/lists/*
 ARG BIN=evobgp-api
 COPY --from=build-all /out/${BIN} /usr/local/bin/evobgp
+COPY --from=birdc /usr/local/sbin/bird /usr/local/sbin/bird
 COPY --from=birdc /usr/local/sbin/birdc /usr/local/sbin/birdc
 EXPOSE 8080
 ENTRYPOINT ["/usr/local/bin/evobgp"]

docs/quickstart.md

@@ -39,7 +39,7 @@ docker login git.shx.one
 
 | Образ | Назначение | Страница пакета (пример) | Pull |
 |--------|------------|--------------------------|------|
-| `evobgp-api` | HTTP API (с `birdc` в образе) | [packages/…/evobgp-api](https://git.shx.one/denozord/-/packages/container/evobgp-api/latest) | `docker pull git.shx.one/denozord/evobgp-api:latest` |
+| `evobgp-api` | HTTP API (с `bird`/`birdc` в образе для parse-check) | [packages/…/evobgp-api](https://git.shx.one/denozord/-/packages/container/evobgp-api/latest) | `docker pull git.shx.one/denozord/evobgp-api:latest` |
 | `evobgp-all` | Монолит microVPS: API + in-process воркеры scheduler/ingest/render/deploy | [packages/…/evobgp-all](https://git.shx.one/denozord/-/packages/container/evobgp-all/latest) | `docker pull git.shx.one/denozord/evobgp-all:latest` |
 | `evobgp-scheduler` | Планировщик (reference) | [packages/…/evobgp-scheduler](https://git.shx.one/denozord/-/packages/container/evobgp-scheduler/latest) | `docker pull git.shx.one/denozord/evobgp-scheduler:latest` |
 | `evobgp-ingest` | Ingest CDN / ETag | [packages/…/evobgp-ingest](https://git.shx.one/denozord/-/packages/container/evobgp-ingest/latest) | `docker pull git.shx.one/denozord/evobgp-ingest:latest` |

internal/jobs/worker_test.go

@@ -10,6 +10,7 @@ import (
 func TestParallelModuleRefresh_CoalescesDeployApply(t *testing.T) {
 	t.Setenv("EVOBGP_ASN_RESOLVE", "0")
 	t.Setenv("EVOBGP_BIRD_ACTIVE_DIR", "") // skip bird binary path in deploy_apply
+	t.Setenv("EVOBGP_JOB_MAX_CONCURRENT", "8")
 
 	m := store.NewMemory()
 	m.SeedDemo()
@@ -35,8 +36,15 @@ func TestParallelModuleRefresh_CoalescesDeployApply(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	// Hold workers until both jobs are enqueued so inflightRefresh=2 before either
+	// finishModuleRefreshSuccess. Otherwise a fast ingest can finalize+deploy before
+	// the second Enqueue — sequential refreshes correctly produce two deploy_apply jobs.
+	start := make(chan struct{})
 	wk := &Worker{Store: m}
-	reg := NewRegistry(wk.Process)
+	reg := NewRegistry(func(j *Job) {
+		<-start
+		wk.Process(j)
+	})
 	wk.Registry = reg
 
 	mid1 := modIP
@@ -47,6 +55,7 @@ func TestParallelModuleRefresh_CoalescesDeployApply(t *testing.T) {
 	if _, _, err := reg.Enqueue(tenant, KindModuleRefresh, nil, &mid2, map[string]any{"module_id": mod2.ID}); err != nil {
 		t.Fatal(err)
 	}
+	close(start)
 
 	waitSucceededJobsByKindCount(t, reg, tenant, KindModuleRefresh, 2)
 

internal/store/memory.go

@@ -414,6 +414,9 @@ func (m *Memory) ListModules(tenantID string) []*Module {
 		}
 		return out[i].Name < out[j].Name
 	})
+	for i := range out {
+		out[i] = cloneModule(out[i])
+	}
 	return out
 }
 
@@ -446,7 +449,7 @@ func (m *Memory) GetModule(tenantID, moduleID string) (*Module, error) {
 	if mod.TenantID != tenantID {
 		return nil, ErrTenantScope
 	}
-	return mod, nil
+	return cloneModule(mod), nil
 }
 
 func (m *Memory) GetRevision(tenantID, revisionID string) (*Revision, error) {
@@ -684,3 +687,24 @@ func (m *Memory) ListRevisions(tenantID, moduleID string, cursor string, limit i
 	}
 	return page, nextCursor, hasMore
 }
+
+func cloneStringPtr(s *string) *string {
+	if s == nil {
+		return nil
+	}
+	v := *s
+	return &v
+}
+
+func cloneModule(m *Module) *Module {
+	if m == nil {
+		return nil
+	}
+	cp := *m
+	cp.DefaultCommunityID = cloneStringPtr(m.DefaultCommunityID)
+	cp.DohProfileID = cloneStringPtr(m.DohProfileID)
+	cp.DohProfileIDs = append([]string(nil), m.DohProfileIDs...)
+	cp.LastRefreshedAt = cloneTime(m.LastRefreshedAt)
+	cp.DeletedAt = cloneTime(m.DeletedAt)
+	return &cp
+}

internal/store/memory_crud.go

@@ -38,7 +38,7 @@ func (m *Memory) CreateModule(tenantID string, in *Module) (*Module, error) {
 	}
 	NormalizeModuleDoh(mod)
 	m.modules[id] = mod
-	return mod, nil
+	return cloneModule(mod), nil
 }
 
 func (m *Memory) UpdateModule(tenantID, moduleID string, patch *ModulePatch) (*Module, error) {
@@ -74,12 +74,14 @@ func (m *Memory) UpdateModule(tenantID, moduleID string, patch *ModulePatch) (*M
 			mod.DefaultCommunityID = &v
 		}
 	}
-	ApplyModuleDohPatch(mod, patch)
+	if patch.DohProfileIDs != nil || patch.DohProfileID != nil || patch.DohResolverPolicy != nil {
+		ApplyModuleDohPatch(mod, patch)
+	}
 	if patch.LastRefreshedAt != nil {
 		t := patch.LastRefreshedAt.UTC()
 		mod.LastRefreshedAt = &t
 	}
-	return mod, nil
+	return cloneModule(mod), nil
 }
 
 func (m *Memory) SoftDeleteModule(tenantID, moduleID string) error {

scripts/ci/export-cache-env.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env sh
+# Абсолютные пути для actions/cache: на act_runner «~» часто не раскрывается → cache miss.
+set -eu
+: "${GITHUB_ENV:?GITHUB_ENV required (Gitea/GitHub Actions)}"
+
+HOME_DIR="${HOME:-}"
+if [ -z "$HOME_DIR" ]; then
+  HOME_DIR="$(getent passwd "$(id -u)" 2>/dev/null | cut -d: -f6 || true)"
+fi
+HOME_DIR="${HOME_DIR:-/root}"
+
+if command -v go >/dev/null 2>&1; then
+  GOMODCACHE="$(go env GOMODCACHE)"
+  GOCACHE="$(go env GOCACHE)"
+  GOPATH="$(go env GOPATH)"
+else
+  GOMODCACHE="${HOME_DIR}/go/pkg/mod"
+  GOCACHE="${HOME_DIR}/.cache/go-build"
+  GOPATH="${HOME_DIR}/go"
+fi
+
+PNPM_STORE_DIR="${HOME_DIR}/.pnpm-store"
+COREPACK_HOME="${HOME_DIR}/.cache/node/corepack"
+GOBIN="${GOPATH}/bin"
+GOLANGCI_LINT_CACHE="${HOME_DIR}/.cache/golangci-lint"
+
+mkdir -p "$PNPM_STORE_DIR" "$COREPACK_HOME" "$GOMODCACHE" "$GOCACHE" "$GOBIN" "$GOLANGCI_LINT_CACHE"
+
+{
+  echo "HOME_DIR=${HOME_DIR}"
+  echo "PNPM_STORE_DIR=${PNPM_STORE_DIR}"
+  echo "COREPACK_HOME=${COREPACK_HOME}"
+  echo "GOMODCACHE=${GOMODCACHE}"
+  echo "GOCACHE=${GOCACHE}"
+  echo "GOPATH=${GOPATH}"
+  echo "GOBIN=${GOBIN}"
+  echo "GOLANGCI_LINT_CACHE=${GOLANGCI_LINT_CACHE}"
+} >> "$GITHUB_ENV"
+
+echo "cache-env HOME_DIR=${HOME_DIR}"
+echo "cache-env PNPM_STORE_DIR=${PNPM_STORE_DIR}"
+echo "cache-env GOMODCACHE=${GOMODCACHE}"
+echo "cache-env GOCACHE=${GOCACHE}"
+echo "cache-env GOBIN=${GOBIN}"

scripts/ci/golangci-lint.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env sh
+# Бинарь golangci-lint в GOBIN (кэш actions/cache), без goinstall и без hashFiles.
+set -eu
+VER="${GOLANGCI_LINT_VERSION:-v1.64.8}"
+: "${GOBIN:?GOBIN required — run scripts/ci/export-cache-env.sh after setup-go}"
+
+mkdir -p "$GOBIN"
+export PATH="${GOBIN}:${PATH}"
+if [ -n "${GOLANGCI_LINT_CACHE:-}" ]; then
+  mkdir -p "$GOLANGCI_LINT_CACHE"
+  export GOLANGCI_LINT_CACHE
+fi
+
+if [ ! -x "${GOBIN}/golangci-lint" ]; then
+  echo "install golangci-lint ${VER} -> ${GOBIN}"
+  curl -sSfL "https://raw.githubusercontent.com/golangci/golangci-lint/${VER}/install.sh" \
+    | sh -s -- -b "$GOBIN" "$VER"
+fi
+golangci-lint version
+golangci-lint run

scripts/ci/pnpm-ci.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env sh
+# pnpm install из кэша Gitea (store + node_modules). Без повторного download при hit.
+set -eu
+: "${PNPM_STORE_DIR:?PNPM_STORE_DIR required — run scripts/ci/export-cache-env.sh first}"
+
+export COREPACK_HOME="${COREPACK_HOME:-${HOME:-/root}/.cache/node/corepack}"
+mkdir -p "$PNPM_STORE_DIR" "$COREPACK_HOME"
+corepack enable
+pnpm config set store-dir "$PNPM_STORE_DIR"
+
+echo "pnpm store: $(pnpm store path)"
+echo "PNPM_CACHE_HIT=${PNPM_CACHE_HIT:-}"
+
+if [ "${PNPM_CACHE_HIT:-}" = "true" ]; then
+  if pnpm install --frozen-lockfile --offline; then
+    echo "pnpm install --offline (cache hit)"
+    exit 0
+  fi
+  echo "offline install failed — prefer-offline"
+fi
+pnpm install --frozen-lockfile --prefer-offline