perf: prepared statements, CSP, digest pin, вырезание design-preview, нагрузочные бюджеты, jsdom-тесты web, composite CI, SBOM/Trivy

.gitea/workflows/nightly-perf.yaml

@@ -0,0 +1,49 @@
+# Ночной нагрузочный smoke: образ под лимитами compose + autocannon + бюджеты p99/RPS/RSS.
+name: nightly-perf
+
+on:
+  schedule:
+    - cron: "0 3 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  load:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - id: setup
+        uses: ./.gitea/actions/setup-pnpm
+      - name: Build image
+        working-directory: deploy/docker
+        env:
+          BUILDX_BAKE_ENTITLEMENTS_FS: "0"
+          BUILDX_BAKE_FILE_RELATIVE_PATHS: "1"
+        run: |
+          set -euxo pipefail
+          docker buildx bake --allow=fs.read="${{ github.workspace }}" -f docker-bake.hcl --set 'authportal.output=type=docker' --set 'authportal.tags=authportal:load' authportal
+      - name: Run container with production limits
+        run: |
+          set -euxo pipefail
+          docker volume create load-data
+          docker run --rm -v load-data:/data --entrypoint sh authportal:load -c 'chown 1000:1000 /data'
+          docker run -d --name authportal-load --init --memory 256m --memory-swap 256m --cpus 1.0 \
+            --read-only --tmpfs /tmp --cap-drop ALL -v load-data:/data -p 18080:8080 \
+            -e JWT_SECRET=load-jwt-secret-0123456789 -e ADMIN_PASSWORD=load-admin-pass-1 \
+            -e ADMIN_EMAIL=admin@smoke.local -e ISSUER=http://127.0.0.1:18080 -e RATE_LIMIT_MAX=1000000 authportal:load
+          for i in $(seq 1 40); do curl -fsS http://127.0.0.1:18080/ready && break; sleep 0.5; done
+      - name: Load test
+        env:
+          PNPM_CACHE_HIT: ${{ steps.setup.outputs.cache-hit }}
+          LOAD_PASSWORD: load-admin-pass-1
+        run: |
+          set -euxo pipefail
+          sh scripts/ci/pnpm-ci.sh
+          node scripts/perf/load.mjs http://127.0.0.1:18080 authportal-load
+      - name: Container logs on failure
+        if: failure()
+        run: docker logs --tail 100 authportal-load || true