perf: prepared statements, CSP, digest pin, вырезание design-preview, нагрузочные бюджеты, jsdom-тесты web, composite CI, SBOM/Trivy

.gitea/workflows/quality.yaml

@@ -110,7 +110,7 @@ jobs:
           while IFS= read -r f || [ -n "${f:-}" ]; do
             [ -z "${f:-}" ] && continue
             case "$f" in
-              .gitea/workflows/*|scripts/*)
+              .gitea/workflows/*|.gitea/actions/*|scripts/*)
                 full_pipeline=true
                 ;;
               .cursor/*|.claude/*|.codegraph/*|.agents/*)
@@ -160,32 +160,11 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version: "22"
-      - name: Export cache paths
-        run: sh scripts/ci/export-cache-env.sh
-      - id: pnpm-hash
-        run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
-      - id: pnpm-cache
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
-        with:
-          path: |
-            ${{ env.PNPM_STORE_DIR }}
-            ${{ env.COREPACK_HOME }}
-            .turbo
-            node_modules
-            apps/web/node_modules
-            apps/api/node_modules
-            packages/ui/node_modules
-            packages/shared/node_modules
-            packages/db/node_modules
-          key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
-          restore-keys: |
-            pnpm-${{ runner.os }}-
+      - id: setup
+        uses: ./.gitea/actions/setup-pnpm
       - name: pnpm install, lint, typecheck, build
         env:
-          PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
+          PNPM_CACHE_HIT: ${{ steps.setup.outputs.cache-hit }}
         run: |
           set -euxo pipefail
           sh scripts/ci/pnpm-ci.sh
@@ -202,32 +181,11 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version: "22"
-      - name: Export cache paths
-        run: sh scripts/ci/export-cache-env.sh
-      - id: pnpm-hash
-        run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
-      - id: pnpm-cache
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
-        with:
-          path: |
-            ${{ env.PNPM_STORE_DIR }}
-            ${{ env.COREPACK_HOME }}
-            .turbo
-            node_modules
-            apps/web/node_modules
-            apps/api/node_modules
-            packages/ui/node_modules
-            packages/shared/node_modules
-            packages/db/node_modules
-          key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
-          restore-keys: |
-            pnpm-${{ runner.os }}-
+      - id: setup
+        uses: ./.gitea/actions/setup-pnpm
       - name: pnpm install, lint, test, typecheck, build
         env:
-          PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
+          PNPM_CACHE_HIT: ${{ steps.setup.outputs.cache-hit }}
         run: |
           set -euxo pipefail
           sh scripts/ci/pnpm-ci.sh
@@ -244,33 +202,13 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version: "22"
-      - name: Export cache paths
-        run: sh scripts/ci/export-cache-env.sh
-      - id: pnpm-hash
-        run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
-      - id: pnpm-cache
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
-        with:
-          path: |
-            ${{ env.PNPM_STORE_DIR }}
-            ${{ env.COREPACK_HOME }}
-            node_modules
-            apps/web/node_modules
-            apps/api/node_modules
-            packages/ui/node_modules
-            packages/shared/node_modules
-            packages/db/node_modules
-          key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
-          restore-keys: |
-            pnpm-${{ runner.os }}-
+      - id: setup
+        uses: ./.gitea/actions/setup-pnpm
       - name: Lint commit messages
         env:
           BASE_SHA: ${{ inputs.base_sha }}
           HEAD_SHA: ${{ inputs.head_sha }}
-          PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
+          PNPM_CACHE_HIT: ${{ steps.setup.outputs.cache-hit }}
         run: |
           set -euxo pipefail
           sh scripts/ci/pnpm-ci.sh
@@ -323,3 +261,7 @@ jobs:
           set -euxo pipefail
           docker buildx bake --allow=fs.read="${{ github.workspace }}" -f docker-bake.hcl --set 'authportal.output=type=docker' --set 'authportal.tags=authportal:smoke' authportal
           bash "${{ github.workspace }}/scripts/ci/smoke-image.sh" authportal:smoke
+      - name: trivy (HIGH/CRITICAL; информативно, пайплайн не блокирует)
+        continue-on-error: true
+        run: |
+          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy:0.58.1 image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 0 authportal:smoke