fix(mcp): подготовить доступ и отзыв разрешений для приёмки

deploy/docker/docker-bake.hcl

@@ -0,0 +1,123 @@
+# Единая сборка образа Auth Portal (buildx bake: -f deploy/docker/docker-bake.hcl).
+# context = "../.." — корень репо. Bake резолвит context от cwd (не от HCL),
+# поэтому вызов из deploy/docker/ либо BUILDX_BAKE_FILE_RELATIVE_PATHS=1.
+
+variable "REGISTRY" {
+  default = "git.shx.one/denozord"
+}
+
+variable "IMAGE_TAG" {
+  default = "latest"
+}
+
+variable "SHORT_SHA" {
+  default = "dev"
+}
+
+variable "SHA_FULL" {
+  default = ""
+}
+
+variable "VERSION" {
+  default = "dev"
+}
+
+variable "BUILD_TIME" {
+  default = ""
+}
+
+variable "CACHE_REF_NODE" {
+  default = ""
+}
+
+# provenance + SBOM; включается только при --push (docker exporter attestations не поддерживает).
+variable "ATTEST" {
+  default = "false"
+}
+
+variable "BASE_NODE" {
+  default = "docker.io/library/node:22-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914"
+}
+
+function "node-cache-from" {
+  params = []
+  result = notequal("", CACHE_REF_NODE) ? ["type=registry,ref=${CACHE_REF_NODE}"] : []
+}
+
+# Экспорт кэша — один writer на ref (параллельный cache-to в один ref ломает manifest).
+function "node-cache-to-export" {
+  params = []
+  result = notequal("", CACHE_REF_NODE) ? ["type=registry,ref=${CACHE_REF_NODE},mode=max"] : []
+}
+
+function "image-tags" {
+  params = [name]
+  result = concat(
+    notequal("", SHA_FULL) ? [
+      "${REGISTRY}/${name}:${IMAGE_TAG}",
+      "${REGISTRY}/${name}:${SHORT_SHA}",
+      "${REGISTRY}/${name}:sha-${SHA_FULL}",
+    ] : [
+      "${REGISTRY}/${name}:${IMAGE_TAG}",
+      "${REGISTRY}/${name}:${SHORT_SHA}",
+    ],
+    notequal(VERSION, "dev") && notequal(VERSION, "") ? [
+      "${REGISTRY}/${name}:v${VERSION}",
+      "${REGISTRY}/${name}:${VERSION}",
+    ] : []
+  )
+}
+
+group "default" {
+  targets = ["authportal"]
+}
+
+target "_common" {
+  platforms = ["linux/amd64"]
+  pull      = false
+}
+
+target "node-deps" {
+  inherits   = ["_common"]
+  context    = "../.."
+  dockerfile = "deploy/docker/authportal/Dockerfile"
+  target     = "deps"
+  args = {
+    BASE_NODE = BASE_NODE
+  }
+  cache-from = node-cache-from()
+}
+
+target "node-build" {
+  inherits   = ["_common"]
+  context    = "../.."
+  dockerfile = "deploy/docker/authportal/Dockerfile"
+  target     = "build"
+  args = {
+    BASE_NODE = BASE_NODE
+  }
+  contexts = {
+    deps = "target:node-deps"
+  }
+  cache-from = node-cache-from()
+  cache-to   = node-cache-to-export()
+}
+
+target "authportal" {
+  inherits   = ["_common"]
+  context    = "../.."
+  dockerfile = "deploy/docker/authportal/Dockerfile"
+  target     = "runtime"
+  args = {
+    BASE_NODE  = BASE_NODE
+    VERSION    = VERSION
+    GIT_SHA    = notequal("", SHA_FULL) ? SHA_FULL : SHORT_SHA
+    BUILD_TIME = BUILD_TIME
+  }
+  contexts = {
+    build = "target:node-build"
+  }
+  cache-from = node-cache-from()
+  attest     = equal(ATTEST, "true") ? ["type=provenance,mode=min", "type=sbom"] : []
+  tags       = concat(image-tags("authportal"), image-tags("auth-portal"))
+}