From f728d74f34f42aa360e98a471ff6ff37ce237c69 Mon Sep 17 00:00:00 2001
From: Sergey Antropoff <sergey@antropoff.ru>
Date: Wed, 29 Jul 2026 13:41:17 +0300
Subject: [PATCH] =?UTF-8?q?=D0=A3=D0=B1=D1=80=D0=B0=D0=BD=D1=8B=20short-sh?=
 =?UTF-8?q?a=20=D1=82=D0=B5=D0=B3=D0=B8=20=D0=BE=D0=B1=D1=80=D0=B0=D0=B7?=
 =?UTF-8?q?=D0=B0:=20=D0=B2=20Hub/Harbor=20=D0=BF=D1=83=D0=B1=D0=BB=D0=B8?=
 =?UTF-8?q?=D0=BA=D1=83=D1=8E=D1=82=D1=81=D1=8F=20=D1=82=D0=BE=D0=BB=D1=8C?=
 =?UTF-8?q?=D0=BA=D0=BE=20SemVer=20=D0=B8=20latest.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Jenkinsfile | 25 +++++++++----------------
 README.md   |  2 +-
 2 files changed, 10 insertions(+), 17 deletions(-)

diff --git a/Jenkinsfile b/Jenkinsfile
index fa6b688..4aa6111 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -30,7 +30,6 @@ pipeline {
         HARBOR_REGISTRY   = 'hub.antropoff.ru'
         HARBOR_IMAGE      = 'hub.antropoff.ru/devops-tools/wrapped'
         DOCKERHUB_IMAGE   = 'inecs/wrapped'
-        // RELEASE_TAG — после checkout (с agent none GIT_COMMIT ещё нет → валидация env падает)
         BUILDX_BUILDER    = "jenkins-wrapped-${env.BUILD_NUMBER}"
         DEPLOY_JOB        = 'devops-tools/wrapped/wrapped-deploy/main'
         TZ                = 'Europe/Moscow'
@@ -60,12 +59,7 @@ pipeline {
                             if (!env.IMAGE_VERSION) {
                                 error('VERSION file is empty')
                             }
-                            if (!env.GIT_COMMIT) {
-                                error('GIT_COMMIT is empty after checkout')
-                            }
-                            env.RELEASE_TAG = env.GIT_COMMIT.take(7)
                             echo "IMAGE_VERSION from VERSION → ${env.IMAGE_VERSION}"
-                            echo "RELEASE_TAG → ${env.RELEASE_TAG}"
                         }
                     }
                 }
@@ -89,7 +83,7 @@ pipeline {
                                     set -eux
 
                                     test -n "${IMAGE_VERSION}"
-                                    echo "Building tags: ${IMAGE_VERSION}, ${RELEASE_TAG}, latest"
+                                    echo "Building tags: ${IMAGE_VERSION}, latest (no short-sha)"
 
                                     echo "$HARBOR_PASS" | docker login "$HARBOR_REGISTRY" -u "$HARBOR_USER" --password-stdin
                                     echo "$DOCKERHUB_PASS" | docker login -u "$DOCKERHUB_USER" --password-stdin
@@ -98,27 +92,26 @@ pipeline {
                                     docker buildx create --name "$BUILDX_BUILDER" --driver docker-container --use
                                     docker buildx inspect --bootstrap >/dev/null
 
+                                    # Arch-слои только в Harbor (промежуточные теги), не в Docker Hub
                                     docker buildx build \
                                       --platform linux/amd64 \
                                       --provenance=false --sbom=false --push \
-                                      -t "${HARBOR_IMAGE}:${RELEASE_TAG}-amd64" \
-                                      -t "${DOCKERHUB_IMAGE}:${RELEASE_TAG}-amd64" \
+                                      -t "${HARBOR_IMAGE}:${IMAGE_VERSION}-amd64" \
                                       -f Dockerfile .
 
                                     docker buildx build \
                                       --platform linux/arm64 \
                                       --provenance=false --sbom=false --push \
-                                      -t "${HARBOR_IMAGE}:${RELEASE_TAG}-arm64" \
-                                      -t "${DOCKERHUB_IMAGE}:${RELEASE_TAG}-arm64" \
+                                      -t "${HARBOR_IMAGE}:${IMAGE_VERSION}-arm64" \
                                       -f Dockerfile .
 
+                                    # Публичные теги: только SemVer + latest
                                     for IMAGE in "$HARBOR_IMAGE" "$DOCKERHUB_IMAGE"; do
                                       docker buildx imagetools create \
-                                        -t "${IMAGE}:${RELEASE_TAG}" \
                                         -t "${IMAGE}:${IMAGE_VERSION}" \
                                         -t "${IMAGE}:latest" \
-                                        "${IMAGE}:${RELEASE_TAG}-amd64" \
-                                        "${IMAGE}:${RELEASE_TAG}-arm64"
+                                        "${HARBOR_IMAGE}:${IMAGE_VERSION}-amd64" \
+                                        "${HARBOR_IMAGE}:${IMAGE_VERSION}-arm64"
                                     done
 
                                     echo "--- Harbor ---"
@@ -146,7 +139,7 @@ pipeline {
                     }
                 }
                 success {
-                    echo "✓ Build OK: ${DOCKERHUB_IMAGE}:{${RELEASE_TAG},${IMAGE_VERSION},latest}"
+                    echo "✓ Build OK: ${DOCKERHUB_IMAGE}:{${IMAGE_VERSION},latest}"
                 }
                 failure {
                     echo "✗ Build/push не удались — Deploy не запускается"
@@ -185,7 +178,7 @@ pipeline {
     post {
         success {
             echo "✓ Version: ${IMAGE_VERSION}"
-            echo "✓ Image:   ${DOCKERHUB_IMAGE}:{${RELEASE_TAG},${IMAGE_VERSION},latest}"
+            echo "✓ Image:   ${DOCKERHUB_IMAGE}:{${IMAGE_VERSION},latest}"
             echo "✓ Deploy:  ${DEPLOY_JOB} triggered (async)"
         }
         failure {
diff --git a/README.md b/README.md
index 3271997..3ce7a5f 100644
--- a/README.md
+++ b/README.md
@@ -443,7 +443,7 @@ docker buildx build \
 | Harbor | `hub.antropoff.ru/devops-tools/wrapped` |
 | Docker Hub | `inecs/wrapped` |
 
-Теги на каждый реестр: `:<semver>` (ровно из `VERSION` в коммите), `:<short-sha>`, `:latest`.
+Публичные теги на каждый реестр: `:<semver>` (из `VERSION` в коммите) и `:latest`. Short-sha больше не пушится. Промежуточные `:<semver>-amd64` / `-arm64` остаются только в Harbor для сборки multi-arch manifest.
 
 ### Версионирование