ci: pull node base image from Harbor instead of docker.io

Kaniko builds failed with context deadline exceeded pulling node:24-alpine
from index.docker.io through the egress proxy. Seed node:24-alpine into
abrban/ and pass BASE_IMAGE build-arg so builds use the internal registry.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/build-deploy.yaml

@@ -103,15 +103,15 @@ jobs:
                 containers:
                   - name: kaniko
                     image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
-                    # Kaniko pulls base images (node:24-alpine) straight from
-                    # docker.io — needs the egress proxy. NO_PROXY keeps the
-                    # push to harbor-registry direct.
+                    # Base image (node:24-alpine) is seeded in Harbor abrban/ — avoids
+                    # flaky direct pulls from docker.io through the egress proxy.
                     envFrom:
                       - secretRef:
                           name: registry-egress-proxy
                     args:
                       - --dockerfile=/workspace/backend/Dockerfile
                       - --context=dir:///workspace/backend
+                      - --build-arg=BASE_IMAGE=${PULL_REGISTRY}/${PROJECT}/node:24-alpine
                       - --destination=${PUSH_REGISTRY}/${PROJECT}/cloudhost-backend:${IMAGE_TAG}
                       - --insecure
                       - --skip-tls-verify
@@ -172,6 +172,7 @@ jobs:
                     args:
                       - --dockerfile=/workspace/frontend/Dockerfile
                       - --context=dir:///workspace/frontend
+                      - --build-arg=BASE_IMAGE=${PULL_REGISTRY}/${PROJECT}/node:24-alpine
                       - --build-arg=NEXT_PUBLIC_API_URL=https://api.abrban.com
                       - --destination=${PUSH_REGISTRY}/${PROJECT}/cloudhost-frontend:${IMAGE_TAG}
                       - --insecure

RUNBOOK-CICD.fa.md

@@ -228,7 +228,7 @@ Secretهایی که هنوز دستی‌اند (خارج از چرخهٔ CI): `a
 |-------|-------|
 | Workflow اجرا نمی‌شود | `kubectl -n gitea logs deploy/gitea-act-runner` — ثبت Runner و لیبل `abrban-builder` |
 | Build fail — clone | معتبربودن Secret `CI_TOKEN` در تنظیمات ریپوی `cloud-host` |
-| Build fail — pull ایمیج پایه (403 از docker.io) | Kaniko ایمیج پایه (`node:24-alpine`) را مستقیم از docker.io می‌کشد و به پروکسی egress نیاز دارد؛ Secret `registry-egress-proxy` باید در ns `cloudhost-builds` باشد (در Job با `envFrom` ست می‌شود) |
+| Build fail — pull ایمیج پایه (403/timeout از docker.io) | Kaniko نباید مستقیم از docker.io بکشد؛ ایمیج `node:24-alpine` باید در Harbor پروژهٔ `abrban/` seed شده باشد (`gitops/jobs/seed-ci-images.yaml`) و Workflow `--build-arg=BASE_IMAGE=registry.abrban.com/abrban/node:24-alpine` را پاس می‌دهد |
 | Build fail — push به Harbor | `kubectl -n cloudhost-builds get secret kaniko-harbor-auth`؛ پسورد باید با `REGISTRY_CREDENTIAL_PASSWORD` هاربر یکی باشد |
 | کامیت values push نمی‌شود | دسترسی write کاربر `ci` روی `cloud-host-gitops` |
 | Argo sync نمی‌کند | `kubectl -n argocd get app abrban-platform`؛ هر دو repo credential (`gitea-repo-creds` و `gitea-gitops-repo-creds`) |

backend/Dockerfile

@@ -1,5 +1,6 @@
 # ---- Stage 1: Build ----
-FROM node:24-alpine AS builder
+ARG BASE_IMAGE=node:24-alpine
+FROM ${BASE_IMAGE} AS builder
 
 WORKDIR /app
 
@@ -10,7 +11,7 @@ COPY . .
 RUN npm run build
 
 # ---- Stage 2: Production ----
-FROM node:24-alpine AS production
+FROM ${BASE_IMAGE} AS production
 
 RUN apk add --no-cache dumb-init curl bash \
  && curl -fsSL https://get.helm.sh/helm-v3.15.4-linux-amd64.tar.gz | tar xz -C /tmp \

frontend/Dockerfile

@@ -1,5 +1,6 @@
 # ---- Stage 1: Dependencies ----
-FROM node:24-alpine AS deps
+ARG BASE_IMAGE=node:24-alpine
+FROM ${BASE_IMAGE} AS deps
 
 WORKDIR /app
 COPY package.json package-lock.json* ./
@@ -8,7 +9,7 @@ RUN sed -i 's|https://registry.npmmirror.com|https://registry.npmjs.org|g' packa
  && npm ci
 
 # ---- Stage 2: Build ----
-FROM node:24-alpine AS builder
+FROM ${BASE_IMAGE} AS builder
 
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
@@ -20,7 +21,7 @@ ENV NEXT_TELEMETRY_DISABLED=1
 RUN npm run build
 
 # ---- Stage 3: Production ----
-FROM node:24-alpine AS production
+FROM ${BASE_IMAGE} AS production
 
 RUN apk add --no-cache dumb-init
 

gitops/jobs/seed-ci-images.yaml

@@ -30,6 +30,12 @@ spec:
                 docker://docker.io/gitea/act_runner:0.2.11 \
                 "${DEST}/act-runner:0.2.11"
               skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
-                docker://gcr.io/kaniko-project/executor:v1.23.2 \
-                "${DEST}/kaniko-executor:v1.23.2"
+                docker://docker.io/alpine/git:2.43.0 \
+                "${DEST}/alpine-git:2.43.0"
+              skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
+                docker://docker.io/library/node:24-alpine \
+                "${DEST}/node:24-alpine"
+              skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
+                docker://gcr.io/kaniko-project/executor:v1.27.6-debug \
+                "${DEST}/kaniko-executor:v1.27.6-debug"
               echo SEED_OK