ci: bridge docker-deploy compose to gitea_gitea; bypass turbo for e2e

- docker-compose.ci.yml: attach app/postgres/redis to the external
  gitea_gitea network so the act_runner job container (which lives on
  gitea_gitea) can reach the compose services by name. Otherwise
  'localhost:3100' from the job container resolves to the job container
  itself, not the compose-network app — all health checks and smoke
  tests were hitting nothing.
- ci.yml: switch health/smoke URLs from localhost to http://app:3100
  and expose PLAYWRIGHT_BASE_URL so the smoke config can override.
- ci.yml: run E2E playwright directly via pnpm --filter, bypassing
  turbo which strict-filters PLAYWRIGHT_DATABASE_URL and friends.
- playwright.ci.config.ts: honour PLAYWRIGHT_BASE_URL env override.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -369,7 +369,11 @@ jobs:
           pnpm db:seed
 
       - name: Run E2E tests
-        run: pnpm test:e2e
+        # Bypass turbo here — it runs in strict env mode and does not pass
+        # PLAYWRIGHT_DATABASE_URL / AUTH_SECRET / etc. through to the webServer
+        # subprocess, breaking test-server.mjs. Calling playwright directly
+        # inherits the job-level env unchanged.
+        run: pnpm --filter @capakraken/web exec playwright test
 
       - name: Upload Playwright report
         uses: actions/upload-artifact@v4
@@ -421,9 +425,11 @@ jobs:
         run: docker compose -f docker-compose.yml -f docker-compose.ci.yml --profile full up -d --build app
 
       - name: Wait for /api/health (up to 3 minutes)
+        # docker-compose.ci.yml attaches app/postgres/redis to gitea_gitea so the
+        # act_runner job container can reach them by compose service name.
         run: |
           for i in $(seq 1 36); do
-            STATUS=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:3100/api/health || echo "000")
+            STATUS=$(curl -s -o /dev/null -w "%{http_code}" http://app:3100/api/health || echo "000")
             echo "Attempt $i: HTTP $STATUS"
             if [ "$STATUS" = "200" ]; then exit 0; fi
             sleep 5
@@ -434,7 +440,7 @@ jobs:
 
       - name: Verify health response contains status ok
         run: |
-          BODY=$(curl -sf http://localhost:3100/api/health)
+          BODY=$(curl -sf http://app:3100/api/health)
           echo "$BODY"
           echo "$BODY" | grep '"status":"ok"'
 
@@ -456,6 +462,10 @@ jobs:
           playwright install chromium --with-deps
 
       - name: Run smoke tests
+        env:
+          # App runs on the compose network; act_runner job is on gitea_gitea
+          # (docker-compose.ci.yml attaches services to both). Override baseURL.
+          PLAYWRIGHT_BASE_URL: http://app:3100
         run: npx playwright test --config apps/web/playwright.ci.config.ts
 
       - name: Upload Playwright report

apps/web/playwright.ci.config.ts

@@ -11,7 +11,7 @@ export default defineConfig({
     ? [["list"], ["html", { outputFolder: "playwright-report" }]]
     : "list",
   use: {
-    baseURL: "http://localhost:3100",
+    baseURL: process.env["PLAYWRIGHT_BASE_URL"] ?? "http://localhost:3100",
     trace: "on-first-retry",
     screenshot: "only-on-failure",
   },

docker-compose.ci.yml

@@ -13,3 +13,22 @@
 services:
   app:
     volumes: !reset []
+    # Attach to the gitea_gitea network too so the act_runner job container
+    # (which lives on gitea_gitea) can reach the compose services by name.
+    # Otherwise "localhost:3100" from inside the job container resolves to
+    # the job container itself, not the compose-network app.
+    networks:
+      - default
+      - gitea_gitea
+  postgres:
+    networks:
+      - default
+      - gitea_gitea
+  redis:
+    networks:
+      - default
+      - gitea_gitea
+
+networks:
+  gitea_gitea:
+    external: true