From ec557a0b4bc6273431ba661bc8c0b8caebfd0a3b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hartmut=20N=C3=B6renberg?= <hn@hartmut-noerenberg.com>
Date: Sun, 12 Apr 2026 21:41:46 +0200
Subject: [PATCH] ci: fix E2E db target guard and strip bind mounts in docker
 deploy test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

E2E was failing at `pnpm db:push` because scripts/prisma-with-env.mjs
refuses to run when DATABASE_URL's database name doesn't match the
expected target ("capakraken"). CI uses capakraken_test. Set
CAPAKRAKEN_EXPECTED_DB_NAME=capakraken_test on the e2e job.

Fresh-Linux Docker Deploy was failing because docker-compose.yml's dev
bind mount `.:/app` doesn't work under docker-outside-of-docker on the
Gitea act_runner — the host daemon can't see the job container's
/workspace/... path, so the mount masks the image's baked-in files and
the CMD fails with `cannot open ./tooling/docker/app-dev-start.sh`.
Added docker-compose.ci.yml that resets `app.volumes` and layered it
onto every `docker compose` invocation in the deploy job.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 15 +++++++++------
 docker-compose.ci.yml    | 15 +++++++++++++++
 2 files changed, 24 insertions(+), 6 deletions(-)
 create mode 100644 docker-compose.ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0c32137..a5b5242 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -303,6 +303,9 @@ jobs:
           --health-retries=5
     env:
       DATABASE_URL: postgresql://capakraken:capakraken_test@postgres:5432/capakraken_test
+      # prisma-with-env.mjs refuses to run unless DATABASE_URL's db name matches
+      # the expected target; default is "capakraken", CI uses capakraken_test.
+      CAPAKRAKEN_EXPECTED_DB_NAME: capakraken_test
       ALLOW_DESTRUCTIVE_DB_TOOLS: "true"
       CONFIRM_DESTRUCTIVE_DB_NAME: capakraken_test
       REDIS_URL: redis://redis:6379
@@ -382,17 +385,17 @@ jobs:
           EOF
 
       - name: Start infrastructure (postgres + redis)
-        run: docker compose up -d postgres redis
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml up -d postgres redis
 
       - name: Wait for postgres
         run: |
           for i in $(seq 1 20); do
-            docker compose exec -T postgres pg_isready -U capakraken -d capakraken && break
+            docker compose -f docker-compose.yml -f docker-compose.ci.yml exec -T postgres pg_isready -U capakraken -d capakraken && break
             sleep 3
           done
 
       - name: Build and start app (full profile)
-        run: docker compose --profile full up -d --build app
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml --profile full up -d --build app
 
       - name: Wait for /api/health (up to 3 minutes)
         run: |
@@ -403,7 +406,7 @@ jobs:
             sleep 5
           done
           echo "Health check timed out"
-          docker compose logs app --tail=50
+          docker compose -f docker-compose.yml -f docker-compose.ci.yml logs app --tail=50
           exit 1
 
       - name: Verify health response contains status ok
@@ -414,7 +417,7 @@ jobs:
 
       - name: Seed admin user
         run: |
-          docker compose exec -T app node /app/scripts/setup-admin.mjs \
+          docker compose -f docker-compose.yml -f docker-compose.ci.yml exec -T app node /app/scripts/setup-admin.mjs \
             --email admin@capakraken.dev \
             --name "Admin" \
             --password admin123
@@ -443,7 +446,7 @@ jobs:
 
       - name: Show logs on failure
         if: failure()
-        run: docker compose logs --tail=100
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml logs --tail=100
 
   # ──────────────────────────────────────────────
   # Release images — only on push to main, after
diff --git a/docker-compose.ci.yml b/docker-compose.ci.yml
new file mode 100644
index 0000000..14c18f2
--- /dev/null
+++ b/docker-compose.ci.yml
@@ -0,0 +1,15 @@
+# CI override for docker-deploy-test.
+#
+# The dev compose bind-mounts `.:/app` so edits are live during `pnpm dev`.
+# Under act_runner (docker-outside-of-docker on Gitea), the host docker
+# daemon cannot see the job container's /workspace/... path, so the bind
+# mount resolves to an empty directory inside the app container and masks
+# everything the Dockerfile copied in — including tooling/docker/app-dev-start.sh.
+#
+# Result: `sh: cannot open ./tooling/docker/app-dev-start.sh: No such file`.
+#
+# This override strips all bind mounts from the `app` service so the image
+# runs against its baked-in copy of the repo.
+services:
+  app:
+    volumes: !reset []