Hartmut
01f8974314
CI / Architecture Guardrails (pull_request) Successful in 2m59s
CI / Typecheck (pull_request) Successful in 6m41s
CI / Lint (pull_request) Successful in 4m18s
CI / Assistant Split Regression (pull_request) Successful in 5m6s
CI / Unit Tests (pull_request) Successful in 7m21s
CI / Build (pull_request) Successful in 5m21s
CI / Fresh-Linux Docker Deploy (pull_request) Failing after 38s
CI / E2E Tests (pull_request) Successful in 3m28s
CI / Release Images (pull_request) Has been skipped
- docker-compose.yml / .prod.yml / .ci.yml: project names, POSTGRES_DB/USER, pg_isready, DATABASE_URL, volume names (nexus_pgdata, nexus_prod_*) - .github/workflows/ci.yml: POSTGRES_PASSWORD, pg_isready, psql credentials, GRANT statements, POSTGRES_PASSWORD=nexus_dev for Docker Deploy job - scripts/db-target-guard.mjs: expectedDatabase default, NEXUS_EXPECTED_DB_NAME - scripts/prisma-with-env.mjs, e2e/test-server.mjs: env-var rename - packages/db/src/safe-destructive-env.ts + reset-dispo-import.ts: DB name set - packages/db/src/destructive-db-guard.ts: PROTECTED_DATABASE_NAMES → "nexus" - packages/db/src/destructive-db-guard.test.ts: all fixture DB names + comments - .env.example, tooling/deploy/deploy.env.example: DATABASE_URL, image refs - packages/api: Redis channel/key prefixes (rbac-invalidate, sse, ratelimit), logger service name, app-base-url log prefix - E2E: DB container names, localStorage/sessionStorage keys, email domains - scripts: architecture-guardrails filter, export/import-dev-seed defaults, harden-postgres defaults, start.sh pg_isready, worktree-hygiene fixture - tooling/migrate/rename-to-nexus.sh: new maintenance-window cutover script Only intentional capakraken survivor: anonymization.ts DEFAULT_ANONYMIZATION_SEED (functional cryptographic constant — changing it would invalidate stored aliases). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
43 lines
2.1 KiB
YAML
43 lines
2.1 KiB
YAML
# CI override for docker-deploy-test.
|
|
#
|
|
# The dev compose bind-mounts `.:/app` so edits are live during `pnpm dev`.
|
|
# Under act_runner (docker-outside-of-docker on Gitea), the host docker
|
|
# daemon cannot see the job container's /workspace/... path, so the bind
|
|
# mount resolves to an empty directory inside the app container and masks
|
|
# everything the Dockerfile copied in — including tooling/docker/app-dev-start.sh.
|
|
#
|
|
# Result: `sh: cannot open ./tooling/docker/app-dev-start.sh: No such file`.
|
|
#
|
|
# This override strips all bind mounts from the `app` service so the image
|
|
# runs against its baked-in copy of the repo.
|
|
services:
|
|
app:
|
|
volumes: !reset []
|
|
# Attach only the app to gitea_gitea so the act_runner job container
|
|
# (which lives on gitea_gitea) can reach the compose app by service name.
|
|
# Do NOT attach postgres/redis here — doing so causes hostname collisions
|
|
# with other containers already on gitea_gitea (Gitea core + concurrent
|
|
# job service containers all answer to "postgres"), producing split-brain
|
|
# where different clients hit different DBs. The app talks to postgres/
|
|
# redis by service name on the internal compose network, which works
|
|
# regardless of gitea_gitea.
|
|
networks:
|
|
- default
|
|
- gitea_gitea
|
|
# Even with postgres NOT attached to gitea_gitea, the app container's DNS
|
|
# for "postgres" still returns ambiguous results: Gitea's core stack on
|
|
# gitea_gitea has its own container named "postgres", and Docker's
|
|
# embedded DNS resolves bare names against ALL attached networks. Result:
|
|
# the app's startup script's `prisma db push` and the seed script's
|
|
# `prisma.user.count()` may cache different IPs and end up on different
|
|
# DBs (one with our schema, one without — Gitea's). Pin DATABASE_URL and
|
|
# REDIS_URL to the unique compose container names so resolution is
|
|
# unambiguous regardless of attached networks.
|
|
environment:
|
|
DATABASE_URL: postgresql://nexus:nexus_dev@nexus-postgres-1:5432/nexus
|
|
REDIS_URL: redis://nexus-redis-1:6379
|
|
|
|
networks:
|
|
gitea_gitea:
|
|
external: true
|