diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index f259354..fad102a 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -17,44 +17,18 @@ jobs: # Full-dind runner: job containers already reach the runner's own docker daemon # (pre-set DOCKER_HOST and/or a mounted /var/run/docker.sock) — no dind service. - # Resolve which endpoint works, export it as DOCKER_HOST, and derive E2E_BASE_URL - # from it: for tcp/https endpoints published ports live on that host; for a unix - # socket the daemon sits on the job's docker bridge, so its published ports are - # reached via the default gateway. - - name: Resolve dind endpoint + # Find a working endpoint and export it as DOCKER_HOST for all later steps. + - name: Resolve docker daemon run: | set -u - derive_url() { - ep="$1" - case "$ep" in - unix://*) - gw=$(ip route show default 2>/dev/null | awk '{print $3; exit}') - if [ -z "${gw:-}" ]; then - echo "::error::unix-socket daemon but no default gateway found (needed to reach published ports)" >&2 - return 1 - fi - echo "http://$gw:3000" ;; - tcp://*|https://*) - hostpart=$(printf '%s' "$ep" | sed -e 's|^[a-z]*://||') - hostpart=${hostpart%%:*} - if [ -z "$hostpart" ]; then return 1; fi - echo "http://$hostpart:3000" ;; - *) - echo "::error::cannot derive app URL from endpoint '$ep'" >&2 - return 1 ;; - esac - } - # 1) A pre-set DOCKER_HOST that answers is used as-is, no probing. if [ -n "${DOCKER_HOST:-}" ]; then i=0 while [ "$i" -lt 5 ]; do if docker version --format '{{.Server.Version}}' >/dev/null 2>&1; then - url=$(derive_url "$DOCKER_HOST") || exit 1 - echo "using pre-set DOCKER_HOST=$DOCKER_HOST (E2E_BASE_URL=$url)" + echo "using pre-set DOCKER_HOST=$DOCKER_HOST" echo "DOCKER_HOST=$DOCKER_HOST" >> "$GITHUB_ENV" - echo "E2E_BASE_URL=$url" >> "$GITHUB_ENV" exit 0 fi i=$((i+1)); sleep 2 @@ -70,10 +44,8 @@ jobs: i=0 while [ "$i" -lt 10 ]; do if DOCKER_HOST="$ep" docker version --format '{{.Server.Version}}' >/dev/null 2>&1; then - url=$(derive_url "$ep") || exit 1 - echo "using probed endpoint $ep (E2E_BASE_URL=$url)" + echo "using probed endpoint $ep" echo "DOCKER_HOST=$ep" >> "$GITHUB_ENV" - echo "E2E_BASE_URL=$url" >> "$GITHUB_ENV" exit 0 fi i=$((i+1)); sleep 2 @@ -83,6 +55,20 @@ jobs: echo "::error::no reachable docker daemon (tried: ${DOCKER_HOST:-}, unix:///var/run/docker.sock, tcp://localhost:2375, tcp://localhost:2376, tcp://docker:2375, tcp://docker:2376)" >&2 exit 1 + # Job and app containers share the daemon, so put them on one user-defined network + # and reach the app by service DNS — no endpoint-derived URLs (the job's netns has + # no default route on this runner). The alias `app` is declared in docker-compose.ci.yml. + - name: Prepare e2e network + run: | + set -u + docker network inspect flight-ci-e2e >/dev/null 2>&1 || docker network create flight-ci-e2e + if ! docker network connect flight-ci-e2e "$(hostname)"; then + echo "::error::failed to attach job container '$(hostname)' to flight-ci-e2e — the job must run in a container on the shared daemon (check runner config)" >&2 + exit 1 + fi + docker network inspect flight-ci-e2e --format 'containers on flight-ci-e2e: {{range .Containers}}{{.Name}} {{end}}' + echo "E2E_BASE_URL=http://app:3000" >> "$GITHUB_ENV" + - name: Setup Node uses: actions/setup-node@v4 with: @@ -108,14 +94,23 @@ jobs: - name: Install browsers (local) run: npx playwright install --with-deps chromium - # E2E against an isolated stack inside dind — never the production instance. - # docker-compose.ci.yml mirrors docker-compose.yml minus Traefik; fresh named-volume - # DB per run. E2E_DEPLOY_CMD makes the config's webServer block deploy + wait for - # readiness; E2E_COMPOSE_ARGS points state.spec.ts' mid-run `docker compose restart - # flight` at the same file. DOCKER_HOST/E2E_BASE_URL come from GITHUB_ENV above. + # E2E against an isolated stack on the shared daemon — never the production instance. + # docker-compose.ci.yml joins the flight-ci-e2e network prepared above; project name + # flight-ci keeps it distinct from production. E2E_DEPLOY_CMD makes the config's + # webServer block deploy + wait for readiness (http://app:3000 via service DNS); + # E2E_COMPOSE_ARGS points state.spec.ts' mid-run `docker compose restart flight` at + # the same file + project. DOCKER_HOST/E2E_BASE_URL come from GITHUB_ENV above. - name: E2E (isolated stack in dind) env: PW_REMOTE_BROWSER: "0" - E2E_DEPLOY_CMD: docker compose -f docker-compose.ci.yml up -d --build - E2E_COMPOSE_ARGS: "-f docker-compose.ci.yml" + E2E_DEPLOY_CMD: docker compose -f docker-compose.ci.yml -p flight-ci up -d --build + E2E_COMPOSE_ARGS: "-f docker-compose.ci.yml -p flight-ci" run: npx playwright test + + # The daemon is shared with production — never leave our stack or network behind. + # -v drops the named DB volume so every run seeds fresh (no schema drift between PRs). + - name: Cleanup e2e stack + network + if: always() + run: | + docker compose -f docker-compose.ci.yml -p flight-ci down --remove-orphans -v || true + docker network remove flight-ci-e2e 2>/dev/null || true diff --git a/docker-compose.ci.yml b/docker-compose.ci.yml index 516aa8d..1724adf 100644 --- a/docker-compose.ci.yml +++ b/docker-compose.ci.yml @@ -1,19 +1,28 @@ -# Isolated e2e stack for CI (.gitea/workflows/ci.yml) — runs inside the job's dind daemon, -# never on the production host. Mirrors docker-compose.yml minus Traefik: no external -# dev_net, no traefik labels; the app is served directly on port 3000 of the dind container. +# Isolated e2e stack for CI (.gitea/workflows/ci.yml) — runs on the runner's shared dind +# daemon under project name flight-ci (distinct from production). Joins the external +# network flight-ci-e2e that the workflow attaches the job container to; the app is reached +# via service DNS as http://app:3000 (alias declared below) — no host port mapping needed. # The build context is tarred by the compose client in the job and sent over DOCKER_HOST, # so nothing here needs to be visible from inside dind; game state lives in a named volume -# (fresh per run, survives `docker compose restart flight` for e2e/state.spec.ts). +# (fresh per run — CI cleanup removes it — survives `docker compose restart flight` for +# e2e/state.spec.ts). services: flight: build: . image: flight-ops-ci - ports: - - "3000:3000" environment: FLIGHT_TEST_HOOKS: "1" volumes: - flight-db:/app/db + networks: + flight-ci-e2e: + aliases: + - app + +networks: + flight-ci-e2e: + name: flight-ci-e2e + external: true volumes: flight-db: diff --git a/e2e/state.spec.ts b/e2e/state.spec.ts index 9010a63..bfb9f6b 100644 --- a/e2e/state.spec.ts +++ b/e2e/state.spec.ts @@ -4,7 +4,7 @@ import { test, expect } from '@playwright/test'; // Repo root — docker-compose.yml lives here; `docker compose restart` runs on // this host (the test runner), browsers stay remote. CI points E2E_COMPOSE_ARGS at the -// isolated stack file (docker-compose.ci.yml) instead of the default one. +// isolated stack file + project (-f docker-compose.ci.yml -p flight-ci) instead of the default one. const repoRoot = path.join(__dirname, '..'); const composeArgs = process.env.E2E_COMPOSE_ARGS ?? ''; @@ -48,7 +48,7 @@ test('state survives a container restart (sim clock + account persisted)', async expect(resBefore.status()).toBe(200); const before = (await resBefore.json()) as StateBody; - execSync('docker compose restart flight', { cwd: repoRoot, stdio: 'pipe' }); + execSync(`docker compose ${composeArgs} restart flight`, { cwd: repoRoot, stdio: 'pipe' }); // Wait for the app to come back, capturing the post-restart snapshot. let after: StateBody | undefined;