ci: docker compose (prod + isolated e2e) and Gitea CI pipeline

Prod compose: Traefik labels for space-wanderer.dev.kkhost.pl, ./db volume mount.
CI compose: project space-wanderer-ci on external network space-wanderer-ci-e2e with
the app pinned to static IP 172.39.0.10 (Flight-Ops mechanism verbatim, distinct
network name so both stacks coexist on the shared dind daemon), fresh named DB volume
per run. ci.yml: single 'build + unit + e2e' job — required status check name kept;
flaky-uplink retry loops, dep/browser caches, dind cleanup + prune carried over.

.gitea/workflows/ci.yml

@@ -0,0 +1,229 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  workflow_dispatch:
+
+jobs:
+  ci:
+    name: build + unit + e2e
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # The runner provides a working docker CLI out of the box (full-dind) — no endpoint
+      # resolution needed. Job and app containers share the daemon, so put them on one
+      # user-defined network with a pinned subnet; the app gets a STATIC IP (172.39.0.10,
+      # declared in docker-compose.ci.yml) because Chromium got ERR_SSL_PROTOCOL_ERROR via
+      # the DNS alias while node-side HTTP to the same name worked — bypassing DNS removes
+      # that variable entirely. A stale network with a different subnet is recreated.
+      - name: Prepare e2e network
+        run: |
+          set -u
+          # Interrupted runs skip the end-of-run cleanup, leaking a USED DB volume into later
+          # runs (tests assume seeded state) — drop it so every run starts fresh.
+          docker volume rm space-wanderer-ci_space-wanderer-db 2>/dev/null || true
+          SUBNET=172.39.0.0/24
+          if docker network inspect space-wanderer-ci-e2e >/dev/null 2>&1; then
+            cur=$(docker network inspect space-wanderer-ci-e2e --format '{{(index .IPAM.Config 0).Subnet}}')
+            if [ "$cur" != "$SUBNET" ]; then
+              echo "stale space-wanderer-ci-e2e with subnet $cur — recreating with $SUBNET"
+              docker network rm space-wanderer-ci-e2e || true
+              docker network create --subnet "$SUBNET" space-wanderer-ci-e2e
+            fi
+          else
+            docker network create --subnet "$SUBNET" space-wanderer-ci-e2e
+          fi
+          if ! docker network connect space-wanderer-ci-e2e "$(hostname)"; then
+            echo "::error::failed to attach job container '$(hostname)' to space-wanderer-ci-e2e — the job must run in a container on the shared daemon (check runner config)" >&2
+            exit 1
+          fi
+          docker network inspect space-wanderer-ci-e2e --format 'containers on space-wanderer-ci-e2e: {{range .Containers}}{{.Name}} {{end}}'
+          echo "E2E_BASE_URL=http://172.39.0.10:3000" >> "$GITHUB_ENV"
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      # bun drives installs (repo ships bun.lock, no package-lock.json); pinned to 1.4.2.
+      # Retried: the runner's outbound network/DNS is flaky (transient EAI_AGAIN seen in CI).
+      - name: Install bun
+        run: |
+          set -u
+          ok=0
+          for i in 1 2 3; do
+            if npm i -g bun@1.4.2; then ok=1; break; fi
+            echo "::warning::bun install attempt $i/3 failed (likely transient network) — retrying in 5s" >&2
+            sleep 5
+          done
+          [ "$ok" = "1" ] || { echo "::error::bun install failed after 3 attempts" >&2; exit 1; }
+          bun --version
+
+      # Job-level dep cache via the runner's built-in cache server. continue-on-error on
+      # both steps: an unreachable/broken cache server must never break the run.
+      - name: Restore deps cache
+        uses: actions/cache@v4
+        continue-on-error: true
+        with:
+          path: |
+            node_modules
+            $HOME/.bun/install/cache
+          key: ${{ runner.os }}-deps-bun-${{ hashFiles('bun.lock') }}
+
+      # Retried: the runner's outbound network/DNS is flaky (transient EAI_AGAIN seen in CI).
+      - name: Install dependencies
+        run: |
+          set -u
+          ok=0
+          for i in 1 2 3; do
+            if bun install --frozen-lockfile; then ok=1; break; fi
+            echo "::warning::dependency install attempt $i/3 failed (likely transient network) — retrying in 5s" >&2
+            sleep 5
+          done
+          [ "$ok" = "1" ] || { echo "::error::dependency install failed after 3 attempts" >&2; exit 1; }
+
+      # No explicit save step: caches marked by the restore steps are uploaded automatically at job end.
+
+      - name: Build
+        run: npm run build
+
+      - name: Unit tests
+        run: npx vitest run
+
+      # Browsers run locally in CI (PW_REMOTE_BROWSER=0 below): the shared remote browser
+      # server at 192.168.1.4 cannot reach a stack inside dind, and local chromium keeps
+      # the job self-contained.
+      # Browser binaries (~187 MiB) cached across runs: the runner's uplink is flaky and
+      # cdn.playwright.dev downloads time out mid-transfer; once seeded, installs skip the download.
+      - name: Restore browser cache
+        uses: actions/cache@v4
+        continue-on-error: true
+        with:
+          path: $HOME/.cache/ms-playwright
+          key: ${{ runner.os }}-pw-browsers-${{ hashFiles('package.json') }}
+
+      # Retried: cdn.playwright.dev is flaky from this runner — Playwright's internal 5-retry
+      # window (~40-90s) is often not enough, but runs get through with a longer one. Progress
+      # accumulates across attempts: playwright skips already-installed browsers.
+      - name: Install browsers (local)
+        run: |
+          set -u
+          ok=0
+          for i in 1 2 3 4 5 6; do
+            if npx playwright install --with-deps chromium; then ok=1; break; fi
+            echo "::warning::browser install attempt $i/6 failed (flaky cdn.playwright.dev) — retrying in 5s" >&2
+            sleep 5
+          done
+          [ "$ok" = "1" ] || { echo "::error::browser install failed after 6 attempts" >&2; exit 1; }
+
+      # Cache the base image on the shared daemon up front: a single loud failure here
+      # beats a 6-minute BuildKit "failed to solve" when the daemon's outbound net is down.
+      - name: Pull e2e base image
+        run: docker pull node:22-slim
+
+      # Pre-build the e2e image with retries (flaky runner network); the E2E step's own
+      # build then becomes a fast no-op. Plain progress keeps BuildKit output visible.
+      - name: Build e2e image (retries)
+        run: |
+          set -u
+          ok=0
+          for i in 1 2 3; do
+            if docker compose -f docker-compose.ci.yml -p space-wanderer-ci build --progress=plain; then ok=1; break; fi
+            echo "::warning::e2e image build attempt $i/3 failed (likely transient network) — retrying in 5s" >&2
+            sleep 5
+          done
+          [ "$ok" = "1" ] || { echo "::error::e2e image build failed after 3 attempts" >&2; exit 1; }
+
+      # E2E against an isolated stack on the shared daemon — never the production instance.
+      # docker-compose.ci.yml joins the space-wanderer-ci-e2e network prepared above; project name
+      # space-wanderer-ci keeps it distinct from production. E2E_DEPLOY_CMD makes the config's
+      # webServer block deploy + wait for readiness (http://app:3000 via service DNS);
+      # E2E_COMPOSE_ARGS points state.spec.ts' mid-run `docker compose restart space-wanderer` at
+      # the same file + project. E2E_BASE_URL comes from GITHUB_ENV (Prepare e2e network).
+      - name: E2E (isolated stack in dind)
+        env:
+          PW_REMOTE_BROWSER: "0"
+          # Build separately with plain progress so BuildKit step output is visible in the
+          # job log (auto progress hides it). Playwright's webServer needs a long-running
+          # command — `up -d` returns immediately and triggers "exited early"; `logs -f`
+          # keeps it alive, streams app logs into CI output for debugging, and is killed with
+          # the job (an orphaned `logs -f` dies on its own when cleanup removes the container).
+          E2E_DEPLOY_CMD: "docker compose -f docker-compose.ci.yml -p space-wanderer-ci build --progress=plain && docker compose -f docker-compose.ci.yml -p space-wanderer-ci up -d && docker compose -f docker-compose.ci.yml -p space-wanderer-ci logs -f"
+          E2E_COMPOSE_ARGS: "-f docker-compose.ci.yml -p space-wanderer-ci"
+          # Chromium honors proxy env vars on Linux (node-side HTTP does not) — keep the
+          # in-network app host out of any proxy path.
+          NO_PROXY: app,localhost,127.0.0.1,.kkhost.pl
+          no_proxy: app,localhost,127.0.0.1,.kkhost.pl
+          # Machine-readable e2e results for the job-summary step below (Playwright's built-in
+          # json reporter; without this env var it would dump to stdout). test-results/ is git-ignored.
+          PLAYWRIGHT_JSON_OUTPUT_FILE: test-results/e2e.json
+        # Connectivity diagnostics now run post-deploy in e2e/ci-diagnostics.ts (globalSetup).
+        # --reporter=list prints each test as it completes (name + ✓/× + duration) for progress
+        # visibility in the job log; failure error context/snapshots are unchanged. The json
+        # reporter adds a machine-readable report (PLAYWRIGHT_JSON_OUTPUT_FILE above) — no
+        # execution behavior changes, reporters only observe.
+        run: npx playwright test --reporter=list,json
+
+      # Appends e2e results to the job-summary panel — mirrors how unit tests get there
+      # (vitest's built-in github-actions reporter auto-appends $GITHUB_STEP_SUMMARY in CI).
+      # if: always() so a FAILED suite still gets summarized; non-fatal by design — a missing
+      # or malformed report must never mask the real e2e exit code. The script is single-quoted
+      # for bash, so it contains no apostrophes.
+      - name: E2E job summary
+        if: always()
+        run: |
+          node -e '
+            const fs = require("fs");
+            let report;
+            try {
+              report = JSON.parse(fs.readFileSync("test-results/e2e.json", "utf8"));
+            } catch {
+              process.exit(0); // e2e never ran (earlier step failed) or no report — nothing to summarize
+            }
+            let passed = 0, skipped = 0;
+            const failed = [];
+            const walk = (suite) => {
+              for (const spec of suite.specs ?? []) {
+                if (!spec.ok) failed.push(`${suite.title} › ${spec.title}`);
+                else if ((spec.tests ?? []).length && spec.tests.every((t) => t.expectedStatus === "skipped")) skipped++;
+                else passed++;
+              }
+              for (const sub of suite.suites ?? []) walk(sub);
+            };
+            for (const s of report.suites ?? []) walk(s);
+            const lines = [
+              "", "## E2E results", "",
+              `- Passed: ${passed}`,
+              `- Failed: ${failed.length}`,
+              `- Skipped: ${skipped}`,
+            ];
+            if (failed.length) {
+              lines.push("", "### Failed specs");
+              for (const f of failed) lines.push(`- \`${f}\``);
+            }
+            const summaryFile = process.env.GITHUB_STEP_SUMMARY;
+            if (summaryFile) fs.appendFileSync(summaryFile, lines.join("\n") + "\n");
+          ' || true
+
+      # The daemon is shared with production — never leave our stack or network behind.
+      # -v drops the named DB volume so every run seeds fresh (no schema drift between PRs).
+      - name: Cleanup e2e stack + network
+        if: always()
+        run: |
+          docker compose -f docker-compose.ci.yml -p space-wanderer-ci down --remove-orphans -v || true
+          docker network remove space-wanderer-ci-e2e 2>/dev/null || true
+
+      # The shared runner dind still accumulates between runs what the steps above can't reach:
+      # dangling images/layers from the per-run space-wanderer-ci rebuilds, BuildKit cache, and job
+      # containers leaked by interrupted runs. Prune them here (after stack + network cleanup).
+      # Deliberately NO --volumes: the daemon is shared with production and named volumes may hold
+      # other workflows' persistent data — this project's own space-wanderer-ci_space-wanderer-db volume is already
+      # dropped by the steps above. Non-fatal so a prune failure can never mask or break the run.
+      - name: Prune runner dind leftovers
+        if: always()
+        run: docker system prune -af || echo "::warning::dind prune failed — see logs"

docker-compose.ci.yml

@@ -0,0 +1,29 @@
+# Isolated e2e stack for CI (.gitea/workflows/ci.yml) — runs on the runner's shared dind
+# daemon under project name space-wanderer-ci (distinct from production). Joins the external
+# network space-wanderer-ci-e2e that the workflow attaches the job container to; the app is reached
+# at its STATIC IP http://172.39.0.10:3000 — DNS bypassed for the browser because Chromium
+# got ERR_SSL_PROTOCOL_ERROR via the hostname while node-side HTTP worked (the `app` alias
+# stays as a convenience). Single deterministic address; survives `docker compose restart space-wanderer`.
+# The build context is tarred by the compose client in the job and sent over DOCKER_HOST,
+# so nothing here needs to be visible from inside dind; game state lives in a named volume
+# (fresh per run — CI cleanup removes it — survives `docker compose restart space-wanderer` for
+# e2e/state.spec.ts).
+services:
+  space-wanderer:
+    build: .
+    image: space-wanderer-ci
+    volumes:
+      - space-wanderer-db:/app/db
+    networks:
+      space-wanderer-ci-e2e:
+        aliases:
+          - app
+        ipv4_address: 172.39.0.10
+
+networks:
+  space-wanderer-ci-e2e:
+    name: space-wanderer-ci-e2e
+    external: true
+
+volumes:
+  space-wanderer-db:

docker-compose.yml

@@ -0,0 +1,17 @@
+services:
+  space-wanderer:
+    build: .
+    volumes:
+      # Game state SQLite: created on first run, must survive rebuilds.
+      - "./db:/app/db"
+    networks:
+      - dev_net
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.space-wanderer.rule=Host(`space-wanderer.dev.kkhost.pl`)"
+      - "traefik.http.routers.space-wanderer.entrypoints=web"
+      - "traefik.http.services.space-wanderer.loadbalancer.server.port=3000"
+
+networks:
+  dev_net:
+    external: true