.gitea/workflows/ci.yml

@@ -17,6 +17,17 @@
 # Both jobs cache pnpm store + go modules. Coverage uploaded as artifacts.
 # The M2 acceptance gate (spec §6) requires both jobs GREEN.
 
+# NOTE (2026-10-26, coreci-chat-po): this file is the trigger source. Gitea
+# registers workflow triggers only on a default-branch push that touches THIS
+# file (sre readback c12346, "F-1"); a push that touches other paths leaves
+# the pipeline unfired (coreci-chat#1, M3 kickoff gate). Keep this file in the
+# diff of the next push to main until the first green run lands.
+#
+# NOTE (2026-10-26, coreci-chat-po): the jobs run on the fleet shared-pool label
+# `ubuntu-latest`. The `node` label is a bare node:24-bookworm image with no fleet
+# toolchain - nova-platform run 51350 went green on ubuntu-latest, run 51345 red on
+# node. Go and the postgres client are installed by the jobs themselves, and the
+# postgres service is reached by its service name (coreci-chat#1, M3 kickoff gate).
 name: ci
 
 on:
@@ -24,6 +35,7 @@ on:
     branches: ["**"]
   pull_request:
     branches: ["**"]
+  workflow_dispatch:
 
 env:
   # Pin Node + pnpm versions for reproducibility.
@@ -34,7 +46,7 @@ jobs:
   # ─── Job 1: test-pglite (default — PGlite in-process) ──────────────────
   test-pglite:
     name: test-pglite (PGlite, default)
-    runs-on: node
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
       - name: Checkout
@@ -92,6 +104,12 @@ jobs:
           pnpm --filter @coreci/mcp test:coverage || true
         continue-on-error: true
 
+      - name: Setup Go 1.23
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.23"
+          cache: false
+
       - name: Go tests (Relay Agent)
         run: |
           if [ -f apps/relay-agent/go.mod ]; then
@@ -112,7 +130,7 @@ jobs:
   # ─── Job 2: test-postgres (G-022 — real Postgres 16, RLS enforced) ──────
   test-postgres:
     name: test-postgres (Postgres 16, G-022 RLS)
-    runs-on: node
+    runs-on: ubuntu-latest
     timeout-minutes: 25
     services:
       # Postgres 16 service container (R-009). The image is the official
@@ -134,8 +152,9 @@ jobs:
       # The test harness reads DB_MODE + DATABASE_URL. Connect as the
       # superuser to run setup-ci-roles.sql, then the tests connect as
       # coreci_app (NOBYPASSRLS) so RLS is enforced.
+      # DATABASE_URL is exported by the "Resolve the CI database host" step
+      # below, so the service host is decided once for every later step.
       DB_MODE: "pg"
-      DATABASE_URL: "postgres://coreci_app:coreci_app_ci@localhost:5432/coreci_ci"
       PGPASSWORD: postgres
     steps:
       - name: Checkout
@@ -162,14 +181,24 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Install the postgres client (the runner image carries no psql)
+        run: |
+          apt-get update -qq && apt-get install -y -qq postgresql-client
+
+      - name: Resolve the CI database host
+        run: |
+          HOST=$(getent hosts postgres >/dev/null 2>&1 && echo postgres || echo localhost)
+          echo "CI_DB_HOST=$HOST" >> "$GITHUB_ENV"
+          echo "DATABASE_URL=postgres://coreci_app:coreci_app_ci@$HOST:5432/coreci_ci" >> "$GITHUB_ENV"
+          echo "CI_MIGRATOR_DATABASE_URL=postgres://migrator:migrator_ci@$HOST:5432/coreci_ci" >> "$GITHUB_ENV"
+
       - name: [R-009] Setup CI roles (coreci_app NOBYPASSRLS, migrator BYPASSRLS)
         run: |
-          psql -h localhost -U postgres -d postgres -f packages/db/scripts/setup-ci-roles.sql
+          psql -h "$CI_DB_HOST" -U postgres -d postgres -f packages/db/scripts/setup-ci-roles.sql
 
       - name: [G-022] Run migrations as migrator (BYPASSRLS)
-        env:
-          DATABASE_URL: "postgres://migrator:migrator_ci@localhost:5432/coreci_ci"
-        run: pnpm --filter @coreci/db migrate
+        run: |
+          DATABASE_URL="$CI_MIGRATOR_DATABASE_URL" pnpm --filter @coreci/db migrate
 
       - name: [G-022] Build mcp (dist for smoke imports)
         run: pnpm --filter @coreci/mcp build