From 172b461fb0fd42e154018255812bd2af7b695e89 Mon Sep 17 00:00:00 2001 From: ogt Date: Tue, 14 Jul 2026 11:08:12 +0800 Subject: [PATCH] fix(cd): isolate asset migration verifier network --- .gitea/workflows/cd.yaml | 4 +++- .../api/tests/test_asset_inventory_database_type_migration.py | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml index 995e735c2..b720bed5e 100644 --- a/.gitea/workflows/cd.yaml +++ b/.gitea/workflows/cd.yaml @@ -1832,7 +1832,9 @@ jobs: echo "::error::MIGRATION_DATABASE_URL secret not set in Gitea" exit 1 fi - docker run --rm --network host -i \ + # The migration target is a routed LAN endpoint; the default bridge + # keeps the verifier compatible with the runner's userns-remap policy. + docker run --rm --network bridge -i \ -e DATABASE_URL \ -e MIGRATION_DATABASE_URL \ -v "$PWD/apps/api/migrations/asset_inventory_database_types_2026-07-14.sql:/tmp/asset_inventory_type.sql:ro" \ diff --git a/apps/api/tests/test_asset_inventory_database_type_migration.py b/apps/api/tests/test_asset_inventory_database_type_migration.py index 662999986..fb1dd47e2 100644 --- a/apps/api/tests/test_asset_inventory_database_type_migration.py +++ b/apps/api/tests/test_asset_inventory_database_type_migration.py @@ -58,6 +58,8 @@ def test_cd_applies_and_independently_verifies_the_bounded_migration() -> None: assert "MIGRATION_DATABASE_URL: ${{ secrets.MIGRATION_DATABASE_URL }}" in step assert "DATABASE_URL: ${{ secrets.DATABASE_URL }}" in step assert "${{ secrets." not in script + assert "--network bridge" in script + assert "--network host" not in script assert "asset_inventory_database_types_2026-07-14.sql" in script assert "asset_inventory_type_migration_applied=" in script assert "database_type_allowed=" in script