fix smoke tests

.gitea/workflows/docker.yml

@@ -70,19 +70,37 @@ jobs:
         run: |
           # A tag nobody can run is worse than no tag. SQLite keeps this to one
           # container: no database service, no network, no .env.
+          #
+          # No `-p`: the job itself runs in a container and talks to the host's
+          # docker daemon through the mounted socket, so a published port lands
+          # on the *host*, where this container's 127.0.0.1 cannot see it. Curl
+          # from inside the smoke container instead, which also exercises the
+          # image exactly as it will run.
           docker run -d --name kadence-smoke \
             -e DATABASE_URL="sqlite:///./kadence.db" \
             -e SCHEDULER_ENABLED=0 -e TELEGRAM_BOT_ENABLED=0 \
-            -p 18000:8000 "$IMAGE:$SHORT"
+            "$IMAGE:$SHORT"
+
+          cleanup() {
+            docker logs kadence-smoke 2>&1 | tail -20 || true
+            docker rm -f kadence-smoke >/dev/null 2>&1 || true
+          }
+          trap cleanup EXIT
+
           for _ in $(seq 1 30); do
-            if curl -fsS http://127.0.0.1:18000/api/health >/dev/null 2>&1; then
-              echo "healthy"; break
+            if docker exec kadence-smoke curl -fsS http://localhost:8000/api/health >/dev/null 2>&1; then
+              echo "healthy"
+              break
+            fi
+            # Fail fast instead of waiting out the loop when the app crashed.
+            if [ "$(docker inspect -f '{{.State.Running}}' kadence-smoke)" != "true" ]; then
+              echo "::error::smoke container exited before becoming healthy"
+              exit 1
             fi
             sleep 2
           done
-          curl -fsS http://127.0.0.1:18000/api/health
-          docker logs kadence-smoke | tail -20
-          docker rm -f kadence-smoke
+
+          docker exec kadence-smoke curl -fsS http://localhost:8000/api/health
 
       - name: Push
         if: steps.login.outputs.push == 'true'