S-04c · Run the ACL integration test on the CI runner (compose-network) #55

New Issue

not · 2026-06-29T10:02:45Z

not commented

2026-06-29 10:02:45 +00:00

Follow-up split from #46 (CLAUDE.md §13). S-04a delivered the ACL ↔ real-OpenZaak integration test; it passes via make integration locally / on a host-executing runner, but it cannot run on Gitea's hosted ubuntu-latest runner.

Why: the runner starts the OpenZaak stack as sibling containers via the host daemon, so published ports bind to the host — not to the runner's localhost. A process on the runner (the seed, and dotnet test) gets Connection refused on localhost:8000. Bind mounts have the same reach problem (see gitea-actions-gotchas.md §1). This is why compose-smoke only polls health via docker inspect and never talks to a service port.

Outcome: run the integration test (and the publishing seed) inside the compose network so they reach http://openzaak:8000 by service name, with sources delivered via a built image (not bind mounts). Then re-add a gating integration job to CI.

Options to weigh in this issue:

A built Dockerfile.integration (multi-stage: build Acl.IntegrationTests, run dotnet test --filter Category=Integration at container start) + a containerised seed step, joined to the OpenZaak network (OZ_BASE=http://openzaak:8000).
Gitea Actions services: for OpenZaak + Postgres + Redis (awkward multi-step init/seed ordering).
A host-executing self-hosted runner (reintroduces the runner we moved away from).

Out of scope: changing the test assertions or the gateway behaviour — those are done in #46.

Refs #46. Documented as a known gap in docs/runbooks/gitea-actions-gotchas.md.

Follow-up split from #46 (CLAUDE.md §13). S-04a delivered the ACL ↔ real-OpenZaak integration test; it passes via `make integration` **locally / on a host-executing runner**, but it cannot run on Gitea's hosted `ubuntu-latest` runner. **Why:** the runner starts the OpenZaak stack as *sibling* containers via the host daemon, so published ports bind to the host — not to the runner's `localhost`. A process on the runner (the seed, and `dotnet test`) gets `Connection refused` on `localhost:8000`. Bind mounts have the same reach problem (see gitea-actions-gotchas.md §1). This is why `compose-smoke` only polls health via `docker inspect` and never talks to a service port. **Outcome:** run the integration test (and the publishing seed) **inside the compose network** so they reach `http://openzaak:8000` by service name, with sources delivered via a built image (not bind mounts). Then re-add a gating `integration` job to CI. **Options to weigh in this issue:** - A built `Dockerfile.integration` (multi-stage: build `Acl.IntegrationTests`, run `dotnet test --filter Category=Integration` at container start) + a containerised seed step, joined to the OpenZaak network (`OZ_BASE=http://openzaak:8000`). - Gitea Actions `services:` for OpenZaak + Postgres + Redis (awkward multi-step init/seed ordering). - A host-executing self-hosted runner (reintroduces the runner we moved away from). **Out of scope:** changing the test assertions or the gateway behaviour — those are done in #46. Refs #46. Documented as a known gap in `docs/runbooks/gitea-actions-gotchas.md`.

not added this to the Iteration 1 — Walking Skeleton milestone 2026-06-29 10:02:45 +00:00

not added the type:slice area:acl area:infra labels 2026-06-29 10:02:45 +00:00

not referenced this issue from a commit

2026-06-29 10:04:47 +00:00

ci(acl): keep the integration lane local-only; document the runner gap (refs #46)

~~not referenced this issue 2026-06-29 10:05:11 +00:00~~

test(acl): ACL integration test against real OpenZaak (closes #46) #54

not referenced this issue from a commit

2026-06-29 10:28:47 +00:00

ci(acl): run the ACL integration test in CI inside the compose network (closes #55) (refs #46)

not referenced a pull request that will close this issue

2026-06-29 10:29:08 +00:00