.github/workflows/ci.yml

@@ -21,35 +21,37 @@ jobs:
     runs-on: ubuntu-latest
     needs: gates
     # Compile sqlx query! macros against the committed .sqlx cache (no DB needed).
-    # Tests still need a live Postgres — locally cm-testkit reads CM_TEST_DATABASE_URL
+    # Tests need a live Postgres — locally cm-testkit reads CM_TEST_DATABASE_URL
     # from .cargo/config.toml pointing at scripts/test-server.sh's host container.
-    # In CI the runner is on the fleet's native act_runner (morpheus/tank/architect);
-    # each job runs inside its own container, so we start postgres in the same
-    # network namespace as the job container — both then reach each other on
-    # 127.0.0.1. `services:` was flaky at v1.0.8 (DNS name didn't resolve).
+    # The fleet act_runner uses the `host` executor (jobs run on morpheus/tank/
+    # architect natively, not inside a container), so we start a per-run postgres
+    # container and reach it via its bridge IP. GITHUB_RUN_ID scopes the name so
+    # concurrent jobs on the same runner don't collide.
     env:
       SQLX_OFFLINE: "true"
-      CM_TEST_DATABASE_URL: postgres://postgres:[email protected]:5432/postgres
     steps:
       - uses: actions/checkout@v4
-      - name: Start postgres in the job's netns
+      - name: Start postgres sidecar
         run: |
           set -euo pipefail
-          docker rm -f ci-pg >/dev/null 2>&1 || true
-          docker run -d --name ci-pg \
-            --network "container:$(cat /etc/hostname)" \
+          NAME="ci-pg-${GITHUB_RUN_ID}"
+          docker rm -f "$NAME" >/dev/null 2>&1 || true
+          docker run -d --name "$NAME" \
             -e POSTGRES_PASSWORD=postgres \
             -e POSTGRES_DB=postgres \
             postgres:16-alpine >/dev/null
+          PG_IP=$(docker inspect -f '{{.NetworkSettings.IPAddress}}' "$NAME")
+          echo "PG_CONTAINER=$NAME" >> "$GITHUB_ENV"
+          echo "CM_TEST_DATABASE_URL=postgres://postgres:postgres@${PG_IP}:5432/postgres" >> "$GITHUB_ENV"
           for i in $(seq 1 30); do
-            if docker exec ci-pg pg_isready -U postgres -q >/dev/null 2>&1; then
-              echo "postgres ready after ${i}s"
+            if docker exec "$NAME" pg_isready -U postgres -q >/dev/null 2>&1; then
+              echo "postgres ready at ${PG_IP} after ${i}s"
               exit 0
             fi
             sleep 1
           done
           echo "postgres never became ready" >&2
-          docker logs ci-pg >&2 || true
+          docker logs "$NAME" >&2 || true
           exit 1
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -66,7 +68,7 @@ jobs:
         run: ./ci/test-install.sh
       - name: Cleanup postgres sidecar
         if: always()
-        run: docker rm -f ci-pg >/dev/null 2>&1 || true
+        run: docker rm -f "${PG_CONTAINER:-}" >/dev/null 2>&1 || true
 
   frontend:
     runs-on: ubuntu-latest