From a9ceb8f03f7c015a20f6aceba1fa2b5a06002994 Mon Sep 17 00:00:00 2001
From: Emi Griffith <me@emigriffith.dev>
Date: Wed, 22 Jul 2026 22:24:31 -0700
Subject: [PATCH] CI: port the dev-branch in-image test step into the reusable
 build check

Backend runs its full hermetic suite, frontend its unit tier, inside the
just-built image -- the dev-only feature both app repos carried in their own
build.yml (deleted here in favor of the root workflow).
---
 .forgejo/workflows/build.yml | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 10da8c3..7b8e950 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -1,6 +1,6 @@
 name: Build check (reusable)
 
-# Build-only `docker build` sanity check for ONE app domain, reused via
+# `docker build` + in-image test check for ONE app domain, reused via
 # `uses:` by pr-build.yml and the deploy-dev workflows -- the monorepo port of
 # each app repo's build.yml. Still deliberately NOT a live boot+healthz check:
 # that was tried in the split repos and repeatedly hit this runner's own
@@ -34,3 +34,25 @@ jobs:
 
       - name: Build
         run: docker build -t thermograph-${{ inputs.domain }}:ci ${{ inputs.domain }}/
+
+      # Run the hermetic test tier INSIDE the image we just built (each image
+      # ships tests/ + every runtime dep via COPY . /app/): the exact
+      # interpreter/deps that ship, none of the runner-environment quirks that
+      # sank the old host-side boot check. Backend runs its full (hermetic)
+      # suite; frontend runs only its unit tier -- its integration tier
+      # (frontend/tests/integration/, needs a live backend container) stays a
+      # local `make`/scripts concern, see frontend/scripts/backend-for-tests.sh.
+      # requirements-dev only layers pytest on top, so the install is tiny.
+      # -u 0: the images' default user can't write to site-packages.
+      # --entrypoint sh: backend's entrypoint is alembic-migrate + uvicorn --
+      # without the override the test command is swallowed as entrypoint args
+      # and the container just boots the server forever (harmless no-op for
+      # frontend, which has no entrypoint). unset THERMOGRAPH_BASE: the images
+      # bake the prod root-mount (/), which moves every route off the
+      # /thermograph prefix the tests are written against.
+      - name: Run tests in the built image
+        run: |
+          target=tests
+          if [ "${{ inputs.domain }}" = "frontend" ]; then target=tests/unit; fi
+          docker run --rm -u 0 --entrypoint sh thermograph-${{ inputs.domain }}:ci \
+            -c "unset THERMOGRAPH_BASE; pip install -q --no-cache-dir pytest==8.4.1 && python -m pytest $target -q"