fix(ci): isolate deployment smoke client (#1)

.gitea/workflows/release.yml

@@ -112,18 +112,19 @@ jobs:
         run: |
           set -euo pipefail
           secret="deploy/compose/secrets/signing-key"
-          compose_network=""
           cleanup() {
-            if [[ -n "$compose_network" ]]; then
-              docker network disconnect "$compose_network" "$HOSTNAME" >/dev/null 2>&1 || true
-            fi
             RENDEZVOUS_UID=1654 RENDEZVOUS_GID=1654 RENDEZVOUS_IMAGE="git.finalfactory.de/heikyu/rendezvous:${RENDEZVOUS_VERSION}" \
               docker compose -f deploy/compose/compose.yaml down --volumes >/dev/null 2>&1 || true
             rm -f "$secret"
           }
           trap cleanup EXIT
+          umask 077
           install -d -m 0700 deploy/compose/secrets
           openssl rand -out "$secret" 32
+          chmod 0600 "$secret"
+          publisher_credential="$(RENDEZVOUS_SMOKE_LOCAL_KEY="$secret" \
+            ./scripts/mint-local-publisher-credential.sh)"
+          export RENDEZVOUS_PUBLISHER_CREDENTIAL="$publisher_credential"
           chmod 0444 "$secret"
           export RENDEZVOUS_UID=1654
           export RENDEZVOUS_GID=1654
@@ -141,21 +142,29 @@ jobs:
           test -n "$container_id"
           compose_network="$(docker inspect "$container_id" | jq -er \
             '.[0].NetworkSettings.Networks | keys[0]')"
-          docker network connect "$compose_network" "$HOSTNAME"
           service_ip="$(docker inspect "$container_id" | jq -er \
             --arg network "$compose_network" \
             '.[0].NetworkSettings.Networks[$network].IPAddress')"
-          export RENDEZVOUS_SMOKE_HTTP_URL="http://${service_ip}:8080/"
-          export RENDEZVOUS_SMOKE_UDP_ENDPOINT="${service_ip}:9050"
-          for attempt in {1..100}; do
-            curl --fail --silent "${RENDEZVOUS_SMOKE_HTTP_URL%/}/health/ready" >/dev/null 2>&1 && break
-            if (( attempt == 100 )); then
+          docker run --rm \
+            --network "$compose_network" \
+            --user "$(id -u):$(id -g)" \
+            --env HOME=/tmp \
+            --env RENDEZVOUS_SMOKE_HTTP_URL="http://${service_ip}:8080/" \
+            --env RENDEZVOUS_SMOKE_UDP_ENDPOINT="${service_ip}:9050" \
+            --env RENDEZVOUS_PUBLISHER_CREDENTIAL \
+            --volume "$runner_workspace_source:/source:ro" \
+            --workdir /source \
+            "$RENDEZVOUS_RELEASE_BUILDER" \
+            bash -lc '
+              for attempt in {1..300}; do
+                curl --fail --silent "${RENDEZVOUS_SMOKE_HTTP_URL%/}/health/ready" >/dev/null 2>&1 && exec ./scripts/smoke-deployment.sh
+                sleep 0.1
+              done
+              exit 1
+            ' || {
               docker compose -f deploy/compose/compose.yaml logs rendezvous
               exit 1
-            fi
-            sleep 0.1
-          done
-          ./scripts/smoke-deployment.sh
+            }
 
       - name: Scan candidate for high and critical vulnerabilities
         uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0, post-incident safe SHA