fix(ci): correct Docker inspect templates (#1)

.gitea/workflows/ci.yml

@@ -168,8 +168,8 @@ jobs:
           test -n "$container_id"
           test "$(docker inspect --format '{{.Config.User}}' "$container_id")" = "1654:1654"
           test "$(docker inspect --format '{{.HostConfig.ReadonlyRootfs}}' "$container_id")" = "true"
-          test "$(docker inspect --format '{{range .Mounts}}{{if eq .Destination \"/app/appsettings.Production.json\"}}{{.RW}}{{end}}{{end}}' "$container_id")" = "false"
-          test "$(docker inspect --format '{{range .Mounts}}{{if eq .Destination \"/run/secrets/rendezvous-signing-key\"}}{{.RW}}{{end}}{{end}}' "$container_id")" = "false"
+          test "$(docker inspect --format '{{range .Mounts}}{{if eq .Destination "/app/appsettings.Production.json"}}{{.RW}}{{end}}{{end}}' "$container_id")" = "false"
+          test "$(docker inspect --format '{{range .Mounts}}{{if eq .Destination "/run/secrets/rendezvous-signing-key"}}{{.RW}}{{end}}{{end}}' "$container_id")" = "false"
           for attempt in {1..100}; do
             if curl --fail --silent "${RENDEZVOUS_SMOKE_HTTP_URL%/}/health/ready" >/dev/null 2>&1; then
               break

tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs

@@ -183,6 +183,22 @@ public sealed class ReleaseCompatibilityTests
         }
     }
 
+    [Fact]
+    public void ContainerGateUsesValidInspectTemplates()
+    {
+        string root = FindRepositoryRoot();
+        string workflow = File.ReadAllText(Path.Combine(root, ".gitea/workflows/ci.yml"));
+        Assert.Contains(
+            "eq .Destination \"/app/appsettings.Production.json\"",
+            workflow,
+            StringComparison.Ordinal);
+        Assert.Contains(
+            "eq .Destination \"/run/secrets/rendezvous-signing-key\"",
+            workflow,
+            StringComparison.Ordinal);
+        Assert.DoesNotContain("eq .Destination \\\"", workflow, StringComparison.Ordinal);
+    }
+
     [Fact]
     public void ServerSourceManifestIsCompleteSortedAndDeterministic()
     {