From c0843af83e9e0f3f89fbb533060e7a296ba7db0d Mon Sep 17 00:00:00 2001
From: Per Magnus Petersen <magnus@pmagnus.dk>
Date: Sat, 19 Sep 2026 16:20:59 +0200
Subject: [PATCH] Copy real test inputs into nested CI containers

---
 .gitea/workflows/build.yml |  9 ++-------
 .gitea/workflows/pr.yml    |  2 ++
 scripts/test-fencing.sh    | 11 ++++++++---
 3 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index e8000e1..445c909 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -16,13 +16,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Test
-        run: |
-          docker run --rm \
-            -v "$PWD:/app" \
-            -w /app \
-            clojure:temurin-21-tools-deps-alpine \
-            clj -M:test
+      - name: Unit and PostgreSQL fencing tests
+        run: bash scripts/test-fencing.sh
 
       - name: Generate immutable tags
         id: tags
diff --git a/.gitea/workflows/pr.yml b/.gitea/workflows/pr.yml
index 3a2489c..ed3cfb3 100644
--- a/.gitea/workflows/pr.yml
+++ b/.gitea/workflows/pr.yml
@@ -7,6 +7,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Unit and PostgreSQL fencing tests
         run: bash scripts/test-fencing.sh
 # No registry, deployment, or production credentials in PR jobs.
diff --git a/scripts/test-fencing.sh b/scripts/test-fencing.sh
index 1528436..45909fd 100644
--- a/scripts/test-fencing.sh
+++ b/scripts/test-fencing.sh
@@ -3,7 +3,7 @@
 set -euo pipefail
 name="btcdata-test-${GITHUB_RUN_ID:-$$}-${GITHUB_RUN_ATTEMPT:-1}"
 cleanup() {
-  docker rm -f "$name" >/dev/null 2>&1 || true
+  docker rm -f "${name}-runner" "$name" >/dev/null 2>&1 || true
   docker network rm "$name" >/dev/null 2>&1 || true
 }
 trap cleanup EXIT
@@ -22,6 +22,11 @@ if [ "$ready" != true ]; then
   echo 'Disposable PostgreSQL did not become ready' >&2
   exit 1
 fi
-docker run --rm --network "$name" -v "$PWD:/app" -w /app \
+# The CI workspace is inside the runner container, not on the Docker host.
+# Copy only test inputs; never mount a nonexistent host workspace or copy .env/.git.
+docker create --name "${name}-runner" --network "$name" -w /app \
   -e "BTCDATA_TEST_JDBC_URL=jdbc:postgresql://$name:5432/postgres?user=postgres" \
-  clojure:temurin-21-tools-deps-alpine clj -M:test
+  clojure:temurin-21-tools-deps-alpine clj -M:test >/dev/null
+COPYFILE_DISABLE=1 tar --no-xattrs -cf - deps.edn src resources test env/test | docker cp - "${name}-runner:/app"
+docker start --attach "${name}-runner"
+exit "$(docker inspect --format '{{.State.ExitCode}}' "${name}-runner")"