.gitea/workflows/build.yml

@@ -16,13 +16,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Test
+      - name: Unit and PostgreSQL fencing tests
-        run: |
+        run: bash scripts/test-fencing.sh
-          docker run --rm \
-            -v "$PWD:/app" \
-            -w /app \
-            clojure:temurin-21-tools-deps-alpine \
-            clj -M:test
 
       - name: Generate immutable tags
         id: tags

.gitea/workflows/pr.yml

@@ -7,6 +7,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Unit and PostgreSQL fencing tests
         run: bash scripts/test-fencing.sh
 # No registry, deployment, or production credentials in PR jobs.

scripts/test-fencing.sh

@@ -3,7 +3,7 @@
 set -euo pipefail
 name="btcdata-test-${GITHUB_RUN_ID:-$$}-${GITHUB_RUN_ATTEMPT:-1}"
 cleanup() {
-  docker rm -f "$name" >/dev/null 2>&1 || true
+  docker rm -f "${name}-runner" "$name" >/dev/null 2>&1 || true
   docker network rm "$name" >/dev/null 2>&1 || true
 }
 trap cleanup EXIT
@@ -22,6 +22,11 @@ if [ "$ready" != true ]; then
   echo 'Disposable PostgreSQL did not become ready' >&2
   exit 1
 fi
-docker run --rm --network "$name" -v "$PWD:/app" -w /app \
+# The CI workspace is inside the runner container, not on the Docker host.
+# Copy only test inputs; never mount a nonexistent host workspace or copy .env/.git.
+docker create --name "${name}-runner" --network "$name" -w /app \
   -e "BTCDATA_TEST_JDBC_URL=jdbc:postgresql://$name:5432/postgres?user=postgres" \
-  clojure:temurin-21-tools-deps-alpine clj -M:test
+  clojure:temurin-21-tools-deps-alpine clj -M:test >/dev/null
+COPYFILE_DISABLE=1 tar --no-xattrs -cf - deps.edn src resources test env/test | docker cp - "${name}-runner:/app"
+docker start --attach "${name}-runner"
+exit "$(docker inspect --format '{{.State.ExitCode}}' "${name}-runner")"