From b1330ebe3ead561d4997fd3831e7e7b00addfbd8 Mon Sep 17 00:00:00 2001
From: RaymondVerhoef <raymondverhoef@gmail.com>
Date: Mon, 13 Jul 2026 09:13:12 +0200
Subject: [PATCH] ci: validate the production Caddyfile inside the built image
 (#26)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The caddy-validate step added for #26 (and merged to main via #29) used a
`-v "$PWD":/workspace` bind mount, which does not propagate to the sibling
Docker daemon in the Gitea act runner — the container saw an empty dir and
every PR failed with "open Caddyfile: no such file or directory".

Validate instead inside the freshly built image, where the production
Caddyfile lives at /etc/caddy/Caddyfile: no bind mount, and it checks the
exact file that ships. Caddyfile.test keeps being covered by the homepage
smoke test (its container must serve 200).

Closes #26

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/test.yml | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5fb2303..0c2882c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -11,21 +11,25 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      # The test image below swaps in Caddyfile.test, so the production
-      # Caddyfile is otherwise never exercised by CI — an invalid config then
-      # only surfaces when the deploy health-gate fails, after the broken
-      # container already replaced the healthy one (issue #20/#26). Validate
-      # both files up front so a parse error fails the PR check in seconds.
-      - name: Validate Caddyfiles
-        run: |
-          docker run --rm -v "$PWD":/workspace -w /workspace caddy:2-alpine \
-            caddy validate --config Caddyfile --adapter caddyfile
-          docker run --rm -v "$PWD":/workspace -w /workspace caddy:2-alpine \
-            caddy validate --config Caddyfile.test --adapter caddyfile
-
       - name: Build Docker image
         run: docker build -t learning-platform .
 
+      # The production Caddyfile is otherwise never exercised by CI — the test
+      # image below swaps in Caddyfile.test — so a parse error only surfaced at
+      # deploy time, after the broken container had already replaced the healthy
+      # one (issue #20/#26). Validate it here, inside the freshly built image
+      # where it lives at /etc/caddy/Caddyfile. This runs caddy against the
+      # exact file that ships and needs no bind mount — a `-v "$PWD":...` mount
+      # does not propagate to the sibling Docker daemon in the Gitea runner,
+      # which is why the earlier mount-based step failed with
+      # "open Caddyfile: no such file or directory" (#26).
+      # Caddyfile.test needs no separate check: the "Test homepage" step below
+      # runs the test image and fails if that config can't serve.
+      - name: Validate production Caddyfile
+        run: |
+          docker run --rm --entrypoint caddy learning-platform \
+            validate --adapter caddyfile --config /etc/caddy/Caddyfile
+
       - name: Build test image
         run: |
           cat > Dockerfile.test <<'EOF'