fix dotnet tools missing in migration bundle in cd

.gitea/workflows/cd.yml

@@ -78,33 +78,25 @@ jobs:
   migrate:
     needs: build-and-push
     runs-on: ubuntu-latest
-    # Checkout/setup-* are Node actions and must run on the job host (act_runner
-    # default image). Do not set job-level container: — that replaced the host
-    # with dotnet/sdk (no node) and broke checkout. Use docker run for the SDK
-    # instead; the runner already needs Docker for build-and-push.
+    # Checkout must run on the job host (Node). Do not use job-level container:.
+    # Build the EF bundle via Dockerfile --target migrate (context upload), not
+    # docker run -v — under act_runner bind mounts resolve on the Docker host.
     steps:
       - uses: actions/checkout@v4
 
       - name: Build migration bundle
         run: |
-          docker run --rm \
-            -v "$PWD:/src" \
-            -w /src \
-            -e HOME=/tmp \
-            mcr.microsoft.com/dotnet/sdk:8.0 \
-            bash -euo pipefail -c '
-              dotnet tool install --global dotnet-ef --version 8.0.4 \
-                || dotnet tool update --global dotnet-ef --version 8.0.4
-              export PATH="$PATH:/tmp/.dotnet/tools"
-              bash ./scripts/build-api-migration-bundle.sh
-            '
-          cp -f ./artifacts/migrate-api ./migrate-api
+          docker build -f VigilCareClinicalAPI/Dockerfile --target migrate \
+            -t vigilcare-migrate-bundle:local .
+          cid=$(docker create vigilcare-migrate-bundle:local)
+          docker cp "$cid:/out/migrate-api" ./migrate-api
+          docker rm "$cid"
           chmod +x ./migrate-api
 
       # Runs while the previous release is still serving traffic, so every
       # migration must be backwards-compatible with the outgoing image.
       # See Step 6 — expand-then-contract.
-      # Self-contained linux-x64 binary — runs on the host, not inside the SDK image.
+      # Self-contained linux-x64 binary — runs on the job host.
       - name: Apply migrations
         run: ./migrate-api --connection "${{ secrets.PG_CONNECTION_DDL }}"