fix dotnet tools missing in migration bundle in cd

.gitea/workflows/cd.yml

@@ -78,33 +78,25 @@ jobs:
   migrate:
     needs: build-and-push
     runs-on: ubuntu-latest
-    # Checkout/setup-* are Node actions and must run on the job host (act_runner
-    # default image). Do not set job-level container: — that replaced the host
-    # with dotnet/sdk (no node) and broke checkout. Use docker run for the SDK
-    # instead; the runner already needs Docker for build-and-push.
+    # Checkout must run on the job host (Node). Do not use job-level container:.
+    # Build the EF bundle via Dockerfile --target migrate (context upload), not
+    # docker run -v — under act_runner bind mounts resolve on the Docker host.
     steps:
       - uses: actions/checkout@v4
 
       - name: Build migration bundle
         run: |
-          docker run --rm \
-            -v "$PWD:/src" \
-            -w /src \
-            -e HOME=/tmp \
-            mcr.microsoft.com/dotnet/sdk:8.0 \
-            bash -euo pipefail -c '
-              dotnet tool install --global dotnet-ef --version 8.0.4 \
-                || dotnet tool update --global dotnet-ef --version 8.0.4
-              export PATH="$PATH:/tmp/.dotnet/tools"
-              bash ./scripts/build-api-migration-bundle.sh
-            '
-          cp -f ./artifacts/migrate-api ./migrate-api
+          docker build -f VigilCareClinicalAPI/Dockerfile --target migrate \
+            -t vigilcare-migrate-bundle:local .
+          cid=$(docker create vigilcare-migrate-bundle:local)
+          docker cp "$cid:/out/migrate-api" ./migrate-api
+          docker rm "$cid"
           chmod +x ./migrate-api
 
       # Runs while the previous release is still serving traffic, so every
       # migration must be backwards-compatible with the outgoing image.
       # See Step 6 — expand-then-contract.
-      # Self-contained linux-x64 binary — runs on the host, not inside the SDK image.
+      # Self-contained linux-x64 binary — runs on the job host.
       - name: Apply migrations
         run: ./migrate-api --connection "${{ secrets.PG_CONNECTION_DDL }}"
 

VigilCareClinicalAPI/Dockerfile

@@ -1,4 +1,7 @@
-FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
+# Multi-stage API image + EF migration bundle.
+#   docker build -f VigilCareClinicalAPI/Dockerfile .                  → runtime (default)
+#   docker build -f VigilCareClinicalAPI/Dockerfile --target migrate . → /out/migrate-api
+FROM mcr.microsoft.com/dotnet/sdk:8.0 AS src
 WORKDIR /src
 
 # Restore layer — copy only project files so NuGet restore is cached
@@ -12,6 +15,8 @@ RUN dotnet restore VigilCareClinicalAPI/VigilCareClinicalAPI.csproj
 COPY VigilCare.ClinicalContracts/ VigilCare.ClinicalContracts/
 COPY VigilCare.Simulation.Core/ VigilCare.Simulation.Core/
 COPY VigilCareClinicalAPI/ VigilCareClinicalAPI/
+
+FROM src AS build
 RUN dotnet publish VigilCareClinicalAPI/VigilCareClinicalAPI.csproj \
     -c Release -o /app/publish --no-restore
 
@@ -24,6 +29,21 @@ RUN sed -i \
       -e 's/"ApiKey": "dev-integration[^"]*"/"ApiKey": ""/' \
       /app/publish/appsettings.json
 
+# Self-contained EF bundle for CD (docker build --target migrate).
+# Prefer docker build over docker run -v on act_runner — bind mounts resolve
+# on the Docker host, not the job workspace.
+FROM src AS migrate
+RUN dotnet tool install --global dotnet-ef --version 8.0.4 \
+ && export PATH="$PATH:/root/.dotnet/tools" \
+ && mkdir -p /out \
+ && dotnet ef migrations bundle \
+      --project VigilCareClinicalAPI \
+      --startup-project VigilCareClinicalAPI \
+      --configuration Release \
+      --self-contained -r linux-x64 \
+      --output /out/migrate-api \
+      --force
+
 FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS runtime
 WORKDIR /app