From 9144ca7ac1c8d8bc5e13991f025706480c7b638b Mon Sep 17 00:00:00 2001
From: trent <trendoncato@gmail.com>
Date: Mon, 10 Aug 2026 17:20:46 +0800
Subject: [PATCH] Fix cd missing node in migrate

---
 .gitea/workflows/cd.yml | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index d3c653a..e3ad7fc 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -78,23 +78,33 @@ jobs:
   migrate:
     needs: build-and-push
     runs-on: ubuntu-latest
-    container:
-      image: mcr.microsoft.com/dotnet/sdk:8.0
+    # Checkout/setup-* are Node actions and must run on the job host (act_runner
+    # default image). Do not set job-level container: — that replaced the host
+    # with dotnet/sdk (no node) and broke checkout. Use docker run for the SDK
+    # instead; the runner already needs Docker for build-and-push.
     steps:
       - uses: actions/checkout@v4
 
       - name: Build migration bundle
         run: |
-          dotnet tool install --global dotnet-ef --version 8.0.4 \
-            || dotnet tool update --global dotnet-ef --version 8.0.4
-          export PATH="$PATH:/root/.dotnet/tools"
-          bash ./scripts/build-api-migration-bundle.sh
+          docker run --rm \
+            -v "$PWD:/src" \
+            -w /src \
+            -e HOME=/tmp \
+            mcr.microsoft.com/dotnet/sdk:8.0 \
+            bash -euo pipefail -c '
+              dotnet tool install --global dotnet-ef --version 8.0.4 \
+                || dotnet tool update --global dotnet-ef --version 8.0.4
+              export PATH="$PATH:/tmp/.dotnet/tools"
+              bash ./scripts/build-api-migration-bundle.sh
+            '
           cp -f ./artifacts/migrate-api ./migrate-api
           chmod +x ./migrate-api
 
       # Runs while the previous release is still serving traffic, so every
       # migration must be backwards-compatible with the outgoing image.
       # See Step 6 — expand-then-contract.
+      # Self-contained linux-x64 binary — runs on the host, not inside the SDK image.
       - name: Apply migrations
         run: ./migrate-api --connection "${{ secrets.PG_CONNECTION_DDL }}"