Add code to create minio bucket

.gitea/workflows/cd.yml

@@ -70,6 +70,9 @@ jobs:
     # Checkout must run on the job host. Build the EF bundle via Dockerfile
     # --target migrate (context upload), not docker run -v — under act_runner
     # bind mounts resolve on the Docker host, not the job workspace.
+    # Postgres lives on the deploy host's shared-services network and is not
+    # reachable from act_runner, so the bundle is copied there and executed in
+    # a one-shot container joined to that network (Host=postgres resolves).
     # NOTE: Program.cs also runs db.Database.MigrateAsync() on API startup, so
     # this job is a defense-in-depth pre-deploy step using a DDL-privileged
     # credential the API container never sees, not the only migration path.
@@ -85,12 +88,34 @@ jobs:
           docker rm "$cid"
           chmod +x ./migrate-api
 
+      - name: Configure SSH
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H "${{ secrets.DEPLOY_HOST }}" >> ~/.ssh/known_hosts
+
       # Runs while the previous release is still serving traffic, so every
       # migration must be backwards-compatible with the outgoing image
-      # (expand-then-contract). Self-contained linux-x64 binary — runs on the
-      # job host directly.
+      # (expand-then-contract).
       - name: Apply migrations
-        run: ./migrate-api --connection "${{ secrets.PG_CONNECTION_DDL }}"
+        env:
+          PG_CONNECTION_DDL: ${{ secrets.PG_CONNECTION_DDL }}
+        run: |
+          scp -i ~/.ssh/id_ed25519 ./migrate-api \
+            "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}:/tmp/vigilcare-records-migrate-api"
+          ssh -i ~/.ssh/id_ed25519 \
+            "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" \
+            PG_CONNECTION_DDL="$PG_CONNECTION_DDL" bash -euo pipefail <<'EOF'
+            chmod +x /tmp/vigilcare-records-migrate-api
+            docker run --rm \
+              --network shared-services \
+              -v /tmp/vigilcare-records-migrate-api:/migrate-api:ro \
+              --entrypoint /migrate-api \
+              mcr.microsoft.com/dotnet/runtime-deps:8.0 \
+              --connection "$PG_CONNECTION_DDL"
+            rm -f /tmp/vigilcare-records-migrate-api
+          EOF
 
   deploy:
     needs: [build-and-push, migrate]