Problem
The disposable Gitea E2E suite passes locally but is disabled in CI because the self-hosted runner containers cannot reliably reach a sibling Gitea container through the default Docker bridge. The current fork-PR design would also execute untrusted code on privileged self-hosted runners with access to the host Docker socket.
Scope
- Keep one shared local/CI entry point for the real Gitea provider suites.
- Make local Gitea provisioning use a collision-safe container name and a Docker-assigned localhost port.
- Run the secretless Gitea PR gate on an ephemeral GitHub-hosted runner, including fork PRs.
- Keep credentialed GitHub/GitLab E2E on self-hosted runners for trusted events only.
- Aggregate both E2E paths before downstream CI/release.
- Correct stale E2E documentation and troubleshooting guidance.
Out of scope
Acceptance criteria
npm run test:e2e -- --provider gitea passes locally with automatic cleanup.- Concurrent local runs do not collide on container names or ports.
- Gitea runs on
ubuntu-latest without repository secrets and is eligible for fork PRs.
- GitHub/GitLab live-provider jobs never run fork code on self-hosted runners.
- A real workflow run proves the Gitea job executed rather than reporting a green skip.
- Lint, build, unit tests, workflow validation, and shell syntax checks pass.
Problem
The disposable Gitea E2E suite passes locally but is disabled in CI because the self-hosted runner containers cannot reliably reach a sibling Gitea container through the default Docker bridge. The current fork-PR design would also execute untrusted code on privileged self-hosted runners with access to the host Docker socket.
Scope
Out of scope
Acceptance criteria
npm run test:e2e -- --provider giteapasses locally with automatic cleanup.ubuntu-latestwithout repository secrets and is eligible for fork PRs.