nxtgauge-backend-rust/Dockerfile.test

# Runs crates/db's Postgres-backed integration tests as a build step.
# Not published anywhere - build.yaml's DOCKER_HOST/buildx setup builds this
# ad-hoc and discards the image; only whether the RUN step exits 0 matters.
# TEST_DATABASE_URL is passed as a buildx secret (not a build-arg) so it
# never lands in the image's layer history/cache metadata.
FROM rust:1-bookworm

WORKDIR /workspace
COPY . .

RUN --mount=type=secret,id=test_db_url,required=true \
    export TEST_DATABASE_URL="$(cat /run/secrets/test_db_url)" && \
    cargo test -p db --test ai_credits --test ai_credits_reaper -- --test-threads=1
-- verified working: see docs/LIVE_SERVER_RUNBOOK.md step 6
fix(ci): run ai_credits tests via buildx build, not runtime apt-get/docker run -v The bare bookworm runner image has no apt-get/package manager at all (the earlier build-essential install attempt failed with 'apt-get: command not found'), and a plain 'docker run -v $PWD:/workspace' wouldn't work either - DOCKER_HOST points at the sibling dind engine (same nested-container setup build.yaml's own comments describe), so a bind mount would look for the path on the wrong filesystem. Matches build.yaml's actual working pattern instead: docker buildx build with context transfer (not a volume mount), using a Dockerfile (Dockerfile.test) whose RUN step runs the test suite and fails the build on a non-zero exit. TEST_DATABASE_URL passed via buildx --secret (not --build-arg) so it never lands in image layer history. Isolated this by testing each piece of the original workflow independently (env/secrets, id+GITHUB_OUTPUT, if: conditionals all checked out fine one at a time) until apt-get was confirmed as the actual failure point. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> 2026-08-13 18:08:31 +05:30			`# Runs crates/db's Postgres-backed integration tests as a build step.`
			`# Not published anywhere - build.yaml's DOCKER_HOST/buildx setup builds this`
			`# ad-hoc and discards the image; only whether the RUN step exits 0 matters.`
			`# TEST_DATABASE_URL is passed as a buildx secret (not a build-arg) so it`
			`# never lands in the image's layer history/cache metadata.`
			`FROM rust:1-bookworm`

			`WORKDIR /workspace`
			`COPY . .`

			`RUN --mount=type=secret,id=test_db_url,required=true \`
			`export TEST_DATABASE_URL="$(cat /run/secrets/test_db_url)" && \`
			`cargo test -p db --test ai_credits --test ai_credits_reaper -- --test-threads=1`
chore: trivial touch to Dockerfile.test to trigger a real ai-credits CI run 2026-08-13 20:16:26 +05:30			`-- verified working: see docs/LIVE_SERVER_RUNBOOK.md step 6`