fix: add explicit --context and --file to all docker build commands

- PR workflow: build, deploy to CI site, wait for health, run acceptance tests
- Release workflow: deploy to dev using mounted compose path with health check
- Add deploy-prod workflow (workflow_dispatch) for human-gated prod deployment
- Add just recipes: deploy-prod, status (view current image tags across envs)
- Runners now have /apps mount for access to all environment compose files

.gitea/workflows/build-ci-images.yml

@@ -5,13 +5,13 @@ on:
     branches:
       - main
     paths:
-      - 'Dockerfile.ci-base'
+      - "Dockerfile.ci-base"
-      - 'package.json'
+      - "package.json"
-      - 'bun.lock'
+      - "bun.lock"
-      - '.gitea/workflows/build-ci-images.yml'
+      - ".gitea/workflows/build-ci-images.yml"
   schedule:
     # Weekly rebuild to get latest Playwright/Bun versions
-    - cron: '0 2 * * 0'  # Every Sunday at 2 AM
+    - cron: "0 2 * * 0" # Every Sunday at 2 AM
   workflow_dispatch: # Manual trigger
 
 env:
@@ -40,7 +40,7 @@ jobs:
         id: meta
         run: |
           # Get Playwright version from package.json
-          PLAYWRIGHT_VERSION=$(grep -o '"@playwright/test": "[^"]*"' package.json | cut -d'"' -f4)
+          PLAYWRIGHT_VERSION=$(grep -o '"@playwright/test": "[^"]*"' package.json | cut -d'"' -f4 | sed 's/^\^//')
           echo "playwright_version=${PLAYWRIGHT_VERSION}" >> $GITHUB_OUTPUT
 
           # Get Bun version (latest)
@@ -52,20 +52,17 @@ jobs:
 
       - name: Build and push CI base image
         run: |
+          WORKSPACE_DIR="$GITHUB_WORKSPACE"
           # Build with multiple tags
           docker build \
-            --file Dockerfile.ci-base \
+            --context "$WORKSPACE_DIR" \
+            --file "$WORKSPACE_DIR/Dockerfile.ci-base" \
             --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/ci-base:latest \
             --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/ci-base:playwright-${{ steps.meta.outputs.playwright_version }} \
             --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/ci-base:${{ github.sha }} \
-            .
-          
-          # Push all tags
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/ci-base:latest
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/ci-base:playwright-${{ steps.meta.outputs.playwright_version }}
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/ci-base:${{ github.sha }}
 
       - name: Clean up
         if: always()
         run: |
           docker logout ${{ env.REGISTRY }}
+

.gitea/workflows/deploy-prod.yml

@@ -0,0 +1,52 @@
+name: Deploy Production
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version tag to deploy (e.g., v0.1.21)'
+        required: true
+        type: string
+
+env:
+  REGISTRY: docker.notsosm.art
+  IMAGE_NAME: euchre-camp
+  PROD_APPS_PATH: /apps/youthful_simon
+
+jobs:
+  deploy-prod:
+    runs-on: ubuntu-latest
+    container:
+      image: docker.notsosm.art/euchre-camp/ci-base:latest
+      options: --user root
+
+    steps:
+      - name: Deploy to production
+        run: |
+          VERSION="${{ inputs.version }}"
+          COMPOSE_FILE="${{ env.PROD_APPS_PATH }}/docker-compose.yml"
+
+          echo "Deploying ${VERSION} to production..."
+
+          # Update prod compose file with the release tag
+          # Note: Standardizing to docker.notsosm.art registry
+          sed -i "s|image: euchre-camp/euchre-camp:[a-zA-Z0-9.-]*|image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${VERSION}|" ${COMPOSE_FILE}
+          sed -i "s|image: docker.notsosm.art/euchre-camp:[a-zA-Z0-9.-]*|image: docker.notsosm.art/euchre-camp:${VERSION}|" ${COMPOSE_FILE}
+
+          # Pull and restart the prod container
+          cd ${{ env.PROD_APPS_PATH }}
+          docker compose pull app
+          docker compose up -d app
+
+          # Wait for production site to be healthy
+          echo "Waiting for production site to be healthy..."
+          for i in {1..30}; do
+            if curl -sf https://euchre.notsosm.art/api/health > /dev/null 2>&1; then
+              echo "✅ Production successfully deployed with version ${VERSION}"
+              exit 0
+            fi
+            sleep 0.5
+          done
+          echo "❌ Production deployment failed"
+          docker compose logs app
+          exit 1

.gitea/workflows/pr.yml

@@ -5,6 +5,10 @@ on:
     branches:
       - main
 
+env:
+  REGISTRY: docker.notsosm.art
+  IMAGE_NAME: euchre-camp
+
 jobs:
   unit-tests:
     runs-on: ubuntu-latest
@@ -27,8 +31,9 @@ jobs:
       - name: Run unit tests
         run: bun test src/__tests__/unit/ src/__tests__/*.test.tsx src/__tests__/auth-simple.test.ts
 
-  acceptance-tests:
+  build-and-deploy-ci:
     runs-on: ubuntu-latest
+    needs: unit-tests
     container:
       image: docker.notsosm.art/euchre-camp/ci-base:latest
       options: --user root
@@ -45,11 +50,60 @@ jobs:
         env:
           DATABASE_URL: postgresql://user:pass@localhost:5432/dummy
 
+      - name: Extract PR number and commit info
+        id: info
+        run: |
+          echo "pr_number=$(echo $GITHUB_REF | grep -oP 'refs/pull/\K[0-9]+')" >> $GITHUB_OUTPUT
+          echo "short_sha=$(echo $GITHUB_SHA | cut -c1-7)" >> $GITHUB_OUTPUT
+
+      - name: Build Docker image for PR
+        run: |
+          WORKSPACE_DIR="$GITHUB_WORKSPACE"
+          IMAGE_TAG="pr-${{ steps.info.outputs.pr_number }}-${{ steps.info.outputs.short_sha }}"
+          docker build \
+            --context "$WORKSPACE_DIR" \
+            --file "$WORKSPACE_DIR/Dockerfile" \
+            --target runner \
+            --build-arg GIT_COMMIT=$GITHUB_SHA \
+            -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG} \
+            "$WORKSPACE_DIR"
+
+      - name: Update CI site compose and restart
+        run: |
+          IMAGE_TAG="pr-${{ steps.info.outputs.pr_number }}-${{ steps.info.outputs.short_sha }}"
+          COMPOSE_FILE="/apps/euchre_camp_ci/docker-compose.yml"
+
+          # Update the image tag in the compose file
+          sed -i "s|image: docker.notsosm.art/euchre-camp:[a-zA-Z0-9.-]*|image: docker.notsosm.art/euchre-camp:${IMAGE_TAG}|" ${COMPOSE_FILE}
+
+          # Pull the new image and restart the CI stack
+          cd /apps/euchre_camp_ci
+          docker compose pull app
+          docker compose up -d app
+
+      - name: Wait for CI site to be healthy
+        run: |
+          for i in {1..30}; do
+            if curl -sf https://euchre-ci.notsosm.art/api/health > /dev/null 2>&1; then
+              echo "CI site is healthy"
+              exit 0
+            fi
+            sleep 0.5
+          done
+          echo "CI site failed to become healthy after 15 seconds"
+          docker compose -f /apps/euchre_camp_ci/docker-compose.yml logs app
+          exit 1
+
       - name: Run acceptance tests
-        run: DATABASE_URL="${{ vars.CI_DATABASE_URL }}" bun test:acceptance
+        run: DATABASE_URL="${{ secrets.CI_DATABASE_URL }}" bun test:acceptance
         env:
           CI: true
 
+      - name: Cleanup PR images
+        if: always()
+        run: |
+          docker rmi ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:pr-${{ steps.info.outputs.pr_number }}-${{ steps.info.outputs.short_sha }} || true
+
   analyze-bump-type:
     runs-on: ubuntu-latest
     needs: unit-tests

.gitea/workflows/release.yml

@@ -110,11 +110,14 @@ jobs:
       - name: Build test-capable image
         if: steps.commit.outputs.committed == 'true'
         run: |
+          WORKSPACE_DIR="$GITHUB_WORKSPACE"
           docker build \
+            --context "$WORKSPACE_DIR" \
+            --file "$WORKSPACE_DIR/Dockerfile" \
             --target test-runner \
             --build-arg GIT_COMMIT=${{ github.sha }} \
             -t ${{ env.IMAGE_NAME }}-test:${{ steps.version.outputs.new_version }} \
-            .
+            "$WORKSPACE_DIR"
 
       - name: Run tests inside test-capable container
         if: steps.commit.outputs.committed == 'true'
@@ -127,12 +130,15 @@ jobs:
       - name: Build production image
         if: steps.commit.outputs.committed == 'true'
         run: |
+          WORKSPACE_DIR="$GITHUB_WORKSPACE"
           docker build \
+            --context "$WORKSPACE_DIR" \
+            --file "$WORKSPACE_DIR/Dockerfile" \
             --target runner \
             --build-arg GIT_COMMIT=${{ github.sha }} \
             -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.new_version }} \
             -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest \
-            .
+            "$WORKSPACE_DIR"
 
       - name: Push Docker images
         if: steps.commit.outputs.committed == 'true'
@@ -164,31 +170,25 @@ jobs:
         run: |
           echo "Deploying version ${{ steps.version.outputs.new_version }} to dev environment..."
 
-          # Update docker-compose.yml with new image tag using full registry path
+          # Update dev compose file with new image tag
-          # The registry is docker.notsosm.art and image is euchre-camp
           IMAGE_TAG="${{ steps.version.outputs.new_version }}"
-          sed -i "s|image: docker.notsosm.art/euchre-camp:[0-9.]*|image: docker.notsosm.art/euchre-camp:${IMAGE_TAG}|" docker-compose.yml
+          COMPOSE_FILE="/apps/intelligent_silasak/docker-compose.yml"
-          
+          sed -i "s|image: docker.notsosm.art/euchre-camp:[a-zA-Z0-9.-]*|image: docker.notsosm.art/euchre-camp:${IMAGE_TAG}|" ${COMPOSE_FILE}
-          # Copy the updated docker-compose.yml to the deployment location
-          # The runners are on the same Docker server where the container is running
-          sudo mkdir -p /home/euchre_camp
-          sudo cp docker-compose.yml /home/euchre_camp/
-          sudo chown -R euchre:euchre /home/euchre_camp
 
           # Pull and restart the dev container
-          cd /home/euchre_camp
+          cd /apps/intelligent_silasak
-          docker-compose pull app
+          docker compose pull app
-          docker-compose up -d app
+          docker compose up -d app
 
           # Wait for container to be healthy
-          echo "Waiting for container to start..."
+          echo "Waiting for dev site to be healthy..."
-          sleep 10
+          for i in {1..30}; do
-          
+            if curl -sf https://euchre-dev.notsosm.art/api/health > /dev/null 2>&1; then
-          # Check if container is running
-          if docker ps --filter "name=euchre-camp-app" --format "{{.Status}}" | grep -q "Up"; then
               echo "✅ Dev environment successfully deployed with version ${{ steps.version.outputs.new_version }}"
-          else
+              exit 0
-            echo "❌ Dev environment deployment failed"
-            docker-compose logs app
-            exit 1
             fi
+            sleep 0.5
+          done
+          echo "❌ Dev environment deployment failed"
+          docker compose logs app
+          exit 1

docs/TODO.md

@@ -24,11 +24,11 @@
 - [x] Write TODO list to repository file
 - [x] Auto-create tournament when uploading matches without selecting one
 
-### In Progress 🔄
+### Completed ✅
-- [ ] Update API routes to handle new variant scoring fields
+- [x] Update API routes to handle new variant scoring fields
-- [ ] Update EditTournamentForm to add variant scoring controls
+- [x] Update EditTournamentForm to add variant scoring controls
-- [ ] Update MatchEditor to use tournament-specific target score
+- [x] Update MatchEditor to use tournament-specific target score
-- [ ] Run tests and verify variant scoring implementation
+- [x] Run tests and verify variant scoring implementation
 
 ### Recently Completed ✅
 - [x] Update CI/CD workflows to use Bun (PR, release)
@@ -59,11 +59,27 @@
 - [x] Create migration to add rating system tables (elo_ratings, glicko2_ratings, open_skill_ratings)
 - [x] Add tabbed rankings page to display Elo, OpenSkill, and Glicko2 ratings
 
+### Completed ✅
+- [x] Add UI controls for variant scoring in tournament creation/edit
+- [x] Test variant tournament functionality end-to-end (e2e/tournament-edit-allowTies.test.ts)
+- [x] Add validation for tie scores based on tournament configuration (MatchEditor.tsx)
+
+### Completed ✅ (CI/DB Infrastructure)
+- [x] Fix PostgreSQL database ownership — each env owns its own DB
+- [x] Fix role attributes — euchre_camp_dev gets CREATEDB, euchre_camp_ci loses SUPERUSER
+- [x] Update .env.development to use euchre_camp_dev user
+- [x] Update .env.development.local to use euchre_camp_dev user
+- [x] Update CI docker-compose to use euchre_camp_ci user
+- [x] Update dev docker-compose to use euchre_camp_dev user
+- [x] Recreate dev and CI containers with correct credentials
+- [x] Fix Playwright baseURL for CI (https://euchre-ci.notsosm.art)
+- [x] Fix Navigation unit tests (RoleSwitcherProvider wrapper)
+- [x] Fix secrets vs vars in PR workflow (secrets.CI_DATABASE_URL)
+
 ### Backlog 📋
-- [ ] Add UI controls for variant scoring in tournament creation/edit
-- [ ] Test variant tournament functionality end-to-end
-- [ ] Add validation for tie scores based on tournament configuration
 - [ ] Document variant tournament features
+- [ ] Update Gitea secret CI_DATABASE_URL to use euchre_camp_ci user
+- [ ] Test isolation improvements for parallel CI execution
 
 ## Recently Completed (Detailed)
 

justfile

@@ -240,6 +240,50 @@ workflow-status:
     @echo "Test Workflow: Runs unit tests on all branch pushes"
     @echo "Release Workflow: Runs on main branch pushes (version bump + Docker build)"
 
+# --- Production Deployment ---
+
+# Deploy a specific version to production (human gate)
+# Usage: just deploy-prod v0.1.21
+deploy-prod version:
+    @echo "Deploying {{version}} to production..."
+    @echo "This requires the image to already be pushed to the registry."
+    @echo ""
+    @read -p "Have you verified this version works in dev? (y/N) " confirm; \
+    if [ "$$confirm" != "y" ]; then \
+      echo "Cancelled. Please verify in dev first."; \
+      exit 1; \
+    fi
+    cd /apps/youthful_simon && \
+    sed -i "s|image: docker.notsosm.art/euchre-camp:[a-zA-Z0-9.-]*|image: docker.notsosm.art/euchre-camp:{{version}}|" docker-compose.yml && \
+    sed -i "s|image: euchre-camp/euchre-camp:[a-zA-Z0-9.-]*|image: docker.notsosm.art/euchre-camp:{{version}}|" docker-compose.yml && \
+    docker compose pull app && \
+    docker compose up -d app && \
+    echo "Waiting for production site to be healthy..." && \
+    for i in {1..30}; do \
+      if curl -sf https://euchre.notsosm.art/api/health > /dev/null 2>&1; then \
+        echo "✅ Production successfully deployed with version {{version}}"; \
+        exit 0; \
+      fi; \
+      sleep 0.5; \
+    done && \
+    echo "❌ Production deployment failed - health check timed out"; \
+    docker compose logs app; \
+    exit 1
+
+# Show current deployment status across all environments
+status:
+    @echo "=== EuchreCamp Deployment Status ==="
+    @echo ""
+    @echo "CI Site (euchre-camp-ci):"
+    @grep "image:" /apps/euchre_camp_ci/docker-compose.yml | head -1
+    @echo ""
+    @echo "Dev Site (euchre-camp-dev):"
+    @grep "image:" /apps/intelligent_silasak/docker-compose.yml | head -1
+    @echo ""
+    @echo "Prod Site (euchre-camp):"
+    @grep "image:" /apps/youthful_simon/docker-compose.yml | head -1
+    @echo ""
+
 # --- SDLC Database Operations ---
 
 # Sync production data to development database (manual operation)

playwright.config.ts

@@ -11,9 +11,9 @@ export default defineConfig({
   // Fail the build on CI if you accidentally left test.only in the source code.
   forbidOnly: !!process.env.CI,
   // Retry on CI only.
-  retries: process.env.CI ? 2 : 0,
+  retries: process.env.CI ? 1 : 0,
-  // Always run with 1 worker to avoid database conflicts
+  // Use 2 workers in CI for parallel project execution; 1 locally
-  workers: 1,
+  workers: process.env.CI ? 2 : 1,
   // Reporter to use
   reporter: 'html',
   // Global setup and teardown
@@ -21,7 +21,7 @@ export default defineConfig({
   globalTeardown: require.resolve('./e2e/global.teardown'),
   // Use base URL for relative navigation
   use: {
-    baseURL: 'http://localhost:3000',
+    baseURL: process.env.CI ? 'https://euchre-ci.notsosm.art' : 'http://localhost:3000',
     // Collect trace when retrying the failed test.
     trace: 'on-first-retry',
     // Capture screenshot only on failure

src/__tests__/Navigation.test.tsx

@@ -8,6 +8,7 @@
 import { describe, it, expect, mock, beforeEach, afterEach } from 'bun:test'
 import { render, screen, waitFor } from '@testing-library/react'
 import Navigation from '@/components/Navigation'
+import { RoleSwitcherProvider } from '@/components/RoleSwitcher'
 
 // Mock next/link
 mock.module('next/link', () => ({
@@ -31,6 +32,14 @@ mock.module('@/lib/auth-client', () => ({
 // Mock fetch for role API call
 global.fetch = mock(async () => new Response()) as any
 
+function renderNavigation() {
+  return render(
+    <RoleSwitcherProvider>
+      <Navigation />
+    </RoleSwitcherProvider>
+  )
+}
+
 import { useSession as useSessionOriginal } from '@/components/SessionProvider'
 const useSession = useSessionOriginal as any
 
@@ -61,7 +70,7 @@ describe('Epic 1: Navigation Component', () => {
       refreshSession: mock(() => {}),
     })
 
-    render(<Navigation />)
+    renderNavigation()
 
     expect(screen.getByText('EuchreCamp')).toBeInTheDocument()
     expect(screen.getByText('Rankings')).toBeInTheDocument()
@@ -84,7 +93,7 @@ describe('Epic 1: Navigation Component', () => {
       refreshSession: mock(() => {}),
     })
 
-    render(<Navigation />)
+    renderNavigation()
 
     await waitFor(() => {
       expect(screen.getByText('Test User')).toBeInTheDocument()
@@ -109,7 +118,7 @@ describe('Epic 1: Navigation Component', () => {
       refreshSession: mock(() => {}),
     })
 
-    render(<Navigation />)
+    renderNavigation()
 
     await waitFor(() => {
       expect(screen.getByText('Tournaments')).toBeInTheDocument()
@@ -142,7 +151,7 @@ describe('Epic 1: Navigation Component', () => {
       return new Response(JSON.stringify({}), { status: 200 })
     })
 
-    render(<Navigation />)
+    renderNavigation()
 
     await waitFor(() => {
       expect(screen.getByText('Admin')).toBeInTheDocument()
@@ -177,7 +186,7 @@ describe('Epic 1: Navigation Component', () => {
       } as Response
     })
 
-    render(<Navigation />)
+    renderNavigation()
 
     await waitFor(() => {
       expect(screen.getByText('Tournaments')).toBeInTheDocument()
@@ -192,7 +201,7 @@ describe('Epic 1: Navigation Component', () => {
       refreshSession: mock(() => {}),
     })
 
-    render(<Navigation />)
+    renderNavigation()
 
     expect(screen.getByText('Loading...')).toBeInTheDocument()
   })

src/__tests__/auth-simple.test.ts

@@ -47,7 +47,9 @@ describe('getSession', () => {
   })
 
   it('returns null when an error occurs', async () => {
-    mockFetch.mockRejectedValue(new Error('Network error'))
+    mockFetch.mockImplementation(async () => {
+      throw new Error('Network error')
+    })
 
     const result = await getSession()
 

src/__tests__/unit/permissions.test.ts

@@ -7,7 +7,6 @@
 import { describe, test, expect, mock, beforeEach } from 'bun:test';
 import { hasRole, canManageTournament, canCreateTournaments } from '@/lib/permissions';
 import { getSession } from '@/lib/auth-simple';
-import { prisma } from '@/lib/prisma';
 import type { User } from '@prisma/client';
 
 // Create mock functions at module level

src/__tests__/unit/tournament-update.test.ts

@@ -3,7 +3,7 @@
  * Tests the allowTies field is properly saved when updating tournaments
  */
 
-import { describe, it, expect, mock, beforeEach,} from 'bun:test';
+import { describe, it, expect, mock, beforeEach, afterAll } from 'bun:test';
 
 // Create mock functions at module level
 const eventFindUniqueMock = mock(async () => ({}));
@@ -27,6 +27,11 @@ mock.module('@/lib/permissions', () => ({
   canDeleteTournament: canDeleteTournamentMock,
 }));
 
+// Cleanup after all tests in this file
+afterAll(() => {
+  mock.restore('module');
+});
+
 // Import the route handler after mocking
 import { PUT } from '@/app/api/tournaments/[id]/route';
 import { prisma } from '@/lib/prisma';