Run integration tests on runner tooling

.gitea/workflows/backend-quality-gate.yml

@@ -65,6 +65,9 @@ jobs:
           if ! command -v g++ >/dev/null 2>&1; then
             packages+=(g++)
           fi
+          if ! command -v rsync >/dev/null 2>&1; then
+            packages+=(rsync)
+          fi
           if [ "${#packages[@]}" -gt 0 ]; then
             apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=30 \
               -o Acquire::https::Timeout=30 update
@@ -80,62 +83,9 @@ jobs:
           docker compose version --short | grep -Eq '^v?2\.'
           docker compose --help | grep -q -- '--project-name'
 
-      - name: Prepare pinned Node tooling
-        env:
-          NODE_TOOL_SOURCE_IMAGE: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c
-          NODE_TOOL_IMAGE: node:22-bookworm-slim
+      - name: Verify runner Node tooling
         run: |
           set -euo pipefail
-          if ! docker image inspect "$NODE_TOOL_SOURCE_IMAGE" >/dev/null 2>&1; then
-            for attempt in 1 2 3; do
-              if timeout 180 docker pull "$NODE_TOOL_SOURCE_IMAGE"; then
-                break
-              fi
-              if [ "$attempt" -eq 3 ]; then
-                echo "Failed to preload $NODE_TOOL_IMAGE after $attempt attempts" >&2
-                exit 1
-              fi
-              sleep $((attempt * 15))
-            done
-          fi
-          docker tag "$NODE_TOOL_SOURCE_IMAGE" "$NODE_TOOL_IMAGE"
-          docker image inspect "$NODE_TOOL_IMAGE" >/dev/null
-          tool_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/jyotisha-node-tools.XXXXXX")"
-          cat > "$tool_dir/node" <<'EOF'
-          #!/usr/bin/env bash
-          set -euo pipefail
-          workdir="$(pwd -P)"
-          docker_args=(
-            run --rm --network host
-            --user "$(id -u):$(id -g)"
-            --group-add "$(stat -c %g /var/run/docker.sock)"
-            --volume "$workdir:$workdir"
-            --volume /tmp:/tmp
-            --volume /var/run/docker.sock:/var/run/docker.sock
-            --workdir "$workdir"
-            --env HOME=/tmp
-            --env "npm_config_cache=/tmp/jyotisha-npm-cache-${GITEA_SHA:-local}"
-            --env "DOCKER_CONFIG=/tmp/jyotisha-docker-config-${GITEA_SHA:-local}"
-          )
-          for command_name in docker git openssl; do
-            command_path="$(command -v "$command_name")"
-            docker_args+=(--volume "$command_path:/usr/local/bin/$command_name:ro")
-          done
-          while read -r library; do
-            [ -f "$library" ] && docker_args+=(--volume "$library:$library:ro")
-          done < <(ldd "$(command -v openssl)" | awk '/lib(ssl|crypto)\.so/ { print $3 }')
-          for compose_plugin in \
-            /usr/libexec/docker/cli-plugins/docker-compose \
-            /usr/lib/docker/cli-plugins/docker-compose; do
-            [ -x "$compose_plugin" ] && docker_args+=(--volume "$compose_plugin:$compose_plugin:ro")
-          done
-          exec docker "${docker_args[@]}" node:22-bookworm-slim "${0##*/}" "$@"
-          EOF
-          chmod 0755 "$tool_dir/node"
-          ln -s node "$tool_dir/npm"
-          test -n "${GITHUB_PATH:-}"
-          printf '%s\n' "$tool_dir" >> "$GITHUB_PATH"
-          export PATH="$tool_dir:$PATH"
           node --version
           npm --version
 

frontend/tests/staging-backend-workflows.test.ts

@@ -148,22 +148,21 @@ test("Gitea quality gate validates before publishing an immutable ACR manifest",
   assert.match(workflow, /packages\+=\(python3-venv\)/);
   assert.match(workflow, /sysconfig\.get_path\("include"\)[\s\S]*packages\+=\(python3-dev\)/);
   assert.match(workflow, /command -v g\+\+[\s\S]*packages\+=\(g\+\+\)/);
+  assert.match(workflow, /command -v rsync[\s\S]*packages\+=\(rsync\)/);
   assert.match(workflow, /apt-get install -y --no-install-recommends[\s\S]*"\$\{packages\[@\]\}"/);
   assert.doesNotMatch(workflow, /packages\+=\((?:nodejs|npm)\)|apt-get install[^\n]*(?:nodejs|npm)/);
-  assert.equal((workflow.match(/NODE_TOOL_SOURCE_IMAGE: swr\.cn-north-4\.myhuaweicloud\.com\/ddn-k8s\/docker\.io\/library\/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c/g) ?? []).length, 2);
-  assert.equal((workflow.match(/NODE_TOOL_IMAGE: node:22-bookworm-slim/g) ?? []).length, 2);
-  assert.equal((workflow.match(/timeout 180 docker pull "\$NODE_TOOL_SOURCE_IMAGE"/g) ?? []).length, 2);
-  assert.equal((workflow.match(/docker tag "\$NODE_TOOL_SOURCE_IMAGE" "\$NODE_TOOL_IMAGE"/g) ?? []).length, 2);
-  assert.equal((workflow.match(/cat > "\$tool_dir\/node" <<'EOF'/g) ?? []).length, 2);
-  assert.equal((workflow.match(/--volume "\$workdir:\$workdir"/g) ?? []).length, 2);
-  assert.equal((workflow.match(/--workdir "\$workdir"/g) ?? []).length, 2);
-  assert.equal((workflow.match(/ln -s node "\$tool_dir\/npm"/g) ?? []).length, 2);
-  assert.equal((workflow.match(/>> "\$GITHUB_PATH"/g) ?? []).length, 2);
-  assert.match(workflow, /--volume \/var\/run\/docker\.sock:\/var\/run\/docker\.sock/);
-  assert.match(workflow, /--network host/);
+  assert.equal((workflow.match(/NODE_TOOL_SOURCE_IMAGE: swr\.cn-north-4\.myhuaweicloud\.com\/ddn-k8s\/docker\.io\/library\/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c/g) ?? []).length, 1);
+  assert.equal((workflow.match(/NODE_TOOL_IMAGE: node:22-bookworm-slim/g) ?? []).length, 1);
+  assert.equal((workflow.match(/timeout 180 docker pull "\$NODE_TOOL_SOURCE_IMAGE"/g) ?? []).length, 1);
+  assert.equal((workflow.match(/docker tag "\$NODE_TOOL_SOURCE_IMAGE" "\$NODE_TOOL_IMAGE"/g) ?? []).length, 1);
+  assert.equal((workflow.match(/cat > "\$tool_dir\/node" <<'EOF'/g) ?? []).length, 1);
+  assert.equal((workflow.match(/--volume "\$workdir:\$workdir"/g) ?? []).length, 1);
+  assert.equal((workflow.match(/--workdir "\$workdir"/g) ?? []).length, 1);
+  assert.equal((workflow.match(/ln -s node "\$tool_dir\/npm"/g) ?? []).length, 1);
+  assert.equal((workflow.match(/>> "\$GITHUB_PATH"/g) ?? []).length, 1);
   assert.match(workflow, /node:22-bookworm-slim "\$\{0##\*\/\}" "\$@"/);
   assert.doesNotMatch(workflow, /(?:--volume|-v)[^\n]*(?:\$HOME\/\.docker|DOCKER_CONFIG)/);
-  assert.match(workflow, /node --version[\s\S]*npm --version/);
+  assert.match(workflow, /name: Verify runner Node tooling[\s\S]*node --version[\s\S]*npm --version/);
   assert.match(workflow, /docker compose version --short/);
   assert.match(workflow, /docker compose --help \| grep -q -- '--project-name'/);
   assert.match(