fix(ci): downgrade actions/upload-artifact and actions/download-artifact to v3 for compatibility

Reviewed-on: #16

.gitea/workflows/docker-publish.yml

@@ -19,6 +19,9 @@ on:
         required: true
         type: string
 
+env:
+  REGISTRY: git.arthurerlich.de
+
 jobs:
   build-push:
     runs-on: ubuntu-latest
@@ -40,12 +43,6 @@ jobs:
           fi
           git checkout "refs/tags/${{ inputs.tag }}"
 
-      # Strip the protocol from the server URL to get the registry hostname.
-      # e.g. https://gitea.example.com → gitea.example.com
-      - name: Derive registry hostname
-        run: |
-          echo "REGISTRY=$(echo '${{ gitea.server_url }}' | sed 's|https://||;s|http://||')" >> $GITHUB_ENV
-
       # Generates OCI-compliant tags and labels from the provided release tag.
       # 1.2.3 → image tags: 1.2.3 / 1.2 / 1
       - name: Extract Docker metadata

.gitea/workflows/test.yml

@@ -0,0 +1,87 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  REGISTRY: git.arthurerlich.de
+
+jobs:
+  build-dev:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # type=gha depends on act_runner's internal cache proxy, which is unreachable
+      # from job containers on this runner (dial tcp ... i/o timeout). Use the
+      # registry cache backend instead, same as docker-publish.yml.
+      - name: Log in to Gitea registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Build dev image (PHP 8.4 + composer deps)
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile.dev
+          target: dev
+          outputs: type=docker,dest=/tmp/graph-dev.tar
+          tags: graph-dev:ci
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-dev
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-dev,mode=max
+
+      - name: Upload dev image
+        uses: actions/upload-artifact@v3
+        with:
+          name: graph-dev-image
+          path: /tmp/graph-dev.tar
+          retention-days: 1
+  build-prod:
+    needs: build-dev
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build prod image (final target)
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile
+          target: final
+          push: false
+
+  test:
+    needs: build-dev
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download dev image
+        uses: actions/download-artifact@v3
+        with:
+          name: graph-dev-image
+          path: /tmp
+
+      - name: Load dev image
+        run: docker load --input /tmp/graph-dev.tar
+
+      - name: Run PHPUnit
+        run: docker run --rm graph-dev:ci vendor/bin/phpunit --testdox
+
+      - name: Run PHPStan
+        run: docker run --rm graph-dev:ci composer phpstan

CLAUDE.md

@@ -138,12 +138,29 @@ Workflow files live in [.gitea/workflows/](.gitea/workflows/). This project uses
 - Secrets are set under Repository → Settings → Secrets → Actions
 - The registry hostname must be derived from `gitea.server_url` (strip the protocol prefix)
 - Triggers use standard `on:` syntax; `tags: '*.*.*'` matches semver pushes without a `v` prefix
+- Do not use `cache-from/cache-to: type=gha` — on this instance's act_runner (v2.0.0), the internal GitHub Actions-cache-compatible proxy is not reachable from job containers (`dial tcp <ip>:<port>: i/o timeout`), a known act_runner docker-executor networking limitation, not a workflow bug. Use `type=registry` instead (push cache blobs to `${{ env.REGISTRY }}/<repo>:buildcache*` — see both `test.yml` and `docker-publish.yml`); it requires a registry login step even for jobs that don't push the final image.
 
 **Current workflows:**
 
 | File                 | Trigger          | Purpose                                                   |
 | -------------------- | ---------------- | --------------------------------------------------------- |
 | `docker-publish.yml` | Push tag `*.*.*` | Build & push multi-arch image to Gitea container registry |
+| `test.yml`           | Push/PR to `main`| Build dev+prod images, run PHPUnit and PHPStan            |
+
+### Release testing with `act`
+
+Before tagging a release (anything that would trigger `docker-publish.yml`), run `test.yml` locally with [`act`](https://github.com/nektos/act) to catch pipeline failures before pushing. `test.yml` uses plain GitHub Actions syntax (no `gitea.*` contexts), so it runs under `act` unmodified.
+
+```bash
+act -j test \
+  -P ubuntu-latest=catthehacker/ubuntu:act-latest \
+  --artifact-server-path /tmp/act-artifacts
+```
+
+- `-P ubuntu-latest=catthehacker/ubuntu:act-latest` — default act runner image lacks a Docker CLI, which the `test` job needs for its nested `docker run` steps
+- `--artifact-server-path` — required for the `upload-artifact`/`download-artifact` steps to work; without it they silently no-op
+
+**If `act` is not installed:** warn the user it's missing and how to install it (`sudo pacman -S act`, or see the repo above) — do not install it yourself or force the check. `docker-publish.yml` is out of scope for `act` (it needs real `gitea.*` context and a live registry secret); don't try to run it locally.
 
 ## Docker
 

Dockerfile

@@ -30,8 +30,7 @@ FROM deps AS build
 COPY . .
 RUN composer dump-autoload --classmap-authoritative --no-dev --no-interaction && \
     mkdir -p var/cache var/log && \
-    APP_ENV=prod APP_SECRET=placeholder php bin/console cache:warmup --no-debug && \
-    composer dump-env prod
+    APP_ENV=prod APP_SECRET=placeholder php bin/console cache:warmup --no-debug
 
 # ── final (prod) stage — no composer binary ────────────────────────────────────
 FROM base AS final