fix: paralelizar CI no act_runner (rede por job, sem :8000 no host)

capacity>1 exige rede isolada por job e containers aninhados via DNS,
sem publish de host ports que colidem entre jobs.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/ci.yml

@@ -166,17 +166,19 @@ jobs:
 
       - name: Run browser tests against FrankenPHP container
         run: |
-          # Join the job/service network so nested app reaches service "postgres"
-          # without publishing host :5432 (collides on shared act_runner hosts).
+          # Join the per-job network (act_runner creates one when
+          # container.network is empty). No host -p: parallel jobs would
+          # collide on :8000/:5432; DNS names work on the job network.
           JOB_CID="$(hostname)"
           JOB_NET="$(docker inspect -f '{{range $k, $_ := .NetworkSettings.Networks}}{{println $k}}{{end}}' "$JOB_CID" | head -n1)"
           test -n "$JOB_NET"
 
           docker run -d --name amare-web \
             --network "$JOB_NET" \
+            --network-alias amare-web \
             -e APP_ENV=testing \
             -e APP_KEY="${APP_KEY}" \
-            -e APP_URL=http://127.0.0.1:8000 \
+            -e APP_URL=http://amare-web:8000 \
             -e APP_LOCALE=pt_BR \
             -e APP_FALLBACK_LOCALE=pt_BR \
             -e APP_TIMEZONE=America/Sao_Paulo \
@@ -190,18 +192,17 @@ jobs:
             -e CACHE_STORE=database \
             -e QUEUE_CONNECTION=database \
             -v "${GITHUB_WORKSPACE}/storage/app/public:/app/storage/app/public" \
-            -p 8000:8000 \
             amare-app:ci
 
           for i in $(seq 1 30); do
-            if curl -fsS http://127.0.0.1:8000/up; then
+            if curl -fsS http://amare-web:8000/up; then
               break
             fi
             sleep 2
           done
 
-          curl -fsS http://127.0.0.1:8000/up
-          ./vendor/bin/pest --testsuite=Browser
+          curl -fsS http://amare-web:8000/up
+          APP_URL=http://amare-web:8000 ./vendor/bin/pest --testsuite=Browser
 
       - name: Collect failure diagnostics
         if: failure()
@@ -229,10 +230,18 @@ jobs:
 
       - name: Verify container healthcheck and storage link
         run: |
+          # Same per-job network as the step container — no host :8000
+          # publish (collides when capacity > 1).
+          JOB_CID="$(hostname)"
+          JOB_NET="$(docker inspect -f '{{range $k, $_ := .NetworkSettings.Networks}}{{println $k}}{{end}}' "$JOB_CID" | head -n1)"
+          test -n "$JOB_NET"
+
           docker run -d --name amare-health \
+            --network "$JOB_NET" \
+            --network-alias amare-health \
             -e APP_ENV=production \
             -e APP_KEY="${{ env.APP_KEY }}" \
-            -e APP_URL=http://127.0.0.1:8000 \
+            -e APP_URL=http://amare-health:8000 \
             -e APP_DEBUG=false \
             -e DB_CONNECTION=pgsql \
             -e DB_HOST=127.0.0.1 \
@@ -240,11 +249,10 @@ jobs:
             -e DB_DATABASE=amare \
             -e DB_USERNAME=amare \
             -e DB_PASSWORD=secret \
-            -p 8000:8000 \
             amare-app:ci
 
           for i in $(seq 1 30); do
-            if curl -fsS http://127.0.0.1:8000/up; then
+            if curl -fsS http://amare-health:8000/up; then
               docker exec amare-health test -L /app/public/storage
               exit 0
             fi