remove clojure dep for CI

script/docker-coverage-report

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Merge the unit and integration coverage results inside a Babashka container; needs only
+# Docker. Inputs and outputs travel via `docker cp` rather than a bind mount. Extra args go
+# to script/coverage_report.clj. Output: target/coverage/merged.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+id=$(docker create --security-opt apparmor=unconfined -w / --entrypoint bb \
+  babashka/babashka:latest script/coverage_report.clj "$@")
+trap 'docker rm -f "$id" >/dev/null' EXIT
+
+# The report reads target/coverage/*/lcov.info and, for the HTML, the sources.
+tar -c script/coverage_report.clj src integration-test test target/coverage | docker cp - "$id:/"
+
+docker start -a "$id"
+
+rm -rf target/coverage/merged
+docker cp "$id:/target/coverage/merged" target/coverage/

script/docker-unit-coverage

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Run the unit tests under Cloverage inside the app image; needs only Docker. The report is
+# copied out with `docker cp` (not a bind mount) so it works when this itself runs in a
+# job container. Output: target/coverage/unit.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+source script/lib/docker.sh
+
+build_unit_image
+
+id=$(docker create --security-opt apparmor=unconfined vibe-unit \
+  clojure -M:cov -m cloverage.coverage \
+  --src-ns-path src --test-ns-path test \
+  --lcov --html --output target/coverage/unit)
+trap 'docker rm -f "$id" >/dev/null' EXIT
+
+status=0
+docker start -a "$id" || status=$?
+
+rm -rf target/coverage/unit
+mkdir -p target/coverage
+docker cp "$id:/app/target/coverage/unit" target/coverage/ || echo "[test] WARNING: no unit coverage report was produced"
+exit "$status"

script/docker-unit-test

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Run the Clojure unit tests inside the app image; needs only Docker. Extra args go to the test runner.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+source script/lib/docker.sh
+
+build_unit_image
+exec docker run --rm --security-opt apparmor=unconfined vibe-unit clojure -M:test "$@"

script/integration-test

@@ -9,6 +9,7 @@
 set -euo pipefail
 cd "$(dirname "$0")/.."
 root=$PWD
+source script/lib/docker.sh
 
 # Picks a random port in [lo, hi] that's currently free on this host; retries on
 # collision since another process could grab it first.
@@ -34,15 +35,7 @@ if [[ -n "${COVERAGE:-}" ]]; then
   compose+=(-f docker-compose.yml -f docker-compose.coverage.yml)
 fi
 
-# Works around an LXC/AppArmor bug in runc (opencontainers/runc#5007) that fails RUN steps
-# during image build; a docker-container builder with apparmor disabled sidesteps it.
-builder=vibe-builder
-if ! docker buildx inspect "$builder" >/dev/null 2>&1; then
-  docker buildx create --name "$builder" \
-    --driver docker-container \
-    --buildkitd-config buildkitd.toml
-fi
-docker buildx use "$builder"
+use_builder
 
 cd integration-test
 export VIBE_PORT=$port

script/lib/docker.sh

@@ -0,0 +1,20 @@
+# Shared helpers for the script/docker-* entry points and script/integration-test. Source, don't run.
+#
+# The docker-container buildx builder works around an LXC/AppArmor bug in runc
+# (opencontainers/runc#5007) that fails RUN steps during image build.
+
+use_builder() {
+  local builder=vibe-builder
+  if ! docker buildx inspect "$builder" >/dev/null 2>&1; then
+    docker buildx create --name "$builder" \
+      --driver docker-container \
+      --buildkitd-config buildkitd.toml
+  fi
+  docker buildx use "$builder"
+}
+
+# Builds the app image with the test and coverage deps pre-fetched, tagged vibe-unit.
+build_unit_image() {
+  use_builder
+  docker buildx build --load --build-arg DEPS_ALIASES=test:cov -t vibe-unit .
+}