services:
  tbd-app:
    image: tbd-app-integration
    build:
      context: ..
      dockerfile: Dockerfile
    ports:
      - "${TBD_PORT:-3000}:${TBD_PORT:-3000}"
    security_opt:
      - apparmor:unconfined
    environment:
      - PORT=${TBD_PORT:-3000}
      # Dummy OAuth settings so /auth/login can be exercised; there's no Gitea to complete a login.
      - BASE_URL=http://tbd-app:${TBD_PORT:-3000}
      - GITEA_URL=http://gitea.invalid
      - GITEA_CLIENT_ID=integration-client
      - GITEA_CLIENT_SECRET=integration-secret
      - ADMIN_USERS=integration-admin
      - SESSION_SECRET=integration-session-secret
    # No container healthcheck: healthchecks run via `docker exec`, which hits the
    # same LXC/AppArmor runc bug (opencontainers/runc#5007) as image builds and
    # always fails here. integration_test.bb polls the server until it's ready.

  # The suite is baked into the image (Dockerfile) rather than bind-mounted: bind mounts
  # resolve on the Docker host, so they break when run from inside a CI job container.
  integration-test:
    image: tbd-integration-test
    build:
      context: .
    security_opt:
      - apparmor:unconfined
    depends_on:
      tbd-app:
        condition: service_started
    entrypoint: ["bb", "/integration_test.bb", "http://tbd-app:${TBD_PORT:-3000}"]