Keep the dev bind mounts out of CI, where they land nowhere

compose.dev.yml mounts the source over the image's own copy so `--reload`
means something in a detached local stack, and mounts the Playwright report
out to the host. Under act_runner the daemon is a sibling of the job rather
than its host: it resolves those paths against its own filesystem, finds
nothing, and mounts empty directories. So the backend reported "Path does not
exist fluksio/main.py" for a file the image plainly ships, and every shard
uploaded nothing — "No files were found with the provided path:
frontend/blob-report".

compose.ci.yml now puts backend's volumes back to what compose.yml declares
and drops Playwright's entirely; the shard copies its report out of the
container before the teardown instead.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/playwright.yml

@@ -68,11 +68,22 @@ jobs:
       # PLAYWRIGHT_BASE_URL points the browser at `frontend`, which is not a
       # dependency of the playwright service, so bring it up explicitly.
       - run: docker compose up -d --wait backend frontend
+      # Named rather than --rm: the report is written inside the container, and
+      # compose.ci.yml drops the mount that would have put it on this
+      # filesystem — under a sibling daemon that mount lands somewhere this job
+      # cannot read. The teardown below removes the container either way.
       - name: Run Playwright tests
         run: >-
-          docker compose run --rm playwright
+          docker compose run --name "$COMPOSE_PROJECT_NAME-pw" playwright
           bunx playwright test --trace=retain-on-failure
           --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }}
+      # Before the teardown, and on a failed run too — a red shard's report is
+      # the one worth reading.
+      - name: Collect the blob report
+        if: ${{ !cancelled() }}
+        run: |
+          docker cp "$COMPOSE_PROJECT_NAME-pw:/app/frontend/blob-report" frontend/ \
+            || echo "no blob report to collect"
       - name: Tear down
         if: always()
         run: docker compose down -v --remove-orphans

docker/compose.ci.yml

@@ -32,6 +32,15 @@ services:
   backend:
     container_name: !reset null
     ports: !reset []
+    # compose.dev.yml mounts the source over the image's own copy, so `--reload`
+    # means something in a detached local stack. Here the daemon is a sibling of
+    # the job rather than its host: it resolves that path against its own
+    # filesystem, finds nothing, and mounts an empty directory over the package.
+    # That is how the container came to report "Path does not exist
+    # fluksio/main.py" for a file the image plainly ships. Back to what
+    # compose.yml declares — CI wants the built image anyway.
+    volumes: !override
+      - app-flow-data:/data
 
   frontend:
     container_name: !reset null
@@ -49,6 +58,12 @@ services:
 
   playwright:
     ports: !reset []
+    # Same reason as backend above. These two exist so a local run leaves its
+    # report on the host; under a sibling daemon they are empty directories the
+    # report is written into and never seen again, which is what "No files were
+    # found with the provided path: frontend/blob-report" was. The job copies
+    # the report out of the container instead.
+    volumes: !reset []
     # frontend/playwright.config.ts defaults baseURL to http://app.localhost,
     # which is right for a local run against the integrated stack but resolves
     # to 127.0.0.1 in here. In CI the nginx `frontend` service serves the SPA.