nested-host mounts (no options/secrets)

.forgejo/workflows/grade.yml

@@ -2,37 +2,25 @@ name: grade
 on: [push]
 
 # Production wiring (forgejo-runner on ghost):
-#   - forgejo-runner v13: docker_host: automount -> the job container gets the
+#   - forgejo-runner v13 config: docker_host: automount -> the job container
-#     host docker socket, so docker_grade.sh drives the host daemon as designed
+#     gets the host docker socket, so `docker run` drives the host daemon
-#   - hidden tests mount from the runner host via the nested docker run
+#   - the nested grade container mounts the secret + hidden tests straight from
-#     (-v /opt/grade-hidden/...) — never in this repo
+#     the host (/opt/grade/grade.env, /opt/grade-hidden/...) — never in this
-#   - GRADE_HMAC_SECRET is a Forgejo org/repo Actions secret (set via API),
+#     repo, no job-container options, no Actions secrets required
-#     injected with ${{ secrets.GRADE_HMAC_SECRET }}
 jobs:
   grade:
     runs-on: docker
     container:
       image: gitea/runner-images:ubuntu-22.04
-      options: -v /opt/grade/runner-diag:/diag
     steps:
       - uses: actions/checkout@v4
       - name: Grade (blank fails, solved passes)
-        env:
-          GRADE_HMAC_SECRET: ${{ secrets.GRADE_HMAC_SECRET }}
         run: |
-          LOG=/diag/$(date +%s).log
+          docker run --rm --network=none \
-          {
+            -v "$PWD":/work \
-            echo "PWD=$PWD"; echo "secret-len=${#GRADE_HMAC_SECRET}"
+            -v /opt/grade/grade.env:/run/secrets/grade.env:ro \
-            docker images | grep -E "grade-(c|harness)" || echo "NO GRADE IMAGES"
+            -v /opt/grade-hidden/cs2060/record-manager:/hidden:ro \
-            ls -la /opt/grade-hidden/cs2060/record-manager/ 2>&1 | head -3
+            grade-c:dev \
-            docker run --rm --network=none \
+            sh -c 'set -a; . /run/secrets/grade.env; set +a; python3 /opt/grade/grade_cli.py run --student /work --hidden /hidden --course CS2060 --assignment record-manager --out /work/results.json'
-              -v "$PWD":/work \
+          echo "--- signed result summary ---"
-              -v /opt/grade-hidden/cs2060/record-manager:/hidden:ro \
+          head -c 400 results.json
-              -e GRADE_HMAC_SECRET \
-              grade-c:dev \
-              python3 /opt/grade/grade_cli.py run \
-                --student /work --hidden /hidden \
-                --course CS2060 --assignment record-manager \
-                --out /work/results.json 2>&1 | tail -20
-          } > "$LOG" 2>&1 || true
-          head -c 400 "$LOG"