fix(ci): Run docker compose from helper container with deploy dir mounted

The runner container has Docker socket but no host filesystem access.
docker compose needs to read YAML files, so run build+deploy inside
a helper container that has both Docker socket and the deploy dir mounted.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -231,39 +231,42 @@ jobs:
               fi
             "
 
-          # 3. Docker Images bauen (docker compose liest vom Host-Dateisystem)
+          # 3. Build + Deploy via Helper-Container mit Docker-Socket + Deploy-Dir
+          # docker compose muss die YAML-Dateien lesen koennen, daher
+          # alles in einem Container mit beiden Mounts ausfuehren.
           echo ""
-          echo "=== Building Docker Images ==="
+          echo "=== Building + Deploying ==="
-          docker compose -f "${DEPLOY_DIR}/docker-compose.yml" \
+          docker run --rm \
-            -f "${DEPLOY_DIR}/docker-compose.hetzner.yml" \
+            -v /var/run/docker.sock:/var/run/docker.sock \
-            --project-directory "${DEPLOY_DIR}" \
+            -v "${DEPLOY_DIR}:${DEPLOY_DIR}" \
-            build --parallel \
+            -w "${DEPLOY_DIR}" \
-            admin-compliance \
+            docker:27-cli \
-            backend-compliance \
+            sh -c "
-            ai-compliance-sdk \
+              COMPOSE_FILES='-f docker-compose.yml -f docker-compose.hetzner.yml'
-            developer-portal
 
-          # 4. Container neu starten
+              echo '=== Building Docker Images ==='
-          echo ""
+              docker compose \${COMPOSE_FILES} build --parallel \
-          echo "=== Deploying ==="
+                admin-compliance \
-          docker compose -f "${DEPLOY_DIR}/docker-compose.yml" \
+                backend-compliance \
-            -f "${DEPLOY_DIR}/docker-compose.hetzner.yml" \
+                ai-compliance-sdk \
-            --project-directory "${DEPLOY_DIR}" \
+                developer-portal
-            up -d --remove-orphans \
-            admin-compliance \
-            backend-compliance \
-            ai-compliance-sdk \
-            developer-portal
 
-          # 5. Health Checks
+              echo ''
-          echo ""
+              echo '=== Starting containers ==='
-          echo "=== Health Checks ==="
+              docker compose \${COMPOSE_FILES} up -d --remove-orphans \
-          sleep 10
+                admin-compliance \
+                backend-compliance \
+                ai-compliance-sdk \
+                developer-portal
 
-          for svc in bp-compliance-admin bp-compliance-backend bp-compliance-ai-sdk bp-compliance-developer-portal; do
+              echo ''
-            STATUS=$(docker inspect --format='{{.State.Status}}' "${svc}" 2>/dev/null || echo "not found")
+              echo '=== Health Checks ==='
-            echo "${svc}: ${STATUS}"
+              sleep 10
-          done
+              for svc in bp-compliance-admin bp-compliance-backend bp-compliance-ai-sdk bp-compliance-developer-portal; do
+                STATUS=\$(docker inspect --format='{{.State.Status}}' \"\${svc}\" 2>/dev/null || echo 'not found')
+                echo \"\${svc}: \${STATUS}\"
+              done
+            "
 
           echo ""
           echo "=== Deploy abgeschlossen: ${SHORT_SHA} ==="