fix(ci): harden community image smoke

.gitea/workflows/ci.yml

@@ -286,17 +286,44 @@ jobs:
           CRANK_SESSION_SECRET=ci-session-secret
           CRANK_PASSWORD_PEPPER=ci-password-pepper
           CRANK_BOOTSTRAP_ADMIN_EMAIL=owner@crank.test
-          CRANK_BOOTSTRAP_ADMIN_PASSWORD=ci-admin-password
           CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME=CI Owner
           CRANK_BASE_URL=http://127.0.0.1
+          CRANK_ENVIRONMENT=ci
+          CRANK_OUTBOUND_ALLOWED_HOSTS=admin-api
           CRANK_PUBLISH_BIND=127.0.0.1
           CRANK_ADMIN_PUBLISH_PORT=0
           CRANK_MCP_PUBLISH_PORT=0
           CRANK_UI_PUBLISH_PORT=0
           CRANK_DEMO_SEED=true
           EOF
-          docker compose -f deploy/community/docker-compose.images.yml \
-            --env-file .tmp/community-smoke.env --profile local-db up -d --wait
+          compose=(docker compose -f deploy/community/docker-compose.images.yml \
+            --env-file .tmp/community-smoke.env --profile local-db)
+          "${compose[@]}" up -d --wait postgres
+          "${compose[@]}" run --rm migrate
+          bootstrap_json="$("${compose[@]}" run --rm --no-deps \
+            --entrypoint crank-migrate migrate admin-auth bootstrap-create \
+            --email owner@crank.test --display-name 'CI Owner')"
+          bootstrap_token="$(python3 -c \
+            'import json,sys; print(json.loads(sys.stdin.read())["bootstrap_token"])' \
+            <<<"$bootstrap_json")"
+          install -d -m 700 .tmp/community-bootstrap
+          printf '%s' "$bootstrap_token" > .tmp/community-bootstrap/token
+          printf '%s' 'ci-admin-password' > .tmp/community-bootstrap/password
+          printf '%s' 'ci-password-pepper' > .tmp/community-bootstrap/password-pepper
+          chmod 600 .tmp/community-bootstrap/token \
+            .tmp/community-bootstrap/password \
+            .tmp/community-bootstrap/password-pepper
+          "${compose[@]}" run --rm --no-deps \
+            -v "$PWD/.tmp/community-bootstrap:/run/bootstrap:ro" \
+            --entrypoint crank-migrate migrate admin-auth bootstrap-complete \
+            --token-file /run/bootstrap/token \
+            --password-file /run/bootstrap/password \
+            --password-pepper-file /run/bootstrap/password-pepper
+          rm -f .tmp/community-bootstrap/token \
+            .tmp/community-bootstrap/password \
+            .tmp/community-bootstrap/password-pepper
+          rmdir .tmp/community-bootstrap
+          "${compose[@]}" up -d --wait
 
       - name: Run authenticated Community image smoke
         env:

.gitea/workflows/release.yml

@@ -217,8 +217,8 @@ jobs:
           CRANK_SESSION_SECRET=release-smoke-session
           CRANK_PASSWORD_PEPPER=release-smoke-pepper
           CRANK_BOOTSTRAP_ADMIN_EMAIL=owner@crank.test
-          CRANK_BOOTSTRAP_ADMIN_PASSWORD=release-smoke-password
           CRANK_BASE_URL=http://127.0.0.1
+          CRANK_ENVIRONMENT=release-smoke
           CRANK_PUBLISH_BIND=127.0.0.1
           CRANK_ADMIN_PUBLISH_PORT=0
           CRANK_MCP_PUBLISH_PORT=0