test: integration helpers and org, team and repo scenarios through the MCP server

tests/integration/harness.py

@@ -34,6 +34,13 @@ import httpx
 GITEA_IMAGE = (
     "gitea/gitea:28.1.0@sha256:f505a0d3a41323b786e05942fc7a4075e07ae7c169fd9485649aa55ee543a21a"
 )
+# Actions runner image (digest-pinned, tag 0.6.1 at the time of writing). Jobs run in
+# host mode inside this very container, so no Docker socket and no bind mounts are needed.
+ACT_RUNNER_IMAGE = (
+    "gitea/act_runner:0.6.1@sha256:b5c35d6bdbb9bb25e531230bfc7cc663cb751406cbec90a2a891b85fea54de86"
+)
+RUNNER_LABEL = "aegis-host"
+RUNNER_REGISTRATION_ENV = "GITEA_RUNNER_REGISTRATION_TOKEN"
 NAME_PREFIX = "aegis-it-"
 GITEA_PORT = 3000
 ADMIN_LOGIN = "aegis-admin"
@@ -176,6 +183,7 @@ class RunResources:
     container: str
     network: str
     attached_container: str | None = None  # job container joined in CI mode
+    extra_containers: list[str] = field(default_factory=list)  # e.g. the act_runner
     cleaned: bool = False
 
 
@@ -194,6 +202,8 @@ def cleanup_resources(res: RunResources) -> None:
         _ACTIVE.pop(res.run_id, None)
     if res.attached_container:
         run_docker("network", "disconnect", "-f", res.network, res.attached_container, check=False)
+    for extra in res.extra_containers:
+        run_docker("rm", "-f", "-v", extra, check=False)
     run_docker("rm", "-f", "-v", res.container, check=False)
     run_docker("network", "rm", res.network, check=False)
 
@@ -311,11 +321,27 @@ class GiteaInstance:
         ``token`` defaults to the admin token; pass ``anonymous=True`` for an
         unauthenticated call, or ``auth=(login, password)`` for basic auth.
         """
+        return self.request(
+            method, f"/api/v1/{path.lstrip('/')}", token, anonymous=anonymous, **kwargs
+        )
+
+    def request(
+        self,
+        method: str,
+        path: str,
+        token: str | None = None,
+        *,
+        anonymous: bool = False,
+        **kwargs: Any,
+    ) -> httpx.Response:
+        """Call any absolute ``path`` of the instance (for example ``/api/packages/...``).
+
+        Authentication works like :meth:`api`.
+        """
         headers: dict[str, str] = dict(kwargs.pop("headers", None) or {})
         if not anonymous and "auth" not in kwargs:
             headers["Authorization"] = f"token {token or self.admin_token}"
-        url = f"{self.base_url}/api/v1/{path.lstrip('/')}"
-        return self._client.request(method, url, headers=headers, **kwargs)
+        return self._client.request(method, f"{self.base_url}{path}", headers=headers, **kwargs)
 
     def unique(self, prefix: str) -> str:
         """Return ``<prefix>-<8 hex>``, valid as a Gitea user, org or repo name."""
@@ -529,3 +555,48 @@ def stop_gitea(instance: GiteaInstance) -> None:
         res = _ACTIVE.get(instance.run_id)
     if res is not None:
         cleanup_resources(res)
+
+
+def start_runner(instance: GiteaInstance, registration_token: str) -> str:
+    """Start an ``act_runner`` container registered with ``registration_token``.
+
+    The runner joins the run's private network, reaches Gitea by its container name
+    (so it works in local and in container network mode) and runs jobs labelled
+    ``aegis-host`` in host mode inside its own container. The token travels in the
+    environment of the docker CLI and is forwarded with ``-e NAME`` (never in argv).
+    The container is registered for cleanup before it is created. Returns its name.
+    """
+    with _LOCK:
+        res = _ACTIVE.get(instance.run_id)
+    if res is None:
+        raise HarnessError("the Gitea instance is not tracked (already stopped?)")
+    ensure_image(ACT_RUNNER_IMAGE)
+    name = f"{NAME_PREFIX}{instance.run_id}-runner"
+    res.extra_containers.append(name)
+    run_docker(
+        "run",
+        "-d",
+        "--name",
+        name,
+        "--network",
+        instance.network,
+        "--label",
+        "aegis-it=1",
+        "-e",
+        RUNNER_REGISTRATION_ENV,
+        "-e",
+        f"GITEA_INSTANCE_URL=http://{instance.container}:{GITEA_PORT}",
+        "-e",
+        f"GITEA_RUNNER_NAME={name}",
+        "-e",
+        f"GITEA_RUNNER_LABELS={RUNNER_LABEL}:host",
+        ACT_RUNNER_IMAGE,
+        env={RUNNER_REGISTRATION_ENV: registration_token},
+        timeout=300,
+    )
+    return name
+
+
+def runner_logs(name: str, lines: int = 60) -> str:
+    """Return the last log lines of a runner container (for failure diagnostics)."""
+    return _container_logs_tail(name, lines)