From 43ecdaee1958d242d3aa9e16d425aa2cb48a8c33 Mon Sep 17 00:00:00 2001
From: openhands <openhands@all-hands.dev>
Date: Fri, 4 Sep 2026 12:16:26 +0200
Subject: [PATCH] fix(ci): docker build met --network=host tegen hangende
 registry-stappen

De host heeft Docker iptables uitgeschakeld, dus build-containers op
bridge hebben geen outbound internet; 'npm install -g pnpm' in de
builder-stage hing daardoor. Met --network=host krijgt de build wel
registry-toegang. Contract-test vergrendelt de flag.
---
 .gitea/workflows/ci.yaml                 | 4 ++++
 src/lib/deploy-workflow-contract.test.ts | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 059fafef..263a8bd4 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -65,7 +65,11 @@ jobs:
 
       - name: Build image
         run: |
+          # --network=host is vereist: deze host heeft Docker iptables
+          # uitgeschakeld, dus build-containers op het bridge-netwerk
+          # hebben geen outbound internet (npm/pnpm zouden hangen).
           DOCKER_BUILDKIT=1 docker build \
+            --network=host \
             --build-arg NODE_OPTIONS="--max-old-space-size=1536" \
             --cache-from epicnext-cms:latest \
             -t epicnext-cms:latest .
diff --git a/src/lib/deploy-workflow-contract.test.ts b/src/lib/deploy-workflow-contract.test.ts
index f5b309b7..e869e929 100644
--- a/src/lib/deploy-workflow-contract.test.ts
+++ b/src/lib/deploy-workflow-contract.test.ts
@@ -24,6 +24,10 @@ describe("deploy job", () => {
 		expect(deployJob).toContain("-t epicnext-cms:latest");
 	});
 
+	it("builds on host network for registry access", () => {
+		expect(deployJob).toContain("--network=host");
+	});
+
 	it("stops old container before starting new one", () => {
 		expect(deployJob).toContain("docker stop epicnext-cms-app");
 		expect(deployJob).toContain("docker rm epicnext-cms-app");