Run the frontend container smoke in CI (W4-3)

[vladmesh]

What

New frontend-container job in .github/workflows/ci.yml. It runs the existing make test-frontend-container, which builds the nginx frontend image and the backend image and then runs tests/frontend_proxy/ (SPA, REST, WebSocket and /health through the nginx proxy). The Makefile, compose file and smoke assertions are unchanged, and so are the existing check, frontend and integration jobs.

Trigger

The job runs when detect-changes gives any scope except docs (so frontend, backend, mixed, and an empty or unknown value too). The existing classifier puts every container-relevant path into one of the scopes that run:

• frontend/** (including Dockerfile, nginx.conf.template, .dockerignore) → frontend
• src/, tests/, content/, pyproject.toml, uv.lock → backend
• Dockerfile*, docker-compose*.yml, .dockerignore, Makefile, scripts/, .github/ → mixed

A change is skipped only if it touches nothing but docs/** or *.md, and both Docker build contexts leave *.md out.

Isolation and cleanup

• COMPOSE_PROJECT_NAME: dnd-fe-smoke-${run_id}-${run_attempt}-${job}. The compose file has no container_name, no named volumes and no fixed image names, so the containers, the network and the built images (<project>-<service>) all belong to this project.
• FRONTEND_PORT: "0" publishes nginx on an ephemeral host port. The smoke itself reaches nginx over the project network.
• An if: always() step (it also runs on failure or cancel) calls docker compose ... --profile frontend down --volumes --remove-orphans --rmi local, taking the project from the job env. There is no prune and no other project is touched.
• Exit status: the make target keeps the up --exit-code-from frontend-smoke status after its own down, so a failing build or smoke fails the step.

Tests

tests/unit/test_ci_frontend_container.py (28 tests, runs in under a second):

• container-relevant paths never classify as docs; a docs-only change does
• the job's scope gate, the project name made of run_id, run_attempt and job, the ephemeral port, and the always() cleanup with no prune
• make test-frontend-container run against a fake docker on PATH: the exit status follows up (0/1/7), and down always runs with the same project

Verification

• make check: passed (backend 3074 tests, frontend 387; lint and mypy clean).
• Local real smoke: could not complete. I started dockerd in the session and it worked, but pulling node:22-alpine from Docker Hub returned 429 Too Many Requests. So the build failed before any smoke test ran. The make target did exit non-zero (2) and left no containers behind. docker compose config with the CI env gives the expected project name and published: "0".
• This PR's Actions run of the frontend-container job is the first real run of the smoke. Check that it passes before merging.

---

[vladmesh]

Independent review — PASS

Reviewed exact head: e76d5d24757773d3ad0bb2447a03ba083cf8cf67.

Independent read-only reviewer completed PASS (deleg_ff98c7d0/task-0.log); no blocking findings. Scope is exactly CI workflow plus 28 regression tests. PR/push triggers, non-doc scope, unique Compose project, failure propagation through the existing Make target, and always cleanup are correct. Classifier exercised against 20 relevant paths; none incorrectly skips smoke. No unrelated changes or secrets.

Verification on this exact head:

• Full local make check: exit 0, 3074 pytest + 390 Vitest passed, lint/type checks passed (existing non-blocking React compiler warning).
• GitHub CI run https://github.com/vladmesh/dnd-simulator/actions/runs/36557682377: all five jobs success.
• Real frontend-container job https://github.com/vladmesh/dnd-simulator/actions/runs/36557682377/job/109370735403: make test-frontend-container, 9 passed, frontend-smoke exit 0, scoped cleanup executed; not skipped.
• Additional local isolated container smoke: 9 passed, exit 0, project dnd-w4-review90-smoke cleaned up.

Evidence: wave4/pr-90/checks.json, check.log, github-container-smoke.log, container-smoke.log. Merge only if head and CI remain unchanged/green.