fix(ci): isolate PostgreSQL services and patch audited dependencies

.gitea/workflows/ci.yml

@@ -11,14 +11,11 @@ jobs:
         env:
           POSTGRES_PASSWORD: ci-only-password
           POSTGRES_DB: traceiq
-        ports: ['5432:5432']
         options: >-
+          --label traceiq-ci-postgres=${{ github.repository }}:${{ github.run_id }}:${{ github.run_attempt }}
           --health-cmd pg_isready --health-interval 5s
           --health-timeout 5s --health-retries 10
     env:
-      # Gitea act_runner 的 job 跑在容器里，与服务容器同网络：主机名必须用服务名
-      # postgres（GitHub 托管 runner 的 localhost 语义在这里连不通，勿改回）。
-      DATABASE_URL: postgresql://postgres:ci-only-password@postgres:5432/traceiq
       E2E_PASSWORD: CI-Test-Only-SecurePassword882!
       PYTHONPATH: .
     steps:
@@ -31,6 +28,31 @@ jobs:
           node-version: '22'
           cache: npm
       - run: uv sync --frozen --python 3.12
+      # runner 使用共享 Docker 网络；按本次运行的标签找服务 IP，避免共用 postgres 别名。
+      # act_runner v0.6.1 尚未提供 job.services.postgres.id，现有 Docker socket 仅用于读取。
+      - name: Resolve isolated PostgreSQL service
+        env:
+          POSTGRES_SERVICE_LABEL: traceiq-ci-postgres=${{ github.repository }}:${{ github.run_id }}:${{ github.run_attempt }}
+        run: |
+          postgres_containers=$(curl --fail --silent --show-error \
+            --unix-socket /var/run/docker.sock \
+            --get --data-urlencode "filters={\"label\":[\"$POSTGRES_SERVICE_LABEL\"]}" \
+            http://localhost/containers/json)
+          POSTGRES_CONTAINERS="$postgres_containers" uv run python - <<'PY'
+          import ipaddress
+          import json
+          import os
+
+          containers = json.loads(os.environ["POSTGRES_CONTAINERS"])
+          if len(containers) != 1:
+              raise SystemExit("Expected exactly one PostgreSQL service for this run")
+          networks = list(containers[0]["NetworkSettings"]["Networks"].values())
+          if len(networks) != 1:
+              raise SystemExit("Expected PostgreSQL to use the runner's single Docker network")
+          address = ipaddress.IPv4Address(networks[0]["IPAddress"])
+          with open(os.environ["GITHUB_ENV"], "a") as env_file:
+              env_file.write(f"DATABASE_URL=postgresql://postgres:ci-only-password@{address}:5432/traceiq\n")
+          PY
       - run: npm ci --registry=https://registry.npmjs.org
       - run: uv run ruff check server finance tests scripts
       - run: uv run ruff format --check server finance tests scripts