docker-build-validation.yml

name: Docker Build Validation

on:
  pull_request:
    branches:
      - main
  merge_group:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

jobs:
  validate-authzed-compose:
    name: Validate AuthZed Compose
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
    env:
      DATABASE_URL: postgresql://test:test@127.0.0.1:5432/formbricks
      POSTGRES_PASSWORD: build-time-placeholder
      ENCRYPTION_KEY: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
      REDIS_URL: redis://127.0.0.1:6379
      CUBEJS_API_URL: http://127.0.0.1:4000
      CUBEJS_API_SECRET: build-time-placeholder
      HUB_API_URL: http://127.0.0.1:4000
      HUB_API_KEY: build-time-placeholder

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit

      - name: Checkout Repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Setup repository Node.js version
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc

      - name: Install pnpm
        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --config.platform=linux --config.architecture=x64

      - name: Test maintenance, development preparation and release tagging
        run: pnpm exec vitest run docker/__tests__/maintenance-upgrade.test.ts scripts/setup-dev-env.test.ts scripts/dev-authzed-up.test.ts .github/actions/build-and-push-docker/ghcr-tags.test.ts

      - name: Build web workspace dependencies
        run: pnpm build --filter=@formbricks/web^...

      - name: Test AuthZed client and schema lifecycle
        run: pnpm --dir apps/web test lib/authzed

      - name: Validate Compose contracts
        run: bash docker/authzed-compose-contract.sh

      - name: Run AuthZed application and persistence smoke test
        run: bash docker/authzed-smoke.sh

  validate-docker-build:
    name: Validate Docker Build
    runs-on: ubuntu-latest
    permissions:
      contents: read

    # Add PostgreSQL and Redis service containers
    services:
      postgres:
        image: pgvector/pgvector@sha256:9ae02a756ba16a2d69dd78058e25915e36e189bb36ddf01ceae86390d7ed786a
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: formbricks
        ports:
          - 5432:5432
        # Health check to ensure PostgreSQL is ready before using it
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

      redis:
        image: valkey/valkey@sha256:e0eb7c480958d32bdc4357a74bdd70653ae15f2f9b4c93c4a5a9fad1dc471c84
        ports:
          - 6379:6379

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit

      - name: Checkout Repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Verify Valkey Image Platforms
        shell: bash
        env:
          AUTHZED_DATABASE_PASSWORD: 0000000000000000000000000000000000000000000000000000000000000002
          AUTHZED_TOKEN: 0000000000000000000000000000000000000000000000000000000000000001
          POSTGRES_PASSWORD: build-time-placeholder
        run: |
          set -euo pipefail

          valkey_image="$(docker compose -f docker/docker-compose.yml config --format json | jq -r '.services.redis.image')"
          manifest="$(docker buildx imagetools inspect --raw "$valkey_image")"

          jq -e '
            .mediaType == "application/vnd.oci.image.index.v1+json" and
            any(.manifests[]; .platform.os == "linux" and .platform.architecture == "amd64") and
            any(.manifests[]; .platform.os == "linux" and .platform.architecture == "arm64")
          ' <<<"$manifest"

      # NOTE: deliberately no `cache-from`/`cache-to: type=gha`. Measured over four runs, exporting
      # the cache cost 222-407s per run while the layers it could restore add up to 12s of work: the
      # only steps that ever reported CACHED were the apk/corepack prelude, because `COPY . .` sits
      # ahead of `pnpm install` in apps/web/Dockerfile and invalidates everything after it on any
      # diff. Nothing populates a cache scope this job can read either — no workflow runs on pushes
      # to main, and merge_group runs write to throwaway `gh-readonly-queue/...` scopes. Restoring
      # the cache is worth revisiting only together with both halves of the fix: reorder the
      # Dockerfile so the install layer survives a source change, and give the cache a producer PRs
      # can read (a push-to-main build, or a registry cache, which is not branch-scoped).
      - name: Build Docker Image
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        env:
          GITHUB_SHA: ${{ github.sha }}
        with:
          context: .
          file: ./apps/web/Dockerfile
          push: false
          load: true
          tags: formbricks-test:${{ env.GITHUB_SHA }}
          secrets: |
            database_url=${{ secrets.DUMMY_DATABASE_URL }}
            encryption_key=${{ secrets.DUMMY_ENCRYPTION_KEY }}
            redis_url=redis://localhost:6379
            hub_api_url=http://localhost:4000
            hub_api_key=build-time-placeholder
            cubejs_api_url=http://localhost:4000
            cubejs_api_secret=build-time-placeholder

      - name: Verify Runtime Image Excludes npm
        shell: bash
        run: |
          set -euo pipefail

          docker run --rm --entrypoint sh "formbricks-test:$GITHUB_SHA" -c '
            set -eu
            test ! -d /usr/local/lib/node_modules/npm
            ! command -v npm >/dev/null 2>&1
            ! command -v npx >/dev/null 2>&1
            node --version
          '

      - name: Verify Release-Matched AuthZed Operator CLI
        shell: bash
        env:
          GITHUB_SHA: ${{ github.sha }}
          DUMMY_ENCRYPTION_KEY: ${{ secrets.DUMMY_ENCRYPTION_KEY }}
        run: |
          set -euo pipefail

          IMAGE="formbricks-test:$GITHUB_SHA"
          docker run --rm --entrypoint sh "$IMAGE" -c '
            set -eu
            test "$(id -u)" != "0"
            test -x /usr/local/bin/formbricks-authzed
            test -r /home/nextjs/authzed-cli/index.mjs
            test -r /home/nextjs/authzed-cli/schema.zed
          '

          AUTHZED_CLI_ENV=(
            -e DATABASE_URL="postgresql://test:test@192.0.2.1:5432/formbricks"
            -e ENCRYPTION_KEY="$DUMMY_ENCRYPTION_KEY"
            -e REDIS_URL="redis://192.0.2.1:6379"
            -e HUB_API_URL="http://192.0.2.1:4000"
            -e HUB_API_KEY="build-time-placeholder"
            -e CUBEJS_API_URL="http://192.0.2.1:4000"
            -e CUBEJS_API_SECRET="build-time-placeholder"
            -e AUTHZED_ENABLED="false"
          )

          set +e
          output="$(docker run --rm \
            --entrypoint formbricks-authzed \
            "${AUTHZED_CLI_ENV[@]}" \
            "$IMAGE" health 2>&1)"
          status=$?
          set -e

          test "$status" -eq 1
          test "$output" = '{"status":"disabled"}'

          UNREACHABLE_TOKEN="authzed-cli-validation-secret"
          set +e
          unreachable_output="$(timeout 10s docker run --rm \
            --entrypoint formbricks-authzed \
            "${AUTHZED_CLI_ENV[@]}" \
            -e AUTHZED_ENABLED="true" \
            -e AUTHZED_ENDPOINT="192.0.2.1:50051" \
            -e AUTHZED_INSECURE="true" \
            -e AUTHZED_SYSTEM_KEY="formbricks" \
            -e AUTHZED_TOKEN="$UNREACHABLE_TOKEN" \
            "$IMAGE" health 2>&1)"
          unreachable_status=$?
          set -e

          test "$unreachable_status" -eq 1
          test "$(printf '%s\n' "$unreachable_output" | wc -l)" -eq 1
          ! printf '%s' "$unreachable_output" | grep -F "$UNREACHABLE_TOKEN"
          printf '%s' "$unreachable_output" | jq -e '
            .status == "unhealthy" and
            .retryable == true and
            (.latencyMs | type == "number")
          ' >/dev/null

          set +e
          upgrade_output="$(docker run --rm \
            --entrypoint formbricks-authzed \
            "${AUTHZED_CLI_ENV[@]}" \
            "$IMAGE" upgrade check 2>&1)"
          upgrade_status=$?
          set -e

          test "$upgrade_status" -eq 1
          test "$upgrade_output" = '{"code":"authzed_disabled","retryable":false,"status":"failed"}'

      - name: Reject Invalid Environment Before Database Setup
        shell: bash
        env:
          GITHUB_SHA: ${{ github.sha }}
          DUMMY_ENCRYPTION_KEY: ${{ secrets.DUMMY_ENCRYPTION_KEY }}
        run: |
          set -euo pipefail

          IMAGE="formbricks-test:$GITHUB_SHA"
          COMMON_ENV=(
            -e DATABASE_URL="postgresql://test:test@192.0.2.1:5432/formbricks"
            -e ENCRYPTION_KEY="$DUMMY_ENCRYPTION_KEY"
            -e BETTER_AUTH_SECRET="$DUMMY_ENCRYPTION_KEY"
            -e REDIS_URL="redis://192.0.2.1:6379"
            -e HUB_API_URL="http://192.0.2.1:4000"
            -e HUB_API_KEY="build-time-placeholder"
            -e CUBEJS_API_URL="http://192.0.2.1:4000"
            -e CUBEJS_API_SECRET="build-time-placeholder"
          )

          run_invalid_case() {
            local case_name="$1"
            local expected_field="$2"
            local secret_value="$3"
            shift 3

            set +e
            local output
            output="$(docker run --rm "${COMMON_ENV[@]}" "$@" "$IMAGE" 2>&1)"
            local status=$?
            set -e

            if [ "$status" -eq 0 ]; then
              echo "Expected $case_name to fail environment validation"
              exit 1
            fi

            if ! grep -Fq "$expected_field" <<<"$output"; then
              echo "Expected $case_name output to name $expected_field"
              echo "$output"
              exit 1
            fi

            if [ -n "$secret_value" ] && grep -Fq "$secret_value" <<<"$output"; then
              echo "Environment validation leaked the configured value for $case_name"
              exit 1
            fi

            if grep -Eq "Running database migrations|Running SAML database setup|Prisma|Can't reach database" <<<"$output"; then
              echo "Database work started before $case_name environment validation failed"
              echo "$output"
              exit 1
            fi
          }

          run_invalid_case "missing AuthZed configuration" "AUTHZED_ENABLED=true" ""
          run_invalid_case "disabled AuthZed" "AUTHZED_ENABLED=true" "" -e AUTHZED_ENABLED=false
          run_invalid_case "missing AuthZed token" "AUTHZED_TOKEN" "" \
            -e AUTHZED_ENABLED=true -e AUTHZED_ENDPOINT=spicedb:50051 -e AUTHZED_SYSTEM_KEY=formbricks
          run_invalid_case "weak AuthZed consistency" "AUTHZED_CONSISTENCY=fully_consistent" "authzed-secret-sentinel" \
            -e AUTHZED_ENABLED=true -e AUTHZED_ENDPOINT=spicedb:50051 -e AUTHZED_SYSTEM_KEY=formbricks \
            -e AUTHZED_TOKEN=authzed-secret-sentinel -e AUTHZED_CONSISTENCY=minimize_latency

          # Valid configuration succeeds even without networking: this is not a readiness RPC.
          docker run --rm --network none --entrypoint node "${COMMON_ENV[@]}" \
            -e AUTHZED_ENABLED=true -e AUTHZED_ENDPOINT=spicedb:50051 -e AUTHZED_SYSTEM_KEY=formbricks \
            -e AUTHZED_TOKEN=authzed-secret-sentinel -e AUTHZED_CONSISTENCY=fully_consistent \
            "$IMAGE" /home/nextjs/validate-env.mjs --server

          # Migration-only preflight must accept the same base environment without
          # AuthZed credentials. It must not construct a client or contact a database.
          docker run --rm --network none --entrypoint node "${COMMON_ENV[@]}" \
            "$IMAGE" /home/nextjs/validate-env.mjs

          run_invalid_case \
            "invalid provider" \
            "AI_PROVIDER" \
            "unsupported-provider-sentinel" \
            -e AI_PROVIDER="unsupported-provider-sentinel"

          run_invalid_case \
            "missing model" \
            "AI_MODEL" \
            "" \
            -e AI_PROVIDER="google" \
            -e AI_GOOGLE_CLOUD_PROJECT="test-project" \
            -e AI_GOOGLE_CLOUD_LOCATION="us-central1"

          run_invalid_case \
            "invalid credentials JSON" \
            "AI_GOOGLE_CLOUD_CREDENTIALS_JSON" \
            "credentials-secret-sentinel" \
            -e AI_PROVIDER="google" \
            -e AI_MODEL="gemini-2.5-flash" \
            -e AI_GOOGLE_CLOUD_PROJECT="test-project" \
            -e AI_GOOGLE_CLOUD_LOCATION="us-central1" \
            -e AI_GOOGLE_CLOUD_CREDENTIALS_JSON="credentials-secret-sentinel"

          run_invalid_case \
            "invalid provider base URL" \
            "AI_OPENAI_COMPATIBLE_BASE_URL" \
            "base-url-secret-sentinel" \
            -e AI_PROVIDER="openai-compatible" \
            -e AI_MODEL="test-model" \
            -e AI_OPENAI_COMPATIBLE_BASE_URL="base-url-secret-sentinel"

          run_invalid_case \
            "invalid Azure base URL" \
            "AI_AZURE_BASE_URL" \
            "azure-base-url-secret-sentinel" \
            -e AI_PROVIDER="azure" \
            -e AI_MODEL="test-model" \
            -e AI_AZURE_API_KEY="azure-base-url-secret-sentinel" \
            -e AI_AZURE_BASE_URL="azure-base-url-secret-sentinel"

      - name: Validate Docker Compose Migration Environment
        shell: bash
        env:
          GITHUB_SHA: ${{ github.sha }}
          DUMMY_ENCRYPTION_KEY: ${{ secrets.DUMMY_ENCRYPTION_KEY }}
        run: |
          set -euo pipefail

          docker tag "formbricks-test:$GITHUB_SHA" ghcr.io/formbricks/formbricks:latest
          trap 'rm -f docker/.env' EXIT
          printf '%s\n' \
            'WEBAPP_URL=http://localhost:3000' \
            'BETTER_AUTH_URL=http://localhost:3000' \
            'POSTGRES_PASSWORD=compose-postgres-placeholder' \
            "ENCRYPTION_KEY=$DUMMY_ENCRYPTION_KEY" \
            "BETTER_AUTH_SECRET=$DUMMY_ENCRYPTION_KEY" \
            'HUB_API_KEY=build-time-placeholder' \
            'CUBEJS_API_SECRET=build-time-placeholder' \
            'AUTHZED_TOKEN=compose-authzed-token-placeholder' \
            'AUTHZED_DATABASE_PASSWORD=compose-authzed-database-placeholder' \
            'AI_PROVIDER=compose-provider-secret-sentinel' \
            > docker/.env

          set +e
          output="$(docker compose -f docker/docker-compose.yml run --rm --no-deps formbricks-migrate 2>&1)"
          status=$?
          set -e

          if [ "$status" -eq 0 ]; then
            echo "Expected the Compose migration service to reject its invalid environment"
            exit 1
          fi

          if ! grep -Fq "AI_PROVIDER" <<<"$output"; then
            echo "Expected the Compose migration output to name AI_PROVIDER"
            echo "$output"
            exit 1
          fi

          if grep -Fq "compose-provider-secret-sentinel" <<<"$output"; then
            echo "Compose migration validation leaked the configured provider value"
            exit 1
          fi

          if grep -Eq "prisma migrate|Prisma|Can't reach database" <<<"$output"; then
            echo "Compose started migrations before environment validation failed"
            echo "$output"
            exit 1
          fi

      - name: Preserve Startup Migration Skip Behavior
        shell: bash
        env:
          GITHUB_SHA: ${{ github.sha }}
          DUMMY_ENCRYPTION_KEY: ${{ secrets.DUMMY_ENCRYPTION_KEY }}
        run: |
          set -euo pipefail

          docker run --name formbricks-skip-test \
            -e DATABASE_URL="postgresql://test:test@192.0.2.1:5432/formbricks" \
            -e ENCRYPTION_KEY="$DUMMY_ENCRYPTION_KEY" \
            -e BETTER_AUTH_SECRET="$DUMMY_ENCRYPTION_KEY" \
            -e REDIS_URL="redis://192.0.2.1:6379" \
            -e HUB_API_URL="http://192.0.2.1:4000" \
            -e HUB_API_KEY="build-time-placeholder" \
            -e CUBEJS_API_URL="http://192.0.2.1:4000" \
            -e CUBEJS_API_SECRET="build-time-placeholder" \
            -e SKIP_STARTUP_MIGRATION="true" \
            -e AUTHZED_ENABLED=true \
            -e AUTHZED_ENDPOINT=127.0.0.1:50051 \
            -e AUTHZED_TOKEN=startup-test-placeholder \
            -e AUTHZED_SYSTEM_KEY=formbricks \
            -e AUTHZED_CONSISTENCY=fully_consistent \
            -d "formbricks-test:$GITHUB_SHA"

          trap 'docker rm -f formbricks-skip-test >/dev/null 2>&1 || true' EXIT

          for _ in $(seq 1 30); do
            if docker logs formbricks-skip-test 2>&1 | grep -Fq "Starting Next.js server"; then
              break
            fi

            if [ "$(docker inspect -f '{{.State.Running}}' formbricks-skip-test 2>/dev/null)" != "true" ]; then
              echo "Container exited before exercising the startup migration skip"
              docker logs formbricks-skip-test
              exit 1
            fi

            sleep 1
          done

          logs="$(docker logs formbricks-skip-test 2>&1)"
          grep -Fq "Environment variables validated successfully" <<<"$logs"
          grep -Fq "Skipping startup migrations" <<<"$logs"
          grep -Fq "Running SAML database setup" <<<"$logs"
          grep -Fq "Starting Next.js server" <<<"$logs"

          if grep -Fq "Running database migrations" <<<"$logs"; then
            echo "Startup migrations ran despite SKIP_STARTUP_MIGRATION=true"
            echo "$logs"
            exit 1
          fi

      - name: Verify and Initialize PostgreSQL
        run: |
          echo "Verifying PostgreSQL connection..."
          # Install PostgreSQL client to test connection
          sudo apt-get update && sudo apt-get install -y postgresql-client

          # Test connection using psql with timeout and proper error handling
          echo "Testing PostgreSQL connection with 30 second timeout..."
          if timeout 30 bash -c 'until PGPASSWORD=test psql -h localhost -U test -d formbricks -c "\dt" >/dev/null 2>&1; do
            echo "Waiting for PostgreSQL to be ready..."
            sleep 2
          done'; then
            echo "✅ PostgreSQL connection successful"
            PGPASSWORD=test psql -h localhost -U test -d formbricks -c "SELECT version();"

            # Enable necessary extensions that might be required by migrations
            echo "Enabling required PostgreSQL extensions..."
            PGPASSWORD=test psql -h localhost -U test -d formbricks -c "CREATE EXTENSION IF NOT EXISTS vector;" || echo "Vector extension already exists or not available"

          else
            echo "❌ PostgreSQL connection failed after 30 seconds"
            exit 1
          fi

          # Show network configuration
          echo "Network configuration:"
          netstat -tulpn | grep 5432 || echo "No process listening on port 5432"

      - name: Verify Redis/Valkey Connection
        run: |
          echo "Verifying Redis/Valkey connection..."
          # Install Redis client to test connection
          sudo apt-get update && sudo apt-get install -y redis-tools

          # Test connection using redis-cli with timeout and proper error handling
          echo "Testing Redis connection with 30 second timeout..."
          if timeout 30 bash -c 'until redis-cli -h localhost -p 6379 ping >/dev/null 2>&1; do
            echo "Waiting for Redis to be ready..."
            sleep 2
          done'; then
            echo "✅ Redis connection successful"
            redis-cli -h localhost -p 6379 info server | head -5
          else
            echo "❌ Redis connection failed after 30 seconds"
            exit 1
          fi

          # Show network configuration for Redis
          echo "Redis network configuration:"
          netstat -tulpn | grep 6379 || echo "No process listening on port 6379"

      - name: Test Docker Image with Health Check
        shell: bash
        env:
          GITHUB_SHA: ${{ github.sha }}
          DUMMY_ENCRYPTION_KEY: ${{ secrets.DUMMY_ENCRYPTION_KEY }}
        run: |
          echo "🧪 Testing if the Docker image starts correctly..."

          # Add extra docker run args to support host.docker.internal on Linux
          DOCKER_RUN_ARGS="--add-host=host.docker.internal:host-gateway"

          # Start the container with host.docker.internal pointing to the host
          docker run --name formbricks-test \
            $DOCKER_RUN_ARGS \
            -p 3000:3000 \
            -e DATABASE_URL="postgresql://test:test@host.docker.internal:5432/formbricks" \
            -e ENCRYPTION_KEY="$DUMMY_ENCRYPTION_KEY" \
            -e BETTER_AUTH_SECRET="$DUMMY_ENCRYPTION_KEY" \
            -e REDIS_URL="redis://host.docker.internal:6379" \
            -e HUB_API_URL="http://localhost:4000" \
            -e HUB_API_KEY="build-time-placeholder" \
            -e CUBEJS_API_URL="http://localhost:4000" \
            -e CUBEJS_API_SECRET="build-time-placeholder" \
            -e AUTHZED_ENABLED=true \
            -e AUTHZED_ENDPOINT=127.0.0.1:50051 \
            -e AUTHZED_TOKEN=startup-test-placeholder \
            -e AUTHZED_SYSTEM_KEY=formbricks \
            -e AUTHZED_CONSISTENCY=fully_consistent \
            -d "formbricks-test:$GITHUB_SHA"

          # Start health check polling immediately (every 5 seconds for up to 5 minutes)
          echo "🏥 Polling /health endpoint every 5 seconds for up to 5 minutes..."
          MAX_RETRIES=60  # 60 attempts × 5 seconds = 5 minutes
          RETRY_COUNT=0
          HEALTH_CHECK_SUCCESS=false

          set +e  # Disable exit on error to allow for retries

          while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do
            RETRY_COUNT=$((RETRY_COUNT + 1))

            # Check if container is still running
            if [ "$(docker inspect -f '{{.State.Running}}' formbricks-test 2>/dev/null)" != "true" ]; then
              echo "❌ Container stopped running after $((RETRY_COUNT * 5)) seconds!"
              echo "📋 Container logs:"
              docker logs formbricks-test
              exit 1
            fi

            # Show progress and diagnostic info every 12 attempts (1 minute intervals)
            if [ $((RETRY_COUNT % 12)) -eq 0 ] || [ $RETRY_COUNT -eq 1 ]; then
              echo "Health check attempt $RETRY_COUNT of $MAX_RETRIES ($(($RETRY_COUNT * 5)) seconds elapsed)..."
              echo "📋 Recent container logs:"
              docker logs --tail 10 formbricks-test
            fi

            # Try health endpoint with shorter timeout for faster polling
            # Use -f flag to make curl fail on HTTP error status codes (4xx, 5xx)
            if curl -f -s -m 10 http://localhost:3000/health >/dev/null 2>&1; then
              echo "✅ Health check successful after $((RETRY_COUNT * 5)) seconds!"
              HEALTH_CHECK_SUCCESS=true
              break
            fi

            # Wait 5 seconds before next attempt
            sleep 5
          done

          # Show full container logs for debugging and verify startup work ran exactly once
          echo "📋 Full container logs:"
          CONTAINER_LOGS="$(docker logs formbricks-test 2>&1)"
          echo "$CONTAINER_LOGS"

          assert_log_once() {
            local message="$1"
            local count
            count="$(grep -Fc "$message" <<<"$CONTAINER_LOGS" || true)"
            if [ "$count" -ne 1 ]; then
              echo "Expected '$message' exactly once, found $count occurrences"
              exit 1
            fi
          }

          assert_log_once "Environment variables validated successfully"
          assert_log_once "Running database migrations"
          assert_log_once "Running SAML database setup"

          # Clean up the container
          echo "🧹 Cleaning up..."
          docker rm -f formbricks-test

          # Exit with failure if health check did not succeed
          if [ "$HEALTH_CHECK_SUCCESS" != "true" ]; then
            echo "❌ Health check failed after $((MAX_RETRIES * 5)) seconds (5 minutes)"
            exit 1
          fi

          echo "✨ Docker validation complete - all checks passed!"