From 3122ca76053eb75efd8fddbb5ef955c925e84af7 Mon Sep 17 00:00:00 2001
From: Shane Maynard <snowspeeder@gmail.com>
Date: Thu, 1 Oct 2026 16:19:58 -0400
Subject: [PATCH] fix: validate host certificates through Docker in CI

---
 scripts/deploy-unraid.sh | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/scripts/deploy-unraid.sh b/scripts/deploy-unraid.sh
index c568d94..2609a6f 100644
--- a/scripts/deploy-unraid.sh
+++ b/scripts/deploy-unraid.sh
@@ -7,7 +7,14 @@ test -f "$ENV_FILE"
 test -d "$ROOT/accounts"
 test -d "$ROOT/hermes"
 test -f "$ROOT/livekit.yaml"
-test -d /mnt/user/dev/hope-voice-api/certs
+# CI runs inside a Docker-socket runner: host bind sources need not be visible
+# in its filesystem. --mount fails for a missing host source (unlike -v, which
+# would silently create it). Validate read-only through the host Docker daemon.
+if [ ! -d /mnt/user/dev/hope-voice-api/certs ]; then
+  docker run --rm --network none --entrypoint /usr/bin/test \
+    --mount type=bind,source=/mnt/user/dev/hope-voice-api/certs,target=/certs,readonly \
+    hope-voice-api-voice:latest -d /certs
+fi
 STAMP=$(date -u +%Y%m%dT%H%M%SZ)
 BACKUP="$ROOT/rollback/$STAMP"
 mkdir -p "$BACKUP"