ci: stream source into containers for source checks

.gitea/workflows/cicd-source-checks.yaml

@@ -193,14 +193,21 @@ jobs:
           echo "Verifying backend workspace before container run"
           ls -la backend | head -n 40
 
-          docker run --rm -v "$PWD:/workspace" -w /workspace/backend python:3.14-slim sh -euxc '
+          echo "Packaging backend source for container execution"
+          tar -czf /tmp/backend-src.tgz -C backend .
+
+          echo "Running backend checks in python:3.14-slim via streamed source archive"
+          docker run --rm -i python:3.14-slim sh -euxc '
+            mkdir -p /workspace/backend
+            tar -xzf - -C /workspace/backend
+            cd /workspace/backend
             test -f pyproject.toml
             python -m pip install --disable-pip-version-check --no-cache-dir uv
             uv sync --dev
             uv run ruff format --check .
             uv run ruff check .
             uv run pyright .
-          '
+          ' < /tmp/backend-src.tgz
 
       - *failure_diagnostics_step
 
@@ -269,14 +276,21 @@ jobs:
           echo "Verifying frontend workspace before container run"
           ls -la frontend | head -n 40
 
-          docker run --rm -v "$PWD:/workspace" -w /workspace/frontend node:24-bullseye sh -euxc '
+          echo "Packaging frontend source for container execution"
+          tar -czf /tmp/frontend-src.tgz -C frontend .
+
+          echo "Running frontend checks in node:24-bullseye via streamed source archive"
+          docker run --rm -i node:24-bullseye sh -euxc '
+            mkdir -p /workspace/frontend
+            tar -xzf - -C /workspace/frontend
+            cd /workspace/frontend
             test -f package.json
             corepack enable
             yarn install --immutable || yarn install
             yarn prettier --check src/
             yarn lint
             yarn type-check
-          '
+          ' < /tmp/frontend-src.tgz
 
       - *failure_diagnostics_step