feat: let a bake reach more than one service

.github/workflows/deploy-docs.yml

@@ -62,7 +62,8 @@ jobs:
       - name: Bake the docs site
         uses: $/actions/bake
         with:
-          host-alias: ${{ steps.renderer.outputs.address }}
+          hosts: |
+            host.docker.internal=${{ steps.renderer.outputs.address }}
           source: docs
           output: dist
           image: wikven

.github/workflows/pr-preview.yml

@@ -75,7 +75,8 @@ jobs:
         if: github.event.action != 'closed'
         uses: $/actions/bake
         with:
-          host-alias: ${{ steps.renderer.outputs.address }}
+          hosts: |
+            host.docker.internal=${{ steps.renderer.outputs.address }}
           source: docs
           output: dist
           image: wikven

actions/bake/action.yml

@@ -46,13 +46,15 @@ inputs:
       that runs out of it renders one at a time with "1". Left unset the build
       counts the processors it is allowed and uses one pass per processor.
     default: ""
-  host-alias:
+  hosts:
     description: >-
-      What the bake should find host.docker.internal at: a service a site points
-      MediaWiki at for the length of a build, such as Extension:Chart's renderer.
-      The Docker host by default, which is where such a service usually runs; an
-      address instead where it runs somewhere the host is not.
-    default: host-gateway
+      Where the bake should find the services a site points MediaWiki at for the
+      length of a build, such as Extension:Chart's renderer or a Shellbox with
+      LilyPond in it. One "name=address" per line, naming each as the site's
+      configuration file names it. The default sends host.docker.internal to the
+      Docker host, which is where such a service usually runs; a site with two of
+      them gives each a line, because one name reaches one address.
+    default: host.docker.internal=host-gateway
 
 runs:
   using: composite
@@ -97,7 +99,7 @@ runs:
         FETCH_KEY: ${{ steps.fetch-cache-key.outputs.key }}
         SOURCE_DATE_EPOCH_IN: ${{ inputs.source-date-epoch }}
         JOBS: ${{ inputs.jobs }}
-        HOST_ALIAS: ${{ inputs.host-alias }}
+        HOSTS: ${{ inputs.hosts }}
       run: |
         # A value neither "true" nor "false" used to read as "false", so `cache: npm` -- the
         # spelling setup-node and setup-python take, where the value names what to cache -- turned
@@ -151,6 +153,21 @@ runs:
         if [ -n "$JOBS" ]; then
           jobs=(-e "WIKVEN_BUILD_JOBS=$JOBS")
         fi
+        # One --add-host per line, blank lines passed over so a workflow can write the list with
+        # the block scalar that leaves a trailing newline. A line without "=" is a name with
+        # nowhere to go, and saying so beats a bake that cannot reach what the site asked for.
+        hosts=()
+        while IFS= read -r host; do
+          host=$(echo "$host" | tr -d '[:space:]')
+          case "$host" in
+            '') continue ;;
+            *=*) hosts+=(--add-host="${host%%=*}:${host#*=}") ;;
+            *)
+              echo "::error::wikven: 'hosts' takes \"name=address\" a line, and got \"$host\"."
+              exit 1
+              ;;
+          esac
+        done <<< "$HOSTS"
         # Mounted only where there is a key to cache it under, so a site with nothing pinned gets
         # no directory it never fills. The bake decides for itself whether what is in there still
         # answers the pins; a stale or half-written tree is refetched, not built from.
@@ -182,14 +199,14 @@ runs:
         # writable mount would let that code edit the checkout this job goes on to use. Only the
         # translate subcommands write into src/, and this action never runs one.
         #
-        # A service the site points MediaWiki at during the bake -- Chart's renderer is the first
-        # of them -- runs outside this container. --add-host is the daemon saying where, rather
-        # than a site committing an address into its config file and finding it means something
-        # else on the machine its author bakes from. It adds a line to /etc/hosts: a bake that
-        # fetches over the network could already reach the host, and this opens no port.
-        # --network=host would be a different matter and is not this.
+        # A service the site points MediaWiki at during the bake -- Chart's renderer, a Shellbox
+        # with LilyPond in it -- runs outside this container. --add-host is the daemon saying
+        # where, rather than a site committing an address into its config file and finding it
+        # means something else on the machine its author bakes from. It adds a line to /etc/hosts:
+        # a bake that fetches over the network could already reach the host, and this opens no
+        # port. --network=host would be a different matter and is not this.
         docker run --rm \
-          --add-host="host.docker.internal:$HOST_ALIAS" \
+          "${hosts[@]}" \
           -v "$PWD/$SOURCE:/workspace/src:ro" \
           -v "$PWD/$OUTPUT:/workspace/dist" \
           "${epoch[@]}" \

tests/e2e/citizen.spec.js

@@ -190,9 +190,22 @@ test("Citizen's view-source tab is a button a reader can hit", async ({
 	expect(mask, "the icon's mask image").toMatch(/^url\(/);
 
 	// And the button around it is the size of the ones beside it, rather than an empty sliver.
-	const box = await tab.locator("a").boundingBox();
-	const history = await page.locator("#ca-history a").boundingBox();
-	expect(box.width).toBeGreaterThanOrEqual(history.width * 0.9);
+	// Polled rather than measured the once: the skin sizes the page actions after the styles it
+	// is still fetching land, and a tab measured before that reads zero wide however right it
+	// goes on to be. The ratio is what is asserted either way.
+	await expect
+		.poll(
+			async () => {
+				const box = await tab.locator("a").boundingBox();
+				const history = await page.locator("#ca-history a").boundingBox();
+				if (!box || !history?.width) {
+					return 0;
+				}
+				return box.width / history.width;
+			},
+			{ message: "the view-source tab's width against the history tab's" },
+		)
+		.toBeGreaterThanOrEqual(0.9);
 });
 
 test("a Citizen page gets everything it asks for, and asks no backend", async ({