From bbd62319096a1fb92f72218a28756e6fa101e87b Mon Sep 17 00:00:00 2001
From: kisfenyo <nagyfenyvesi.viktor@gmail.com>
Date: Sun, 2 Aug 2026 16:16:59 +0200
Subject: [PATCH] probe: temporary CI workflow for R-168 Part 0 (P1/P2/P3 +
 Scenario E)

TEMPORARY. Deleted before the session ends. Measures whether a registered runner picks up
a job at all, whether python3 and git are visible to the JOB (not merely present in the
image), whether the source can be obtained with no JavaScript action, and that docker is
NOT reachable from a job.
---
 .gitea/workflows/probe.yml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 .gitea/workflows/probe.yml

diff --git a/.gitea/workflows/probe.yml b/.gitea/workflows/probe.yml
new file mode 100644
index 0000000..9b91c18
--- /dev/null
+++ b/.gitea/workflows/probe.yml
@@ -0,0 +1,30 @@
+# TEMPORARY probe workflow (R-168, Part 0). DELETED before this session ends — if you are reading
+# this on main, teardown was missed. Measures P1 (a runner picks a job up at all), P2 in situ
+# (python3+git inside the job, not just inside the image), P3 (source without any JavaScript
+# action), and Scenario E's negative (docker must NOT be reachable).
+name: probe
+on: [push]
+jobs:
+  probe:
+    runs-on: felhom-gates
+    steps:
+      - name: P1 - the job runs at all
+        run: echo "P1-OK runner picked up the job"
+
+      - name: P2 in situ - tools visible to the JOB, not just the image
+        run: |
+          echo -n "P2 python3: "; python3 --version
+          echo -n "P2 git:     "; git --version
+
+      - name: P3 - obtain the source with no JavaScript action step
+        run: |
+          echo "P3 pushed sha = $GITHUB_SHA"
+          git clone -q http://gitea.gitea-system.svc.cluster.local:3000/admin/felhom.eu.git src
+          cd src && git checkout -q "$GITHUB_SHA"
+          echo "P3 checked-out sha = $(git rev-parse HEAD)"
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA" && echo "P3-OK checkout equals pushed commit" || { echo "P3-FAIL"; exit 1; }
+
+      - name: Scenario E - docker MUST be unreachable
+        run: |
+          if docker ps 2>&1; then echo "E-FAIL docker reachable from the job"; exit 1; fi
+          echo "E-OK docker refused (output above is the refusal)"