# TEMPORARY probe workflow (R-168, Part 0). DELETED before this session ends — if you are reading
# this on main, teardown was missed. Measures P1 (a runner picks a job up at all), P2 in situ
# (python3+git inside the job, not just inside the image), P3 (source without any JavaScript
# action), and Scenario E's negative (docker must NOT be reachable).
name: probe
on: [push]
jobs:
  probe:
    runs-on: felhom-gates
    steps:
      - name: P1 - the job runs at all
        run: echo "P1-OK runner picked up the job"

      - name: P2 in situ - tools visible to the JOB, not just the image
        run: |
          echo -n "P2 python3: "; python3 --version
          echo -n "P2 git:     "; git --version

      - name: P3 - obtain the source with no JavaScript action step
        run: |
          echo "P3 pushed sha = $GITHUB_SHA"
          git clone -q http://gitea.gitea-system.svc.cluster.local:3000/admin/felhom.eu.git src
          cd src && git checkout -q "$GITHUB_SHA"
          echo "P3 checked-out sha = $(git rev-parse HEAD)"
          test "$(git rev-parse HEAD)" = "$GITHUB_SHA" && echo "P3-OK checkout equals pushed commit" || { echo "P3-FAIL"; exit 1; }

      - name: Scenario E - docker MUST be unreachable
        run: |
          if docker ps 2>&1; then echo "E-FAIL docker reachable from the job"; exit 1; fi
          echo "E-OK docker refused (output above is the refusal)"