name: Runner Docker diagnostic

on:
  push:
    branches:
      - chatgpt/geointel-hardening-20260826

permissions:
  contents: read

jobs:
  diagnostic:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      DOCKER_HOST: tcp://gitea-runner-dind:2375
      DOCKER_TLS_CERTDIR: ""
    steps:
      - name: Verify isolated shared runner daemon
        shell: bash
        run: |
          set -euo pipefail
          docker info >/tmp/docker-info.txt
          docker version

          mapfile -t visible_names < <(docker ps -a --format '{{.Names}}')
          echo "visible-container-count=${#visible_names[@]}"
          for name in "${visible_names[@]}"; do
            case "$name" in
              GITEA-ACTIONS-TASK-*) ;;
              *)
                echo "Unexpected non-Actions container visible: $name" >&2
                exit 1
                ;;
            esac
          done

          workdir="$(mktemp -d)"
          printf 'geo-intel-ci\n' > "${workdir}/proof.txt"
          cat > "${workdir}/Dockerfile" <<'EOF'
          FROM scratch
          COPY proof.txt /proof.txt
          EOF
          tag="geointel-runner-diagnostic:${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-1}"
          docker build --pull=false -t "$tag" "${workdir}"
          docker image inspect "$tag" --format '{{.Id}}'
          docker image rm "$tag" >/dev/null