name: Runner Docker diagnostic

on:
  push:
    branches:
      - chatgpt/geointel-hardening-20260826

permissions:
  contents: read

jobs:
  diagnostic:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    services:
      docker:
        image: docker@sha256:7c3e797187e43738220462658f4586572cbd3bf009f728b21e34d9c5c06ce431
        env:
          DOCKER_TLS_CERTDIR: ""
        options: --privileged
    env:
      DOCKER_HOST: tcp://docker:2375
      DOCKER_TLS_CERTDIR: ""
    steps:
      - name: Verify job-private Docker daemon
        shell: bash
        run: |
          set -euo pipefail
          echo "DOCKER_HOST=${DOCKER_HOST}"
          for attempt in $(seq 1 30); do
            if docker info >/tmp/docker-info.txt 2>&1; then
              break
            fi
            if [[ "$attempt" -eq 30 ]]; then
              cat /tmp/docker-info.txt
              exit 1
            fi
            sleep 1
          done
          docker version
          initial_containers="$(docker ps -aq | wc -l)"
          echo "initial-containers=${initial_containers}"
          test "${initial_containers}" -eq 0

          workdir="$(mktemp -d)"
          printf 'geo-intel-ci\n' > "${workdir}/proof.txt"
          cat > "${workdir}/Dockerfile" <<'EOF'
          FROM scratch
          COPY proof.txt /proof.txt
          EOF
          docker build --pull=false -t geointel-runner-diagnostic:local "${workdir}"
          docker image inspect geointel-runner-diagnostic:local --format '{{.Id}}'
          docker image rm geointel-runner-diagnostic:local >/dev/null