name: Runner Docker diagnostic

on:
  push:
    branches:
      - chatgpt/geointel-hardening-20260826

permissions:
  contents: read

jobs:
  diagnostic:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Inspect isolated Docker executor connectivity
        shell: bash
        run: |
          set -u
          echo "DOCKER_HOST=${DOCKER_HOST:-<unset>}"
          echo "DOCKER_TLS_VERIFY=${DOCKER_TLS_VERIFY:-<unset>}"
          echo "DOCKER_CERT_PATH=${DOCKER_CERT_PATH:-<unset>}"
          for socket_path in /var/run/docker.sock /run/user/1000/docker.sock /var/run/user/1000/docker.sock; do
            if [[ -S "${socket_path}" ]]; then
              echo "socket:${socket_path}=present"
            else
              echo "socket:${socket_path}=absent"
            fi
          done
          cat /proc/net/route || true
          python - <<'PY'
          import socket
          import struct
          names = ("gitea-runner-dind", "docker", "host.docker.internal")
          for name in names:
              try:
                  print(f"dns:{name}={socket.gethostbyname(name)}")
              except OSError as exc:
                  print(f"dns:{name}=unresolved:{type(exc).__name__}")
          gateway = None
          try:
              with open("/proc/net/route", encoding="ascii") as handle:
                  next(handle, None)
                  for line in handle:
                      fields = line.split()
                      if len(fields) >= 3 and fields[1] == "00000000":
                          gateway = socket.inet_ntoa(struct.pack("<L", int(fields[2], 16)))
                          break
          except OSError:
              pass
          if gateway:
              print(f"default-gateway={gateway}")
          hosts = ["gitea-runner-dind", "docker", "host.docker.internal"]
          if gateway:
              hosts.append(gateway)
          for host in hosts:
              for port in (2375, 2376):
                  try:
                      with socket.create_connection((host, port), timeout=1.0):
                          print(f"tcp:{host}:{port}=reachable")
                  except OSError as exc:
                      print(f"tcp:{host}:{port}=unreachable:{type(exc).__name__}")
          PY
          docker version >/tmp/docker-version.txt 2>&1 || true
          sed -n '1,40p' /tmp/docker-version.txt