From 3d787b2dd3f9d64be75f34b0b5489fec131b2462 Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Mon, 21 Sep 2026 10:37:14 +0000
Subject: [PATCH] =?UTF-8?q?ci:=20=E5=A2=9E=E5=8A=A0=20VM=20runtime=20?=
 =?UTF-8?q?=E6=9C=80=E5=B0=8F=E9=9B=86=E6=88=90=E6=B5=8B=E8=AF=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/vm-runtime-smoke.yml | 35 +++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 .gitea/workflows/vm-runtime-smoke.yml

diff --git a/.gitea/workflows/vm-runtime-smoke.yml b/.gitea/workflows/vm-runtime-smoke.yml
new file mode 100644
index 0000000..3e2421c
--- /dev/null
+++ b/.gitea/workflows/vm-runtime-smoke.yml
@@ -0,0 +1,35 @@
+---
+name: VM runtime smoke
+
+# yamllint disable-line rule:truthy
+on:
+  workflow_dispatch:
+
+jobs:
+  runtime:
+    runs-on: [self-hosted, vm-dev]
+    steps:
+      - name: Verify workload identity socket
+        shell: bash
+        run: |
+          set -euo pipefail
+          : "${SPIFFE_ENDPOINT_SOCKET:?SPIFFE_ENDPOINT_SOCKET is required}"
+          test -S "$SPIFFE_ENDPOINT_SOCKET"
+
+      - name: Verify Docker daemon
+        shell: bash
+        run: |
+          set -euo pipefail
+          format='{{json .ServerVersion}} {{json .Driver}}'
+          format="$format {{json .CgroupVersion}}"
+          docker info --format "$format"
+
+      - name: Run and clean nested container
+        shell: bash
+        run: |
+          set -euo pipefail
+          name=vm-runtime-smoke
+          trap 'docker rm --force "$name" >/dev/null 2>&1 || true' EXIT
+          output=$(docker run --name "$name" alpine:3.22 /bin/sh -c \
+            'test "$(uname -m)" = x86_64 && printf vm-runtime-ok')
+          test "$output" = vm-runtime-ok