name: SPIRE identity smoke

on:
  workflow_dispatch:

jobs:
  jwt-svid:
    runs-on: [self-hosted, pod]
    steps:
      - name: Verify bundled SPIRE CLI
        shell: bash
        run: |
          set -euo pipefail
          command -v spire-agent
          spire-agent -version

      - name: Fetch short-lived zot JWT-SVID
        shell: bash
        run: |
          set -euo pipefail
          spire-agent api fetch jwt \
            -audience zot \
            -socketPath /run/spire/agent-sockets/spire-agent.sock \
            >/dev/null