---
name: VM runtime smoke

# yamllint disable-line rule:truthy
on:
  workflow_dispatch:

jobs:
  runtime:
    runs-on: [self-hosted, vm]
    steps:
      - name: Verify workload identity socket
        shell: bash
        run: |
          set -euo pipefail
          : "${SPIFFE_ENDPOINT_SOCKET:?SPIFFE_ENDPOINT_SOCKET is required}"
          socket_path=${SPIFFE_ENDPOINT_SOCKET#unix://}
          test -S "$socket_path"

      - name: Verify Docker daemon
        shell: bash
        run: |
          set -euo pipefail
          format='{{json .ServerVersion}} {{json .Driver}}'
          format="$format {{json .CgroupVersion}}"
          docker info --format "$format"

      - name: Run and clean nested container
        shell: bash
        run: |
          set -euo pipefail
          name=vm-runtime-smoke
          trap 'docker rm --force "$name" >/dev/null 2>&1 || true' EXIT
          output=$(docker run --name "$name" alpine:3.22 /bin/sh -c \
            'test "$(uname -m)" = x86_64 && printf vm-runtime-ok')
          test "$output" = vm-runtime-ok