# Canonical CI smoke template (tier 1 routing drill).
# Copy to: .forgejo/workflows/ci-smoke.yaml in consumer repos.
name: CI Smoke

on:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  source-contract:
    # The host lane is intentionally minimal and does not provide the Node
    # runtime required by actions/checkout. Run source validation in the
    # documented disposable container lane instead.
    runs-on: ubuntu-latest
    steps:
      - name: Check out source
        uses: actions/checkout@v4
      - name: Prepare source-contract runtime
        run: |
          set -eu
          apt-get update
          apt-get install -y --no-install-recommends age make python3 python3-yaml
      - name: Validate S1 source contracts
        run: |
          set -eu
          python3 -c 'import yaml'
          python3 scripts/inventory_contract.py
          python3 scripts/baseline_contract.py --check-repo
          python3 scripts/handoff_contract.py
          python3 scripts/sops_rotation.py --check
          python3 scripts/s1_receipt.py docs/evidence/s1-receipts/*.json
          python3 scripts/s1_backup.py check
          python3 -m unittest discover -s tests -v
          make check-secrets

  host-smoke:
    runs-on: self-hosted
    steps:
      - name: Routing probe (host runner)
        run: |
          set -eu
          echo "repository=${GITHUB_REPOSITORY:-unknown}"
          echo "sha=${GITHUB_SHA:-unknown}"
          echo "runner=${RUNNER_NAME:-unknown}"
          uname -a

  container-smoke:
    runs-on: ubuntu-latest
    steps:
      - name: Routing probe (container label)
        run: |
          set -eu
          echo "container-smoke ok for ${GITHUB_REPOSITORY:-unknown}"