name: Sandbox Image Smoke

# Real-image validation of the Docker sandbox hardening. The job preserves
# baseline coverage for the repository-configured/default AIO image and also
# exercises the 1.11.0 startup path that requires FOWNER for chmod on
# /run/user/1000. The offline unit suite (-m "not live") never runs these.
#
# Reproducibility: SANDBOX_SMOKE_IMAGE can pin the baseline image. Both that
# image (or the :latest fallback) and the explicit 1.11.0 regression image are
# pulled first and converted to immutable repo@sha256 references; the exact
# digests are printed to the job summary before either live test runs.

on:
  workflow_dispatch:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
    paths:
      - 'backend/packages/harness/deerflow/community/aio_sandbox/**'
      - 'backend/tests/test_aio_sandbox_local_backend.py'
      - '.github/workflows/sandbox-image-smoke.yml'

concurrency:
  group: sandbox-image-smoke-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  sandbox-image-smoke:
    runs-on: ubuntu-latest
    timeout-minutes: 25
    env:
      SANDBOX_SMOKE_IMAGE_REF: ${{ vars.SANDBOX_SMOKE_IMAGE || 'enterprise-public-cn-beijing.cr.volces.com/vefaas-public/all-in-one-sandbox:latest' }}
      FOWNER_SMOKE_IMAGE_REF: ${{ vars.SANDBOX_FOWNER_SMOKE_IMAGE || 'enterprise-public-cn-beijing.cr.volces.com/vefaas-public/all-in-one-sandbox:1.11.0' }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Resolve immutable image references for this run
        # Pull on the runner's platform, then pass only immutable repo@sha256
        # references to pytest. This keeps both the baseline and the 1.11.0
        # regression run reproducible even if either source tag moves later.
        run: |
          set -euo pipefail

          resolve_image() {
            local source_ref="$1"
            local output_var="$2"
            local label="$3"
            local repo_digest

            docker pull "$source_ref" >/dev/null
            repo_digest="$(docker image inspect "$source_ref" --format '{{index .RepoDigests 0}}')"
            echo "$output_var=$repo_digest" >> "$GITHUB_ENV"
            printf '%s: `%s`\n' "$label" "$repo_digest" | tee -a "$GITHUB_STEP_SUMMARY"
          }

          resolve_image "$SANDBOX_SMOKE_IMAGE_REF" DEER_FLOW_SANDBOX_SMOKE_IMAGE "Configured/default smoke image"
          resolve_image "$FOWNER_SMOKE_IMAGE_REF" DEER_FLOW_SANDBOX_FOWNER_SMOKE_IMAGE "FOWNER regression image (1.11.0)"

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.12'

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          # Must match backend/Dockerfile's UV_IMAGE tag; pinned by backend/tests/test_ci_uv_version_pin.py
          version: "0.11.1"

      - name: Install backend dependencies
        working-directory: backend
        run: uv sync --group dev

      - name: Run the live real-image smoke tests
        working-directory: backend
        run: uv run pytest -m live tests/test_aio_sandbox_local_backend.py -v