name: Sandbox Common Smoke

on:
  push:
    branches: [main]
    paths:
      - scripts/docker/sandbox/Dockerfile
      - scripts/docker/sandbox/Dockerfile.common
      - scripts/sandbox-common-setup.sh
  pull_request:
    types: [opened, reopened, synchronize, ready_for_review, converted_to_draft]
    paths:
      - scripts/docker/sandbox/Dockerfile
      - scripts/docker/sandbox/Dockerfile.common
      - scripts/sandbox-common-setup.sh

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main') }}

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

jobs:
  sandbox-common-smoke:
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: blacksmith-16vcpu-ubuntu-2404
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          submodules: false

      - name: Set up Docker Builder
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

      - name: Build minimal sandbox base (USER sandbox)
        shell: bash
        run: |
          set -euo pipefail

          timeout --kill-after=30s 5m docker build -t openclaw-sandbox-smoke-base:bookworm-slim - <<'EOF'
          FROM debian:bookworm-slim
          RUN useradd --create-home --shell /bin/bash sandbox
          USER sandbox
          WORKDIR /home/sandbox
          EOF

      - name: Build sandbox-common image (root for installs, sandbox at runtime)
        shell: bash
        run: |
          set -euo pipefail

          BASE_IMAGE="openclaw-sandbox-smoke-base:bookworm-slim" \
            TARGET_IMAGE="openclaw-sandbox-common-smoke:bookworm-slim" \
            PACKAGES="ca-certificates" \
            INSTALL_BUN=0 \
            INSTALL_BREW=0 \
            FINAL_USER=sandbox \
            scripts/sandbox-common-setup.sh

          timeout --kill-after=30s 2m docker run --rm openclaw-sandbox-common-smoke:bookworm-slim sh -lc \
            'set -e; test "$(id -un)" = sandbox; node --version; pnpm --version'