name: ci
on:
  push:
    branches: [main]
  pull_request:
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: shellcheck
        # -x follows `source`/`.` directives; box has no lib split today, but the
        # flag costs nothing and keeps the invocation identical to rig's.
        # globstar so a script in a new subdirectory is linted without anyone
        # remembering to edit this list; bin/* covers the extensionless entrypoint
        # (bin/box). The file list is printed so under-coverage shows up in the log.
        run: |
          shopt -s globstar
          files=(bin/* **/*.sh)
          printf 'shellcheck: %s\n' "${files[@]}"
          shellcheck -x "${files[@]}"
      - name: cli tests
        run: bash test/cli.sh
      - name: labels state-machine tests
        run: bash test/labels-reconcile.sh

  # The multi-user rehearsal, on a REAL incus — a GitHub runner is root on a
  # disposable VM, which is exactly the substrate the rehearsal needs. It runs
  # in container mode: the tier's mechanics (grant, confinement, the network
  # contract, revoke) are identical for containers and VMs — the nft bridge
  # drop, the ACL, dns.mode=none and port_isolation all bind to boxnet, not
  # to the instance type. What container mode canNOT validate is the VM trust
  # boundary itself; that stays a real-hardware ritual (drill/RUNS.md), same
  # as the full drill. So: every PR proves the tier's semantics, and a
  # release still proves the boundary.
  rehearsal:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
      - name: install incus
        run: |
          sudo apt-get update
          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y incus
      - name: global install, from this checkout (the #71 layout)
        # Not install.sh: it installs a RELEASE (REPO@REF), and CI must prove
        # the code under review. Same tree, same layout, same a+rX.
        run: |
          sudo cp -r . /opt/box
          sudo rm -rf /opt/box/.git
          sudo chmod -R a+rX /opt/box
          sudo ln -sf /opt/box/bin/box /usr/local/bin/box
      - name: setup-host
        run: sudo bash /opt/box/host/setup-host.sh
      - name: doctor — the baseline is provable before anything is judged
        run: sudo BOX_TIER=admin bash /opt/box/drill/doctor.sh
      - name: multi-user rehearsal (criteria a-l, container mode)
        run: sudo BOX_MULTIUSER_REHEARSAL=1 bash /opt/box/drill/multiuser.sh --yes --container

  # NOT run here: the full drill (drill/drill.sh). It rehearses the whole
  # surface — cold template mints, expose, migration — and wants a real host
  # and the better part of an hour. The rehearsal job above is the CI-shaped
  # slice of the same discipline: isolation claims are still tested on a real
  # daemon, never reasoned about (docs/box-design.md).