# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

name: Windows sandbox W0 evidence

# The paths below are a pre-filter, not this lane's real input. The real input
# is the import closure of the sandbox and filesystem-worker sources, which
# reaches well past any list worth hand-maintaining. So they name the
# directories that own the sandbox, which keeps a change there blocking before
# merge, and the nightly run is what covers transitive edits once they land.
on:
  pull_request:
    paths:
      - 'experiments/windows-sandbox/**'
      - 'packages/runtime/src/sandbox/**'
      - 'packages/runtime/src/filesystem-worker/**'
      - 'packages/runtime/src/__tests__/filesystem-worker-windows-smoke.test.ts'
      - '.github/workflows/windows-sandbox-w0.yml'
  schedule:
    # Offset from windows-baseline so the two Windows lanes do not overlap.
    - cron: '17 7 * * *'
  workflow_dispatch:

permissions:
  contents: read

# Pull request pushes supersede each other. Scheduled and manual runs each get
# a unique group, so neither can discard the other while pending or running.
concurrency:
  group: windows-sandbox-w0-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  protocol:
    name: windows_sandbox_w0_protocol
    runs-on: windows-2025
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          cache: npm
      - id: rustc
        name: Resolve Rust cache version
        shell: bash
        run: |
          echo "version=$(rustc --version | cut -d ' ' -f 2)" >> "$GITHUB_OUTPUT"
          echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
          {
            echo "KACHE_CACHE_DIR=${{ runner.temp }}/kache"
            echo "KACHE_RUNTIME_DIR=${{ runner.temp }}/kache-runtime"
            echo "RUSTC_WRAPPER=kache"
          } >> "$GITHUB_ENV"
      - name: Install Kache
        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2
        with:
          tool: kache@0.16.0
      - id: kache-cache
        name: Restore Rust build cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ runner.temp }}/kache
          key: kache-windows-sandbox-launcher-v0.16.0-${{ runner.os }}-${{ runner.arch }}-rust-${{ steps.rustc.outputs.version }}-${{ steps.rustc.outputs.revision }}
          restore-keys: |
            kache-windows-sandbox-launcher-v0.16.0-${{ runner.os }}-${{ runner.arch }}-rust-${{ steps.rustc.outputs.version }}-
      - name: Record atomic launcher capability
        shell: pwsh
        run: ./experiments/windows-sandbox/atomic-launch-capability.ps1

      - name: Build process-containment launcher
        working-directory: experiments/windows-sandbox/launcher
        run: cargo build --locked
      # Rust is the shipped protocol authority. Its tests consume the exact
      # manifest structs used by the broker instead of a parallel MJS parser.
      - name: Verify launcher protocol and broker authorization
        working-directory: experiments/windows-sandbox/launcher
        run: cargo test --locked
      - name: Report Rust build cache
        shell: bash
        run: kache report --format github >> "$GITHUB_STEP_SUMMARY"
      - name: Save Rust build cache
        if: github.ref_name == github.event.repository.default_branch
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ runner.temp }}/kache
          key: ${{ steps.kache-cache.outputs.cache-primary-key }}
      - name: Verify secure broker pipe
        shell: pwsh
        run: ./experiments/windows-sandbox/broker-pipe-smoke.ps1
      - name: Verify broker client handoff
        shell: pwsh
        run: ./experiments/windows-sandbox/broker-client-smoke.ps1
      - name: Verify one-shot local broker lifecycle
        shell: pwsh
        run: ./experiments/windows-sandbox/broker-local-smoke.ps1
      - name: Verify AppContainer identity candidate
        shell: pwsh
        run: ./experiments/windows-sandbox/appcontainer-smoke.ps1
      - name: Verify production-identity readiness probe
        shell: pwsh
        run: ./experiments/windows-sandbox/readiness-probe-smoke.ps1
      - name: Verify filesystem-worker stdio relay
        shell: pwsh
        run: ./experiments/windows-sandbox/stdio-relay-smoke.ps1
      - name: Verify ACL grant recovery
        shell: pwsh
        run: ./experiments/windows-sandbox/acl-recovery-smoke.ps1
      - name: Probe atomic Job launch candidate
        shell: pwsh
        run: ./experiments/windows-sandbox/atomic-launch-smoke.ps1
      - name: Probe unprivileged restricted-token candidate
        shell: pwsh
        run: ./experiments/windows-sandbox/launcher-smoke.ps1

      - name: Install workspace dependencies
        run: npm ci
      # The runtime's tsc build resolves types from its workspace dependencies'
      # dist output, so each dependency builds first in topological order.
      - name: Build core workspace
        run: npm run build --workspace @maka/core
      - name: Build storage workspace
        run: npm run build --workspace @maka/storage
      - name: Build runtime workspace
        run: npm run build --workspace @maka/runtime
      - name: Run real filesystem-worker operations through the broker
        run: node --test packages/runtime/dist/__tests__/filesystem-worker-windows-smoke.test.js