name: Sized Linux checks

on:
  push:
    branches: [main, sizequeen-scan-hardening]
    paths: ['Cargo.toml', 'Cargo.lock', 'CORE-SNAPSHOT.json', 'crates/**', 'src/**', 'tests/**', 'benches/**', 'scripts/**', '.gitea/workflows/**']
  pull_request:
    branches: [main]
    paths: ['Cargo.toml', 'Cargo.lock', 'CORE-SNAPSHOT.json', 'crates/**', 'src/**', 'tests/**', 'benches/**', 'scripts/**', '.gitea/workflows/**']
  workflow_dispatch:

permissions:
  contents: read

jobs:
  linux-amd64:
    name: Linux AMD64 / Rust 1.88.0
    # Keep the existing shared runner limited to owner-triggered, same-repo code.
    if: ${{ gitea.actor == 'gamertan' && (gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository) }}
    runs-on: himesan-node24
    timeout-minutes: 20
    container:
      image: sha256:271ca1d26057c95a6fd30df7ccc0c053ab394c0e81cd1e4efa182b5b0b60ee97
      options: >-
        --user 65532:65532
        --tmpfs /tmp/sized-mount-test:rw,nosuid,nodev,noexec,size=16m,uid=65532,gid=65532,mode=0700
        --tmpfs /tmp/sized-mount-test/foreign:rw,nosuid,nodev,noexec,size=16m,uid=65532,gid=65532,mode=0700
    env:
      CARGO_HOME: /tmp/sized-cargo
      CARGO_BUILD_JOBS: '2'
      SIZED_TEST_SOURCE: ${{ gitea.workspace }}
      SIZED_TEST_MOUNT_ROOT: /tmp/sized-mount-test
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          persist-credentials: false
      - name: Unprivileged Linux tests, real mount boundary, Clippy and release smoke
        run: ./scripts/check-linux-container.sh
      - name: Require an unchanged checkout
        run: test -z "$(git status --porcelain=v1 --untracked-files=all)"