name: release-isolation-portfolio
'on':
  push:
    branches:
    - ops/release-isolation-20261112
jobs:
  baseline:
    runs-on: diag-portfolio-runner
    timeout-minutes: 5
    steps:
    - name: Provar isolamento efetivo
      run: "node <<'JS'\nconst fs = require('node:fs');\nfor (const p of ['/var/run/docker.sock',\
        \ '/run/docker.sock']) {\n  if (fs.existsSync(p)) throw Error('Docker socket\
        \ exposto: ' + p);\n}\nif (process.env.DOCKER_HOST) throw Error('DOCKER_HOST\
        \ exposto');\nconst status = fs.readFileSync('/proc/self/status', 'utf8');\n\
        const cap = BigInt('0x' + status.match(/^CapEff:\\s*([0-9a-f]+)/m)[1]);\n\
        const forbidden = [16n, 17n, 19n, 21n].reduce((m,b) => m | (1n << b), 0n);\n\
        if (cap & forbidden) throw Error('Capacidades privilegiadas expostas');\n\
        console.log('ISOLATION_OK socket=absent privileged=false runner=' + process.env.RUNNER_NAME);\n\
        JS\n"
  privileged:
    runs-on: diag-portfolio-runner
    timeout-minutes: 5
    container:
      image: docker.gitea.com/runner-images:ubuntu-latest
      options: --privileged
    steps:
    - name: Recusar elevação solicitada pelo workflow
      run: 'node <<''JS''

        const fs = require(''node:fs'');

        if (fs.existsSync(''/var/run/docker.sock'')) throw Error(''Docker socket exposto'');

        const s = fs.readFileSync(''/proc/self/status'', ''utf8'');

        const cap = BigInt(''0x'' + s.match(/^CapEff:\s*([0-9a-f]+)/m)[1]);

        const forbidden = [16n, 17n, 19n, 21n].reduce((m,b) => m | (1n << b), 0n);

        if (cap & forbidden) throw Error(''Workflow conseguiu --privileged'');

        console.log(''PRIVILEGED_DENIED runner='' + process.env.RUNNER_NAME);

        JS

        '
  socket-bind:
    runs-on: diag-portfolio-runner
    timeout-minutes: 5
    container:
      image: docker.gitea.com/runner-images:ubuntu-latest
      options: --volume=/var/run/docker.sock:/var/run/docker.sock
    steps:
    - name: Recusar bind solicitado pelo workflow
      run: 'node -e "if(require(''node:fs'').existsSync(''/var/run/docker.sock''))throw
        Error(''Socket bind permitido'');console.log(''SOCKET_BIND_DENIED'')"

        '