From a37867b94905b00b4da618d0521c281ce1aee504 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Mon, 17 Aug 2026 16:16:47 +0100
Subject: [PATCH] diag: add minimal Forgejo Actions diagnostic workflow

Probes the runner setup so we can tell whether the release.yml
failure is upstream of our workflow (no runner, no network, no
tooling) or specific to a step.

- Container reachable + image usable
- DNS + outbound HTTPS to forgejo.pschneider.fr and hub.docker.com
- Required tooling available (git, dotnet, jq, curl, make, debhelper,
  imagemagick)
- forgejo.* context populated
- secrets.GITHUB_TOKEN resolves (FORGEJO_TOKEN populated)
- API call with the token returns 200 on /repos/<repo>

Will be removed once we've confirmed the runner is healthy.
---
 .forgejo/workflows/diag.yml | 74 +++++++++++++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100644 .forgejo/workflows/diag.yml

diff --git a/.forgejo/workflows/diag.yml b/.forgejo/workflows/diag.yml
new file mode 100644
index 0000000..3e1ef88
--- /dev/null
+++ b/.forgejo/workflows/diag.yml
@@ -0,0 +1,74 @@
+name: diag
+
+# Diagnostic minimal : vérifie que le runner Forgejo démarre, qu'il
+# peut cloner, et qu'il a accès à Internet + Docker (pour le label
+# docker:// sur lequel tournent nos jobs).
+#
+# À supprimer une fois qu'on a confirmé que le runner est OK.
+
+on:
+  workflow_dispatch:
+
+jobs:
+  diag:
+    runs-on: docker
+    container:
+      image: docker.io/pazof/yavsc-build-env:debian12-dotnet10-android36-v2
+    steps:
+      - name: Hello
+        run: |
+          echo "Runner started, container is alive."
+          echo "Image: $(cat /etc/os-release | grep PRETTY_NAME)"
+          echo "Hostname: $(hostname)"
+          echo "User: $(whoami)"
+          echo "Working dir: $(pwd)"
+
+      - name: Network check
+        run: |
+          echo "--- DNS resolution ---"
+          getent hosts forgejo.pschneider.fr || echo "FAIL: cannot resolve forgejo.pschneider.fr"
+          echo "--- HTTP outbound ---"
+          curl -sS -o /dev/null -w "forgejo.pschneider.fr HTTP %{http_code} (%{time_total}s)\n" \
+            https://forgejo.pschneider.fr/ || echo "FAIL: cannot reach forgejo.pschneider.fr"
+          echo "--- Docker Hub ---"
+          curl -sS -o /dev/null -w "hub.docker.com HTTP %{http_code}\n" \
+            https://hub.docker.com/ || echo "FAIL: cannot reach hub.docker.com"
+
+      - name: Tooling check
+        run: |
+          echo "--- git ---"
+          git --version
+          echo "--- dotnet ---"
+          dotnet --info | head -5
+          echo "--- jq ---"
+          jq --version
+          echo "--- curl ---"
+          curl --version | head -1
+          echo "--- make ---"
+          make --version | head -1
+          echo "--- debhelper ---"
+          which dh || echo "FAIL: dh not found (debhelper absent)"
+          echo "--- imagemagick ---"
+          which convert || echo "FAIL: convert not found"
+
+      - name: Forgejo context probe
+        env:
+          FORGEJO_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+        run: |
+          echo "--- forgejo.* context ---"
+          echo "forgejo.ref_name=[${{ forgejo.ref_name }}]"
+          echo "forgejo.repository=[${{ forgejo.repository }}]"
+          echo "forgejo.api_url=[${{ forgejo.api_url }}]"
+          echo "--- secrets.GITHUB_TOKEN probe ---"
+          if [[ -n "$FORGEJO_TOKEN" ]]; then
+            echo "FORGEJO_TOKEN is set (length=${#FORGEJO_TOKEN})"
+          else
+            echo "FORGEJO_TOKEN is EMPTY — secrets.GITHUB_TOKEN did not resolve"
+          fi
+          echo "--- API reachability via FORGEJO_TOKEN ---"
+          if [[ -n "$FORGEJO_TOKEN" ]]; then
+            HTTP=$(curl -sS -o /dev/null -w '%{http_code}' \
+              -H "Authorization: token $FORGEJO_TOKEN" \
+              "${{ forgejo.api_url }}/repos/${{ forgejo.repository }}")
+            echo "GET /repos/${{ forgejo.repository }} -> HTTP $HTTP"
+          fi
\ No newline at end of file