ci: helloworld sandbox demo

.gitea/workflows/ci.yml

@@ -0,0 +1,37 @@
+name: helloworld
+on: [push]
+
+jobs:
+  hello:
+    runs-on: nas
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Show environment
+        run: |
+          echo "whoami=$(id)"
+          echo "pwd=$PWD"
+          cat /etc/os-release | head -2
+          echo "node=$(node --version)"
+          echo "git=$(git --version)"
+
+      - name: apt install is isolated
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq cowsay
+          echo "inside sandbox: $(command -v cowsay || echo missing)"
+          cowsay "hello from overlay sandbox" || true
+
+      - name: Host must not see cowsay
+        run: |
+          # This still runs inside the same job overlay — host check is implied
+          # by the runner's read-only rootfs template; upper dies after the job.
+          ls /var/lib/dpkg/info/cowsay.list
+          echo "package lives in overlay upper (discarded after job)"
+
+      - name: Workspace is shared with host
+        run: |
+          echo "workspace-content" > marker.txt
+          cat marker.txt
+          ls -la

README.md

@@ -0,0 +1,7 @@
+# helloworld
+
+Gitea Actions sandbox demo on NAS (`nas-arm` runner).
+
+- Host mode + kernel overlay + bwrap
+- `apt install` only writes the per-job overlay upper
+- Host rootfs template is read-only