name: helloworld
on: [push]

jobs:
  hello:
    runs-on: nas
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Show environment
        run: |
          echo "whoami=$(id)"
          echo "pwd=$PWD"
          cat /etc/os-release | head -2
          echo "node=$(node --version)"
          echo "git=$(git --version)"

      - name: apt install is isolated
        run: |
          apt-get update -qq
          apt-get install -y -qq cowsay
          echo "inside sandbox: $(command -v cowsay || echo missing)"
          cowsay "hello from overlay sandbox" || true

      - name: Host must not see cowsay
        run: |
          # This still runs inside the same job overlay — host check is implied
          # by the runner's read-only rootfs template; upper dies after the job.
          ls /var/lib/dpkg/info/cowsay.list
          echo "package lives in overlay upper (discarded after job)"

      - name: Workspace is shared with host
        run: |
          echo "workspace-content" > marker.txt
          cat marker.txt
          ls -la