name: Sandbox - ephemeral runner + shared cache
on:
  push:
    branches: [ci/sandbox]
  workflow_dispatch:

jobs:
  cargo:
    runs-on: sandbox
    defaults:
      run:
        working-directory: sandbox
        shell: bash
    steps:
      - uses: actions/checkout@v4

      - name: Where am I?
        run: |
          echo "runner : ${RUNNER_NAME}"
          echo "uid    : $(id -u)   cgroup: $(cut -d/ -f3 /proc/self/cgroup 2>/dev/null || echo n/a)"
          echo "cache  : ${ACTIONS_CACHE_URL:-unset}"

      # Restore first, so a warm cache also skips the toolchain download.
      - name: Cache rust toolchain, registry and target
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo
            ~/.rustup
            sandbox/target
          key: cargo-${{ hashFiles('sandbox/Cargo.lock') }}
          restore-keys: cargo-

      - name: Toolchain
        run: |
          set -euo pipefail
          if ! command -v cargo >/dev/null && [ ! -x "$HOME/.cargo/bin/cargo" ]; then
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
          fi
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
          cargo --version

      - name: Test
        run: |
          set -o pipefail          # without this a failing build looks green
          CARGO="$HOME/.cargo/bin/cargo"
          echo "HOME=$HOME  cargo there: $([ -x "$CARGO" ] && echo yes || echo no)"
          "$CARGO" test 2>&1 | tail -4