#!/usr/bin/env bash
# Smoke profile.build — requires VM tunnel and optional build-registry-token secret.
set -euo pipefail

if [[ -z "${SANDBOXER_SECRET_BUILD_REGISTRY_TOKEN:-}" ]]; then
  echo "SANDBOXER_SECRET_BUILD_REGISTRY_TOKEN not set — skipping live smoke" >&2
  exit 0
fi

VM="${SMOKE_VM:-haskell-build}"
TUNNEL_PORT="${SANDBOXER_VM_TUNNEL_PORT:-12222}"
echo "Smoke: profile.build vm=$VM tunnel=$TUNNEL_PORT"
STATUS=$(sandboxer create \
  --profile profile.build \
  --input "vm=$VM" \
  --input "tunnel_port=$TUNNEL_PORT" \
  --actor agt \
  --project snuggle-inventor)
ID=$(echo "$STATUS" | python3 -c "import sys,json; print(json.load(sys.stdin)['sandbox_id'])")
echo "Created: $ID"
sandboxer reachability show "$ID"
sandboxer destroy "$ID"
echo "OK: build profile smoke"