name: Ansible / Reboot Recovery Contract

on:
  # 2026-06-28 Codex: 110 host runner/CD lane pressure incident.
  # Automatic push/PR triggers stay disabled until the runner is moved or rate-limited.
  # Path contract covered when a future non-110 runner readiness gate re-enables
  # path-scoped automatic triggers:
  # - scripts/reboot-recovery/**
  # - docs/**
  # - .gitea/workflows/**
  workflow_dispatch:

jobs:
  validate:
    runs-on: awoooi-non110-ubuntu
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4

      - name: Bootstrap Ansible validation env
        run: bash scripts/ops/bootstrap-ansible-validation-env.sh

      - name: Run Ansible and reboot-recovery validation
        run: |
          set -euo pipefail
          export PATH="${ANSIBLE_VALIDATION_VENV:-/tmp/awoooi-ansible-venv}/bin:$PATH"
          bash scripts/ops/ansible-validate.sh
          python3 scripts/ops/doc-secrets-sanity-check.py docs .gitea
          python3 scripts/ops/backup-alert-label-contract-check.py
          python3 scripts/ops/recovery-scorecard-contract-check.py
          python3 -m py_compile scripts/ops/backup-alert-live-visibility-check.py
          bash -n scripts/reboot-recovery/full-stack-recovery-scorecard.sh
          bash -n scripts/reboot-recovery/dr-offsite-operator-checklist.sh
          bash -n scripts/reboot-recovery/verify-cold-start-monitor-deploy.sh
          bash scripts/reboot-recovery/reboot-recovery-readiness-audit.sh --no-color
