name: probe registry endpoints

# TEMPORARY probe branch — not for merge. Answers one question with evidence
# instead of inference: which registry endpoints are reachable from a pod inside
# this cluster, after 10.40.0.10 (the istio-gateway LoadBalancer EXTERNAL
# address) turned out to be connection-refused from the pod network while
# answering fine from a LAN workstation.

on:
  workflow_dispatch:

jobs:
  probe:
    if: ${{ github.server_url != 'https://github.com' }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Probe candidate registry endpoints
        run: |
          set -u
          fmt='http=%{http_code} tls=%{ssl_verify_result} t=%{time_total}\n'

          echo "--- public name via cluster DNS (the path that works today) ---"
          printf '%-46s ' 'gitea.langenoja.se:443'
          curl -s -o /dev/null -w "$fmt" --max-time 8 https://gitea.langenoja.se/v2/ \
            || echo "UNREACHABLE"

          echo "--- istio-gateway EXTERNAL lb ip (what #949 pinned) ---"
          printf '%-46s ' '10.40.0.10:443'
          curl -s -o /dev/null -w "$fmt" --max-time 8 \
            --resolve gitea.langenoja.se:443:10.40.0.10 https://gitea.langenoja.se/v2/ \
            || echo "UNREACHABLE"

          echo "--- istio-gateway CLUSTER ip (candidate) ---"
          printf '%-46s ' '10.43.1.114:443'
          curl -s -o /dev/null -w "$fmt" --max-time 8 \
            --resolve gitea.langenoja.se:443:10.43.1.114 https://gitea.langenoja.se/v2/ \
            || echo "UNREACHABLE"

          echo "--- gitea http service, in-cluster, plain http ---"
          printf '%-46s ' 'gitea-system-gitea-http:3000'
          curl -s -o /dev/null -w "$fmt" --max-time 8 \
            http://gitea-system-gitea-http.gitea-system.svc.cluster.local:3000/v2/ \
            || echo "UNREACHABLE"

          echo "--- what this pod resolves the public name to ---"
          getent hosts gitea.langenoja.se || echo "(getent failed)"