From 0680b761138dc64443ac58992edc3590ce9750b7 Mon Sep 17 00:00:00 2001
From: Jim McKeeth <jim@mckeeth.org>
Date: Fri, 17 Jul 2026 01:36:13 -0700
Subject: [PATCH] Fix smoke test: Windows self-hosted runners don't support
 native container jobs

GitHub Actions' jobs.<job>.container key only works on Linux runners
(hosted or self-hosted) - confirmed via a live run that failed with
'Container operations are only supported on Linux runners'. Switched
to explicitly invoking docker run from within a build step instead,
which achieves the same per-build process isolation.
---
 .../self-hosted-container-smoke-test.yml      | 35 ++++++++++---------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/self-hosted-container-smoke-test.yml b/.github/workflows/self-hosted-container-smoke-test.yml
index a9435ab..a99452b 100644
--- a/.github/workflows/self-hosted-container-smoke-test.yml
+++ b/.github/workflows/self-hosted-container-smoke-test.yml
@@ -5,12 +5,7 @@ on:
 
 jobs:
   compile-in-container:
-    runs-on: [self-hosted, windows, delphi, container]
-    container:
-      image: delphi-builder:12-athens
-      volumes:
-        - 'C:\Program Files (x86)\Embarcadero:C:\Program Files (x86)\Embarcadero:ro'
-        - 'C:\Users\Public\Documents\Embarcadero:C:\Users\Public\Documents\Embarcadero:ro'
+    runs-on: [self-hosted, windows, delphi]
     steps:
       - name: Write a trivial Delphi program
         shell: cmd
@@ -21,14 +16,22 @@ jobs:
           echo   WriteLn('Hello from a process-isolated container'^); >> Hello.dpr
           echo end. >> Hello.dpr
 
-      - name: Compile with dcc64
-        shell: cmd
-        run: dcc64.exe Hello.dpr
-
-      - name: Run the compiled binary
-        shell: cmd
-        run: Hello.exe
+      - name: Compile and run inside a process-isolated container
+        shell: pwsh
+        run: |
+          docker run --rm --isolation process `
+            -v "${{ github.workspace }}:C:\work" `
+            -v "C:\Program Files (x86)\Embarcadero:C:\Program Files (x86)\Embarcadero:ro" `
+            -v "C:\Users\Public\Documents\Embarcadero:C:\Users\Public\Documents\Embarcadero:ro" `
+            -w C:\work `
+            delphi-builder:12-athens `
+            cmd /c "dcc64.exe Hello.dpr && Hello.exe && echo this container is ephemeral > C:\marker.txt && dir C:\marker.txt"
+          if ($LASTEXITCODE -ne 0) { throw "container build failed with exit code $LASTEXITCODE" }
 
-      - name: Prove isolation - write a marker file that should not survive
-        shell: cmd
-        run: echo this container is ephemeral > C:\marker-%RANDOM%.txt && dir C:\marker-*.txt
+      - name: Prove isolation - marker from the container must not exist on the runner host
+        shell: pwsh
+        run: |
+          if (Test-Path "C:\marker.txt") {
+            throw "ISOLATION FAILURE: C:\marker.txt leaked from the container onto the host"
+          }
+          Write-Output "Confirmed: container filesystem changes did not leak onto the host"