From 5fa557afbb99a4fc11e59cecdbe02b447bb0640a Mon Sep 17 00:00:00 2001
From: 0x1f6 <178943044+0x1f6@users.noreply.github.com>
Date: Tue, 6 Oct 2026 01:37:42 +0200
Subject: [PATCH] CI: the smoke job exercises the ft wrapper; wrapper changes
 trigger CI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The wrapper is the counterpart of the image — every device run goes
through it. The smoke job now runs it against the image the build
pushed: repo-mode program run, installed-mode update with digest-pin
verification, and the :latest refusal. ft joins the CI trigger paths.
---
 .github/workflows/image.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index 6a23c5d..eba1c9c 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -20,6 +20,7 @@ on:
       - "uv.lock"
       - ".python-version"
       - "justfile"
+      - "ft"
       - ".github/workflows/image.yml"
       - "!**.md"
       - "!**/DESIGN.md"
@@ -94,3 +95,24 @@ jobs:
           docker run --rm \
             -v "$PWD":/src/frametop --workdir /src/frametop \
             "${IMAGE}:${{ needs.build.outputs.tag }}" just test
+      # The wrapper is the counterpart of the image: every run on a device
+      # goes through it, so a wrapper change can break a working image just
+      # like an image change can. The smoke job therefore exercises the
+      # wrapper itself, against the image this run built.
+      - name: Exercise the ft wrapper against the built image
+        run: |
+          export FT_IMAGE="${IMAGE}:${{ needs.build.outputs.tag }}"
+          # repo mode: a program runs from the image, with the checkout mounted
+          ./ft python -V
+          # installed mode, in a sandbox: update digest-pins, then runs
+          mkdir -p /tmp/ft-home/.config/frametop /tmp/ft-home/bin
+          echo "$FT_IMAGE" > /tmp/ft-home/.config/frametop/published
+          install ./ft /tmp/ft-home/bin/ft
+          FT_IMAGE_PUBLISHED="$FT_IMAGE" XDG_CONFIG_HOME=/tmp/ft-home/.config \
+            /tmp/ft-home/bin/ft update
+          pinned=$(cat /tmp/ft-home/.config/frametop/image)
+          grep -q '@sha256:' <<<"$pinned" || { echo "no digest pinned: $pinned"; exit 1; }
+          XDG_CONFIG_HOME=/tmp/ft-home/.config /tmp/ft-home/bin/ft python -V
+          # :latest is refused for what gets deployed
+          echo "${IMAGE}:latest" > /tmp/ft-home/.config/frametop/image
+          XDG_CONFIG_HOME=/tmp/ft-home/.config /tmp/ft-home/bin/ft python -V && exit 1 || true