From f6a8cf52720e8b79df46775ae32632cfebc3995d Mon Sep 17 00:00:00 2001
From: vibeforge1111 <vibeforge1111@gmail.com>
Date: Wed, 27 May 2026 18:28:43 +0400
Subject: [PATCH] ci: add live Docker workbench smoke

---
 .github/workflows/docker-optional.yml | 25 +++++++++++++++++++++++++
 docs/OPTIONAL_DOCKER_WORKBENCH.md     |  5 ++++-
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker-optional.yml b/.github/workflows/docker-optional.yml
index d99fadd9f..ebb70b18c 100644
--- a/.github/workflows/docker-optional.yml
+++ b/.github/workflows/docker-optional.yml
@@ -50,3 +50,28 @@ jobs:
             --tmpfs /sandbox:rw,nosuid,size=512m \
             spark-cli-sandbox:ci \
             --help
+
+  live-smoke:
+    name: live-smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Build live image
+        run: docker build -f docker/live/Dockerfile -t spark-live:ci .
+
+      - name: Run live CLI smoke
+        run: docker run --rm --user spark --entrypoint spark spark-live:ci --help
+
+      - name: Verify live entrypoint fails closed without hosted env
+        run: |
+          set +e
+          docker run --rm spark-live:ci >spark-live-entrypoint.out 2>&1
+          status="$?"
+          set -e
+          test "$status" -eq 2
+          grep -q "SPARK_LLM_PROVIDER is required" spark-live-entrypoint.out
diff --git a/docs/OPTIONAL_DOCKER_WORKBENCH.md b/docs/OPTIONAL_DOCKER_WORKBENCH.md
index a33c70bc5..644bbc6da 100644
--- a/docs/OPTIONAL_DOCKER_WORKBENCH.md
+++ b/docs/OPTIONAL_DOCKER_WORKBENCH.md
@@ -12,6 +12,7 @@ This repo provides two opt-in Docker lanes:
 |---|---|---|---|
 | Dev smoke | `docker/dev/Dockerfile` | Clean disposable environment for tests and installer verification | On |
 | Sandbox run | `docker/sandbox/Dockerfile` | Restricted CLI command experiments with no real home or secrets | Off |
+| Live image smoke | `docker/live/Dockerfile` | Hosted Spark Live image build and entrypoint guard checks | Hosted env only |
 
 Use these when you want to test a new feature without contaminating the operator's real `~/.spark` state.
 
@@ -138,7 +139,9 @@ Network-on sandbox runs should be treated as a separate risk decision.
 
 ## Optional GitHub Workflow
 
-The manual workflow at `.github/workflows/docker-optional.yml` builds both images and runs a smoke command. It only runs through `workflow_dispatch`, so Docker does not become a required CI dependency.
+The manual workflow at `.github/workflows/docker-optional.yml` builds the dev,
+sandbox, and live images and runs bounded smoke commands. It only runs through
+`workflow_dispatch`, so Docker does not become a required CI dependency.
 
 ## Secret Rules