from pathlib import Path

ROOT = Path(__file__).resolve().parents[3]
WORKFLOW = ROOT / ".gitea/workflows/cd.yaml"


def test_cd_known_hosts_gate_keeps_core_fail_closed_and_host111_isolated() -> None:
    workflow = WORKFLOW.read_text(encoding="utf-8")
    gate = workflow[workflow.index(": > /tmp/known_hosts_repair") :]
    gate = gate[: gate.index('echo "✅ 所有 Secrets 注入完成"')]

    assert "for scan_attempt in 1 2 3" in gate
    assert 'sleep "\\$scan_attempt"' in gate
    assert "CORE_EXPECTED_HOSTS=5" in gate
    assert "TARGET_HOSTS=6" in gate
    assert "fresh_6_of_6" in gate
    assert "preserve_existing_6_of_6" in gate
    assert "fresh_core_5_host111_trust_deferred" in gate
    assert "preserve_existing_core_5_host111_trust_deferred" in gate
    assert "host-key core trust incomplete" in gate
    assert "host111_trust_deferred isolated_lane=ansible:111-ollama-fallback" in gate
    assert 'rm -f "\\$EXISTING_KNOWN_HOSTS"' in gate
    assert "cat /tmp/known_hosts_scan_err" not in gate
    assert "KNOWN_HOSTS_B64=\\$(base64 -w 0 \"\\$TRUST_SOURCE\")" in gate