from __future__ import annotations

import json
from pathlib import Path
import subprocess
import sys


REPO_ROOT = Path(__file__).resolve().parents[3]
SCRIPT = REPO_ROOT / "scripts" / "ci" / "generate-cicd-artifact-receipts.py"


def _write(path: Path, text: str) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text(text, encoding="utf-8")


def test_generate_cicd_artifact_receipts_writes_metadata_only_outputs(
    tmp_path: Path,
) -> None:
    repo = tmp_path / "repo"
    out_dir = tmp_path / "artifacts"
    _write(
        repo / "apps/api/pyproject.toml",
        """
[project]
name = "awoooi-api"
version = "1.2.3"
dependencies = ["fastapi>=0.1", "asyncpg>=0.29"]

[project.optional-dependencies]
dev = ["pytest>=8"]
""".strip(),
    )
    _write(
        repo / "package.json",
        json.dumps(
            {
                "name": "@awoooi/root",
                "version": "4.5.6",
                "dependencies": {"typescript": "^5.0.0"},
                "devDependencies": {"eslint": "^9.0.0"},
            }
        ),
    )
    _write(repo / "pnpm-lock.yaml", "lockfileVersion: '9.0'\n")
    _write(repo / ".gitea/workflows/cd.yaml", "name: CD\n")
    _write(repo / "apps/api/Dockerfile", "FROM python:3.11-slim\n")

    result = subprocess.run(
        [
            sys.executable,
            str(SCRIPT),
            "--repo-root",
            str(repo),
            "--out-dir",
            str(out_dir),
        ],
        check=True,
        text=True,
        capture_output=True,
    )

    assert "cicd_artifact_receipt_manifest_sha256=" in result.stdout
    manifest = json.loads(
        (out_dir / "awoooi-ci-artifact-receipts.manifest.json").read_text(
            encoding="utf-8"
        )
    )
    sbom = json.loads((out_dir / "awoooi-ci-sbom.json").read_text(encoding="utf-8"))
    provenance = json.loads(
        (out_dir / "awoooi-ci-provenance.json").read_text(encoding="utf-8")
    )
    retention = json.loads(
        (out_dir / "awoooi-ci-artifact-retention-manifest.json").read_text(
            encoding="utf-8"
        )
    )
    package_release = json.loads(
        (out_dir / "awoooi-ci-package-release-promotion.json").read_text(
            encoding="utf-8"
        )
    )

    assert manifest["schema_version"] == "awoooi_cicd_artifact_receipts_v1"
    assert manifest["ready"] is True
    assert manifest["receipt_count"] == 4
    assert [receipt["id"] for receipt in manifest["receipts"]] == [
        "sbom",
        "provenance",
        "artifact_retention",
        "package_release_promotion",
    ]
    assert manifest["operation_boundaries"] == {
        "secret_values_collected": False,
        "github_api_used": False,
        "gitea_api_write_performed": False,
        "host_write_performed": False,
    }
    assert sbom["schema_version"] == "awoooi_cicd_sbom_v1"
    assert sbom["component_count"] >= 5
    assert sbom["operation_boundaries"]["secret_value_read_allowed"] is False
    assert provenance["schema_version"] == "awoooi_cicd_provenance_v1"
    assert provenance["slsa_source_contract"]["provenance_receipt_generated"] is True
    assert retention["schema_version"] == "awoooi_cicd_artifact_retention_v1"
    assert retention["cache_key_contract"]["python_deps_hash_input"] == (
        "apps/api/pyproject.toml"
    )
    assert (
        retention["operation_boundaries"]["package_registry_write_attempted"] is False
    )
    assert (
        package_release["schema_version"] == "awoooi_cicd_package_release_promotion_v1"
    )
    assert (
        package_release["release_channel_contract"]["primary_package_registry"]
        == "gitea_packages"
    )
    assert (
        package_release["rollback_receipt_contract"][
            "rollback_requires_post_apply_readback"
        ]
        is True
    )
    assert (
        package_release["operation_boundaries"]["package_registry_write_attempted"]
        is False
    )
    assert (
        package_release["operation_boundaries"]["gitea_release_write_attempted"]
        is False
    )