from pathlib import Path

ROOT = Path(__file__).resolve().parents[3]
WORKFLOW = ROOT / ".gitea/workflows/cd.yaml"


def test_cd_known_hosts_gate_retries_and_verifies_preserved_secret() -> None:
    workflow = WORKFLOW.read_text(encoding="utf-8")
    gate = workflow[workflow.index(": > /tmp/known_hosts_repair") :]
    gate = gate[: gate.index('echo "✅ 所有 Secrets 注入完成"')]

    assert "for scan_attempt in 1 2 3" in gate
    assert 'sleep "\\$scan_attempt"' in gate
    assert "existing ssh-mcp-key verified 5/5 and preserved" in gate
    assert "EXISTING_PRESENT=\\$((EXISTING_PRESENT + 1))" in gate
    assert 'if [ "\\$EXISTING_PRESENT" -eq "\\$EXPECTED_HOSTS" ]' in gate
    assert 'rm -f "\\$EXISTING_KNOWN_HOSTS"' in gate
    assert "cat /tmp/known_hosts_scan_err" not in gate
    assert "existing ssh-mcp-key coverage" in gate