"""Keep publication credentials and builds behind the protected release trigger."""

from pathlib import Path

import yaml

ROOT = Path(__file__).resolve().parents[1]
CHECKOUT = "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
UPLOAD = "ChristopherHX/gitea-upload-artifact@62ac910c5d3dfa85c7cb2df15afe2e342b2407c2"


def release_job() -> dict:
    workflow = yaml.safe_load(
        (ROOT / ".gitea/workflows/managed-validation.yml").read_text(encoding="utf-8")
    )
    return workflow["jobs"]["release-images"]


def test_all_checkouts_use_the_canonical_authenticated_https_origin() -> None:
    workflow = yaml.safe_load(
        (ROOT / ".gitea/workflows/managed-validation.yml").read_text(encoding="utf-8")
    )
    checkouts = [
        step
        for job in workflow["jobs"].values()
        for step in job["steps"]
        if step.get("uses") == CHECKOUT
    ]
    assert len(checkouts) == 2
    for checkout in checkouts:
        assert checkout["with"]["github-server-url"] == "https://gitea.example.com"
        assert "token" not in checkout["with"]


def test_release_build_requires_successful_validation_and_exact_main_push() -> None:
    job = release_job()
    assert job["name"] == "release-images"
    assert job["needs"] == ["full"]
    assert job["if"] == (
        "${{ gitea.event_name == 'push' && gitea.ref == 'refs/heads/main' "
        "&& gitea.repository == 'Jens/ITWorx_MCP_Hub' }}"
    )
    assert job["runs-on"] == "itworx-ci-build"
    assert 0 < job["timeout-minutes"] <= 150
    assert job["permissions"] == {"contents": "read", "actions": "read"}
    assert "env" not in job and "container" not in job and "services" not in job


def test_release_credentials_only_reach_the_bounded_producer() -> None:
    steps = release_job()["steps"]
    assert len(steps) == 3
    assert steps[0]["uses"] == CHECKOUT
    assert steps[0]["with"]["persist-credentials"] is False
    assert steps[0]["with"]["fetch-depth"] == 1
    assert "env" not in steps[0] and "env" not in steps[2]
    assert steps[1]["env"] == {
        "GITEA_TOKEN": "${{ secrets.GITEA_TOKEN }}",
        "HUB_RELEASE_REGISTRY_TOKEN": "${{ secrets.HUB_RELEASE_REGISTRY_TOKEN }}",
    }
    command = steps[1]["run"]
    assert "set -euo pipefail" in command
    assert "set -x" not in command and "docker login" not in command
    assert 'python3 scripts/build_mcp_hub_release_images.py --revision "$GITHUB_SHA"' in command
    assert "--prepare-security-bases" not in command
    assert '--run-id "$GITHUB_RUN_ID"' in command
    assert '--output "${RUNNER_TEMP}/hub-release-candidate-${GITHUB_SHA}"' in command


def test_release_artifact_is_pinned_uncompressed_and_cannot_overwrite() -> None:
    upload = release_job()["steps"][2]
    assert upload["uses"] == UPLOAD
    assert "if" not in upload
    assert upload["with"] == {
        "name": "hub-release-candidate-${{ github.sha }}",
        "path": "${{ runner.temp }}/hub-release-candidate-${{ github.sha }}/*",
        "if-no-files-found": "error",
        "retention-days": 90,
        "compression-level": 0,
        "overwrite": False,
    }