import hashlib
import json
import subprocess
from pathlib import Path

import yaml

from scripts import build_mcp_hub_release_images as producer
from scripts import prepare_release_security_bases as preparation

ROOT = Path(__file__).resolve().parents[1]


def test_preparation_recipe_parents_do_not_follow_the_new_production_pins() -> None:
    receipt = json.loads((ROOT / "evidence/WP-400/SECURITY_BASE_PUBLICATION.json").read_text())
    for row in receipt["preparedImages"]:
        parent = preparation.PARENT_IMAGES[row["service"]]
        assert parent == row["parentRef"]
        assert parent != producer.EXTERNAL_IMAGES[row["service"]][0]
        recipe = (
            ROOT / "infrastructure/images/security-bases" / row["service"] / "Dockerfile"
        ).read_text()
        assert f"\nFROM {parent}\n" in "\n" + recipe


def test_phase_b_pins_are_the_exact_runtime_verified_publication() -> None:
    receipt = json.loads((ROOT / "evidence/WP-400/SECURITY_BASE_PUBLICATION.json").read_text())
    assert receipt["schema"] == "itworx.security-base-preparation/v1"
    assert receipt["revision"] == "3237e4d8aec312d63d13b4e80664422a7520b5f9"
    assert receipt["runId"] == 23280 and receipt["runAttempt"] == 1
    assert receipt["candidateEmitted"] is False and receipt["reportCount"] == 5
    services = yaml.safe_load((ROOT / "infrastructure/compose/docker-compose.yml").read_text())[
        "services"
    ]
    rows = receipt["preparedImages"]
    assert {row["service"] for row in rows} == {"postgres", "ingestion-clamd"}
    for row in rows:
        assert row["runtimeVerified"] is True and row["vulnerabilityAndSecretVerified"] is True
        assert producer.EXTERNAL_IMAGES[row["service"]] == (row["imageRef"], row["archiveRef"])
        assert services[row["service"]]["image"] == row["imageRef"]
        assert row["archiveRef"] == row["imageRef"].split("@", 1)[0]
        assert row["archiveRef"] not in {"postgres:18.6", "clamav/clamav:1.4.6"}
        for path, identities in row["sourceInputs"].items():
            assert path in {
                "infrastructure/images/security-bases/postgres/Dockerfile",
                "evidence/WP-400/database-image-candidate-20261003/recipes/postgres/verify-gosu-metadata.sh",
                "infrastructure/images/security-bases/ingestion-clamd/Dockerfile",
                "infrastructure/images/security-bases/ingestion-clamd/verify-pcre2.sh",
            }
            # The recipes remain byte-identical; HEAD also works in depth-one native checkouts.
            blob = subprocess.check_output(["git", "show", "HEAD:" + path], cwd=ROOT)  # noqa: S603,S607 - fixed reviewed recipe blob paths
            assert hashlib.sha256(blob).hexdigest() == identities["sourceSha256"]
            assert (
                hashlib.sha256(blob.replace(b"\r\n", b"\n")).hexdigest()
                == identities["materializedSha256"]
            )
    integration = yaml.safe_load(
        (ROOT / "infrastructure/compose/docker-compose.wp050-integration.yml").read_text()
    )
    assert integration["services"]["postgres"]["image"] == producer.EXTERNAL_IMAGES["postgres"][0]