"""Fail closed unless this terminal job represents one exact healthy main SHA."""

from __future__ import annotations

import os
import re
import subprocess
import sys
from collections.abc import Mapping

FULL_SHA = re.compile(r"^[0-9a-f]{40}$")
REQUIRED_CHILDREN = (
    "BACKEND_VALIDATE",
    "FRONTEND",
)


def validate_main_aggregate(
    environment: Mapping[str, str],
    *,
    checkout_sha: str,
) -> list[str]:
    """Return all invalid conditions so a red aggregate explains its boundary."""
    errors: list[str] = []
    event_sha = environment.get("EVENT_SHA", "")
    if not FULL_SHA.fullmatch(event_sha):
        errors.append("EVENT_SHA must be a full lowercase commit SHA")
    if environment.get("EVENT_REF") != "refs/heads/main":
        errors.append("EVENT_REF must be refs/heads/main")
    if checkout_sha != event_sha:
        errors.append("checked-out revision does not match EVENT_SHA")
    for child in REQUIRED_CHILDREN:
        if environment.get(child) != "success":
            errors.append(f"{child} must be success")
    return errors


def current_checkout_sha() -> str:
    return subprocess.check_output(("git", "rev-parse", "HEAD"), text=True).strip()


def main() -> int:
    errors = validate_main_aggregate(os.environ, checkout_sha=current_checkout_sha())
    if errors:
        for error in errors:
            print(f"::error::{error}", file=sys.stderr)
        return 1
    print("go-ci / Main: all exact-SHA child checks succeeded")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())