from pathlib import Path
import unittest


ROOT = Path(__file__).resolve().parents[1]
WORKFLOW = ROOT / ".github/workflows/package-sfcrm-apprelease.yml"
DOCKERFILE = ROOT / "infra/sfcrm-apprelease.Dockerfile"


class AppReleasePackageWorkflowTest(unittest.TestCase):
    def test_public_contract_is_source_only(self) -> None:
        workflow = WORKFLOW.read_text()
        dispatch = workflow.split("permissions:", 1)[0]
        self.assertIn("source:", dispatch)
        self.assertIn("default: main", dispatch)
        self.assertNotIn("l2_", workflow.lower())
        self.assertNotIn("resolved_bom", workflow.lower())
        self.assertNotIn("environment:", workflow)

    def test_source_is_frozen_and_release_is_rebuilt_and_verified(self) -> None:
        workflow = WORKFLOW.read_text()
        self.assertIn("packaging controller must be dispatched from reviewed main", workflow)
        self.assertIn('source_sha="$(git -C source rev-parse HEAD)"', workflow)
        self.assertIn("path: controller", workflow)
        self.assertIn("path: source", workflow)
        self.assertIn("go -C controller/tools/crm-app-release run . build", workflow)
        self.assertIn("cmp \"${context}/app-package.json\"", workflow)
        self.assertIn("go -C controller/tools/crm-app-release run . verify", workflow)
        self.assertNotIn("go -C controller/tools/crm-app-release test", workflow)
        self.assertNotIn("go -C source/", workflow)
        self.assertIn("ghcr.io/pingcap-inc/nexuscrm-sfcrm-apprelease", workflow)
        self.assertIn("${IMAGE_NAME}@${digest}", workflow)
        self.assertIn("touch --date='2000-01-01T00:00:00Z'", workflow)

    def test_clean_runner_has_exact_go_and_private_builder_dependencies(self) -> None:
        workflow = WORKFLOW.read_text()
        self.assertIn("actions/setup-go@", workflow)
        self.assertIn('go-version: "1.25.x"', workflow)
        self.assertIn("NEXUSCRM_CONTRACT_DEPLOY_KEY", workflow)
        self.assertIn("NEXUSCRM_CONTROLPLANE_DEPLOY_KEY", workflow)
        self.assertIn("GOWORK=off go -C controller/tools/crm-app-release mod download", workflow)
        self.assertIn("trap cleanup EXIT", workflow)

    def test_transport_contains_only_apprelease_publication(self) -> None:
        dockerfile = DOCKERFILE.read_text()
        self.assertIn("/nexuscrm/apprelease/app-package.json", dockerfile)
        self.assertIn("/nexuscrm/apprelease/publisher-attestation.json", dockerfile)
        self.assertIn("/nexuscrm/apprelease/publisher-public-key.json", dockerfile)
        self.assertNotIn("L0", dockerfile)
        self.assertNotIn("L2", dockerfile)


if __name__ == "__main__":
    unittest.main()