"""CI hygiene: pinned actions, fork guards, cleanup scope and the security gates (SEC-06/07/14/15/16).

The workflow files are simple enough to read line by line, so no YAML library is needed
(none is a dependency of the project).
"""

from __future__ import annotations

import os
import re
import stat
import subprocess
from dataclasses import dataclass, field
from pathlib import Path

import pytest

ROOT = Path(__file__).resolve().parents[2]
WORKFLOWS = sorted((ROOT / ".gitea" / "workflows").glob("*.yml"))
FORK_GUARD = (
    "github.event_name != 'pull_request' || "
    "github.event.pull_request.head.repo.full_name == github.repository"
)
PINNED = re.compile(r"^[\w.-]+/[\w.-]+@[0-9a-f]{40}$")
VERSION_COMMENT = re.compile(r"#\s*v\d+\.\d+\.\d+\s*$")
DOCKER_USE = re.compile(
    r"\bdocker\s+(build|run|push|pull|login|save|tag|rmi|rm|image|ps|network|compose)\b"
    r"|cleanup_job_resources\.sh|scan_image\.sh|tests/integration|tests/mcp"
)


@dataclass
class Step:
    lines: list[str] = field(default_factory=list)

    @property
    def text(self) -> str:
        return "\n".join(self.lines)

    @property
    def uses(self) -> str | None:
        for line in self.lines:
            match = re.match(r"\s*(?:-\s*)?uses:\s*(.*)$", line)
            if match:
                return match.group(1).strip()
        return None

    def with_block(self) -> str:
        collected: list[str] = []
        inside = False
        for line in self.lines:
            if re.match(r"^\s{8}with:\s*$", line):
                inside = True
                continue
            if inside and re.match(r"^\s{8}\S", line):
                break
            if inside:
                collected.append(line)
        return "\n".join(collected)


@dataclass
class Job:
    name: str
    lines: list[str]

    @property
    def text(self) -> str:
        return "\n".join(self.lines)

    @property
    def condition(self) -> str | None:
        for line in self.lines:
            match = re.match(r"^ {4}if:\s*(.*)$", line)
            if match:
                return match.group(1).strip()
        return None

    @property
    def needs(self) -> list[str]:
        for line in self.lines:
            match = re.match(r"^ {4}needs:\s*\[(.*)\]\s*$", line)
            if match:
                return [item.strip() for item in match.group(1).split(",")]
        return []

    def steps(self) -> list[Step]:
        steps: list[Step] = []
        in_steps = False
        for line in self.lines:
            if re.match(r"^ {4}steps:\s*$", line):
                in_steps = True
                continue
            if not in_steps:
                continue
            if re.match(r"^ {6}-\s", line):
                steps.append(Step())
            if steps:
                steps[-1].lines.append(line)
        return steps


def jobs_of(path: Path) -> list[Job]:
    jobs: list[Job] = []
    in_jobs = False
    for line in path.read_text(encoding="utf-8").splitlines():
        if line.startswith("jobs:"):
            in_jobs = True
            continue
        if not in_jobs:
            continue
        if line.lstrip().startswith("#"):
            continue  # comment lines (the banner of the next job sits at the end of a block)
        match = re.match(r"^ {2}([\w-]+):\s*$", line)
        if match:
            jobs.append(Job(match.group(1), []))
        if jobs:
            jobs[-1].lines.append(line)
    return jobs


def has_pull_request_trigger(path: Path) -> bool:
    return (
        re.search(r"^ {2}pull_request:", path.read_text(encoding="utf-8"), re.MULTILINE) is not None
    )


def test_there_are_workflows_to_check() -> None:
    assert {path.name for path in WORKFLOWS} >= {"ci.yml", "publish.yml"}
    for path in WORKFLOWS:
        assert jobs_of(path), path.name


# SEC-07


@pytest.mark.parametrize("path", WORKFLOWS, ids=lambda p: p.name)
def test_every_action_is_pinned_to_a_full_commit_sha_with_a_version_comment(path: Path) -> None:
    seen = 0
    for line in path.read_text(encoding="utf-8").splitlines():
        match = re.match(r"^\s*(?:-\s*)?uses:\s*(\S+)(.*)$", line)
        if match is None or line.lstrip().startswith("#"):
            continue
        seen += 1
        assert PINNED.match(match.group(1)), f"{path.name}: {line.strip()}"
        assert VERSION_COMMENT.search(match.group(2)), f"{path.name}: no version comment: {line}"
    assert seen, f"{path.name} uses no action, so the pin check proved nothing"


@pytest.mark.parametrize("path", WORKFLOWS, ids=lambda p: p.name)
def test_no_secret_is_handed_to_a_third_party_action(path: Path) -> None:
    for job in jobs_of(path):
        for step in job.steps():
            if step.uses is not None:
                assert "secrets." not in step.with_block(), f"{path.name}/{job.name}"
                assert "secrets." not in step.text, f"{path.name}/{job.name}: {step.text}"


@pytest.mark.parametrize("path", WORKFLOWS, ids=lambda p: p.name)
def test_checkout_does_not_persist_the_job_token(path: Path) -> None:
    for job in jobs_of(path):
        for step in job.steps():
            if step.uses and step.uses.startswith("actions/checkout@"):
                assert "persist-credentials: false" in step.with_block(), f"{path.name}/{job.name}"


def test_the_registry_login_uses_the_cli_with_the_token_on_stdin() -> None:
    text = (ROOT / ".gitea" / "workflows" / "ci.yml").read_text(encoding="utf-8")

    assert "docker/login-action" not in text
    assert "--password-stdin" in text
    assert not re.search(r"docker login[^\n]*--password(?!-stdin)", text)


# SEC-06


def test_docker_and_secret_jobs_do_not_run_for_fork_pull_requests() -> None:
    path = ROOT / ".gitea" / "workflows" / "ci.yml"
    assert has_pull_request_trigger(path)
    guarded = []
    for job in jobs_of(path):
        if DOCKER_USE.search(job.text) or "secrets." in job.text:
            guarded.append(job.name)
            assert job.condition == FORK_GUARD, f"job {job.name} runs docker or uses secrets"
    assert {"test-integration", "test-mcp", "build-and-push"} <= set(guarded)


def test_workflows_without_a_pull_request_trigger_cannot_run_fork_code() -> None:
    for path in WORKFLOWS:
        if not has_pull_request_trigger(path):
            assert "pull_request_target" not in path.read_text(encoding="utf-8")


# SEC-15


def test_publish_needs_the_security_job_with_every_gate() -> None:
    path = ROOT / ".gitea" / "workflows" / "publish.yml"
    jobs = {job.name: job for job in jobs_of(path)}

    assert "security" in jobs["publish"].needs
    security = jobs["security"].text
    for gate in (
        "scripts/ci/install_gitleaks.sh",
        "gitleaks git",
        "tests/security",
        "scripts/ci/pip_audit.sh",
        "ruff check --select S",
    ):
        assert gate in security
    assert "fetch-depth: 0" in security  # the history scan needs it


def test_ci_security_job_runs_the_security_suite() -> None:
    jobs = {job.name: job for job in jobs_of(ROOT / ".gitea" / "workflows" / "ci.yml")}

    assert "uv run pytest tests/security --no-cov" in jobs["security"].text


# SEC-14


def test_publish_passes_the_token_through_the_environment_not_the_command_line() -> None:
    text = (ROOT / ".gitea" / "workflows" / "publish.yml").read_text(encoding="utf-8")

    assert "--password" not in text
    assert "UV_PUBLISH_PASSWORD: ${{ secrets.REGISTRY_TOKEN }}" in text


def test_the_build_job_logs_out_by_deleting_its_own_credential_directory() -> None:
    text = (ROOT / ".gitea" / "workflows" / "ci.yml").read_text(encoding="utf-8")

    assert "docker logout" not in text
    assert "DOCKER_CONFIG" in text


FAKE_DOCKER = """#!/usr/bin/env bash
echo "$*" >> "$DOCKER_LOG"
if [ "$1" = "ps" ]; then
  # one container per ancestor filter value
  for arg in "$@"; do
    case "$arg" in ancestor=*) echo "cid-of-${arg#ancestor=}" ;; esac
  done
fi
exit 0
"""


def run_cleanup(tmp_path: Path, *refs: str) -> list[str]:
    bin_dir = tmp_path / "bin"
    bin_dir.mkdir()
    fake = bin_dir / "docker"
    fake.write_text(FAKE_DOCKER)
    fake.chmod(fake.stat().st_mode | stat.S_IXUSR)
    log = tmp_path / "docker.log"
    log.write_text("")
    env = {
        "PATH": f"{bin_dir}:/usr/bin:/bin",
        "DOCKER_LOG": str(log),
        "HOME": str(tmp_path),
    }
    work = tmp_path / "work"
    work.mkdir()
    subprocess.run(  # noqa: S603 (fixed script path, fake docker on PATH)
        ["bash", str(ROOT / "scripts" / "ci" / "cleanup_job_resources.sh"), *refs],  # noqa: S607
        cwd=work,
        env=env,
        check=True,
        capture_output=True,
        timeout=30,
    )
    return log.read_text().splitlines()


def test_cleanup_removes_containers_only_for_per_run_refs(tmp_path: Path) -> None:
    registry = "git.hiddenden.cafe/hiddenden/aegisgitea-mcp"
    per_run = f"{registry}:sha-0123456789ab"
    shared = [f"{registry}:latest", f"{registry}:main", f"{registry}:dev"]

    calls = run_cleanup(tmp_path, per_run, *shared)

    removed = [call for call in calls if call.startswith("rm -f")]
    assert removed == [f"rm -f -v cid-of-{per_run}"]
    queried = [call for call in calls if call.startswith("ps ")]
    assert all("sha-0123456789ab" in call for call in queried) and len(queried) == 1
    # Shared tags are only untagged.
    for ref in shared:
        assert f"image rm {ref}" in calls
        assert f"rmi {ref}" not in calls


def test_cleanup_treats_names_with_the_run_prefix_as_per_run(tmp_path: Path) -> None:
    calls = run_cleanup(tmp_path, "aegis-ci-4242-mcp:test")

    assert "rm -f -v cid-of-aegis-ci-4242-mcp:test" in calls
    assert "rmi aegis-ci-4242-mcp:test" in calls


def test_cleanup_without_arguments_touches_nothing(tmp_path: Path) -> None:
    assert not any(call.startswith(("rm", "rmi", "image rm")) for call in run_cleanup(tmp_path))


# SEC-16


def test_the_image_scan_is_pinned_verified_and_gates_the_push() -> None:
    install = (ROOT / "scripts" / "ci" / "install_trivy.sh").read_text(encoding="utf-8")
    scan = (ROOT / "scripts" / "ci" / "scan_image.sh").read_text(encoding="utf-8")
    ci = (ROOT / ".gitea" / "workflows" / "ci.yml").read_text(encoding="utf-8")

    assert re.search(r'^TRIVY_VERSION="\d+\.\d+\.\d+"$', install, re.MULTILINE)
    assert len(re.findall(r'^SHA256_\w+="[0-9a-f]{64}"$', install, re.MULTILINE)) == 2
    assert "sha256sum --check" in install
    assert "--severity HIGH,CRITICAL" in scan and "--exit-code 1" in scan
    assert "--ignore-unfixed" in scan
    jobs = {job.name: job for job in jobs_of(ROOT / ".gitea" / "workflows" / "ci.yml")}
    build = jobs["build-and-push"].text
    assert build.index("scripts/ci/scan_image.sh") < build.index("docker push")
    assert "scripts/ci/install_trivy.sh" in ci


def test_scripts_are_executable_and_parse() -> None:
    for script in (ROOT / "scripts" / "ci").glob("*.sh"):
        assert os.access(script, os.X_OK), script.name
        subprocess.run(["bash", "-n", str(script)], check=True, timeout=30)  # noqa: S603, S607