"""The composite actions every image repository of NetOrk uses (NetOrk/netork#1390).

    uses: https://git.netork.io/NetOrk/image-tools/actions/<name>@<commit>

They only call what this repository holds, so a pinned commit fixes what runs.
"""

from __future__ import annotations

import re
from pathlib import Path

import pytest
import yaml

ROOT = Path(__file__).resolve().parents[1]
ACTIONS = sorted((ROOT / "actions").glob("*/action.yml"))


def test_the_four_actions():
    assert [a.parent.name for a in ACTIONS] == ["judge", "sign", "verdict", "verify-base"]


@pytest.mark.parametrize("action", ACTIONS, ids=lambda a: a.parent.name)
def test_an_action_runs_only_what_this_repository_holds(action):
    spec = yaml.safe_load(action.read_text())

    assert spec["runs"]["using"] == "composite"
    for step in spec["runs"]["steps"]:
        for script in re.findall(r"github\.action_path }}/\.\./\.\./(bin/[\w.-]+)", step["run"]):
            assert (ROOT / script).is_file(), script
        assert "${{ inputs." not in step["run"], "inputs reach a script through env"


def test_signing_needs_its_secrets_from_the_caller():
    text = (ROOT / "actions/sign/action.yml").read_text()

    assert "COSIGN_PRIVATE_KEY_B64" in text and "secrets." not in text


def test_a_verdict_that_could_not_be_reached_fails_the_step():
    """A silent "same" hid an empty NETORK_LICENSE_KEY for two nights (2026-10-21/22)."""
    spec = yaml.safe_load((ROOT / "actions/verdict/action.yml").read_text())
    [step] = spec["runs"]["steps"]

    assert spec["outputs"]["improved"]["value"] == "${{ steps.verdict.outputs.improved }}"
    assert "['error']" in step["run"] and "sys.exit(" in step["run"]
    assert "cat report.md" in step["run"].splitlines()