"""The composite actions every image repository of NetOrk uses (NetOrk/netork#1390).

    uses: https://git.netork.io/NetOrk/image-tools/actions/<name>@<commit>

They only call what this repository holds, so a pinned commit fixes what runs.
"""

from __future__ import annotations

import re
from pathlib import Path

import pytest
import yaml

ROOT = Path(__file__).resolve().parents[1]
ACTIONS = sorted((ROOT / "actions").glob("*/action.yml"))


def test_the_actions():
    names = [a.parent.name for a in ACTIONS]

    assert names == ["bump", "judge", "sign", "verdict", "verify-base"]


@pytest.mark.parametrize("action", ACTIONS, ids=lambda a: a.parent.name)
def test_an_action_runs_only_what_this_repository_holds(action):
    spec = yaml.safe_load(action.read_text())

    assert spec["runs"]["using"] == "composite"
    for step in spec["runs"]["steps"]:
        for script in re.findall(r"github\.action_path }}/\.\./\.\./(bin/[\w.-]+)", step["run"]):
            assert (ROOT / script).is_file(), script
        assert "${{ inputs." not in step["run"], "inputs reach a script through env"


def test_signing_needs_its_secrets_from_the_caller():
    text = (ROOT / "actions/sign/action.yml").read_text()

    assert "COSIGN_PRIVATE_KEY_B64" in text and "secrets." not in text


def test_a_verdict_that_could_not_be_reached_fails_the_step():
    """A silent "same" hid an empty NETORK_LICENSE_KEY for two nights (2026-10-21/22)."""
    spec = yaml.safe_load((ROOT / "actions/verdict/action.yml").read_text())
    [step] = spec["runs"]["steps"]

    assert spec["outputs"]["improved"]["value"] == "${{ steps.verdict.outputs.improved }}"
    assert "['error']" in step["run"] and "sys.exit(" in step["run"]
    assert "cat report.md" in step["run"].splitlines()


def test_bumping_needs_its_token_from_the_caller():
    text = (ROOT / "actions/bump/action.yml").read_text()

    assert "BUMP_TOKEN" in text and "secrets." not in text


def test_a_base_can_be_named_where_the_dockerfile_cannot():
    """base-python builds FROM ${BASE_OS}, an argument the nightly sets, and copies
    CPython from Docker's python:3.12-slim, which is not signed with netOrk's key.
    It names the one image to verify instead."""
    spec = yaml.safe_load((ROOT / "actions/verify-base/action.yml").read_text())
    runs = "\n".join(step["run"] for step in spec["runs"]["steps"])

    assert not spec["inputs"]["dockerfiles"].get("required")
    assert "refs" in spec["inputs"]
    assert "bin/verify-signature.sh" in runs and "bin/verify-base.sh" in runs