#!/usr/bin/env bats

setup() {
	REPO_ROOT="$(git rev-parse --show-toplevel)"
	WORKFLOW="$REPO_ROOT/.gitea/workflows/custom-release.yml"
	RELEASE_SCRIPT="$REPO_ROOT/scripts/update-custom-release.sh"
}

@test "custom release runs as one job on ffmini macos runner" {
	run rg -n 'runs-on:[[:space:]]*ffmini_macos_arm64' "$WORKFLOW"
	[ "$status" -eq 0 ]

	run rg -n 'ubuntu-latest' "$WORKFLOW"
	[ "$status" -ne 0 ]

	run rg -n 'actions/upload-artifact' "$WORKFLOW"
	[ "$status" -ne 0 ]
}

@test "custom release tea login setup is idempotent on persistent host runner" {
	run rg -n 'tea" logins delete actions >/dev/null 2>&1 \|\| true' "$WORKFLOW"
	[ "$status" -eq 0 ]

	run rg -n 'tea" logins add --name actions' "$WORKFLOW"
	[ "$status" -eq 0 ]
}

@test "custom release workflow imports developer id signing material into temporary keychain" {
	run rg -n 'DEVELOPER_ID_APPLICATION_P12_BASE64' "$WORKFLOW"
	[ "$status" -eq 0 ]

	run rg -n 'DEVELOPER_ID_APPLICATION_P12_PASSWORD' "$WORKFLOW"
	[ "$status" -eq 0 ]

	run rg -n 'DEVELOPER_ID_APPLICATION_P12_BASE64 secret is required' "$WORKFLOW"
	[ "$status" -eq 0 ]

	run rg -n 'DEVELOPER_ID_APPLICATION_P12_PASSWORD secret is required' "$WORKFLOW"
	[ "$status" -ne 0 ]

	run rg -n 'security import .* -P "\$DEVELOPER_ID_APPLICATION_P12_PASSWORD"' "$WORKFLOW"
	[ "$status" -eq 0 ]

	run rg -n 'security import .* -A ' "$WORKFLOW"
	[ "$status" -eq 0 ]

	run rg -n 'security find-identity -v -p codesigning "\$keychain_path"' "$WORKFLOW"
	[ "$status" -eq 0 ]

	run rg -n 'codesign_identity_sha1=' "$WORKFLOW"
	[ "$status" -eq 0 ]

	run rg -n 'sed -n .*Developer ID Application' "$WORKFLOW"
	[ "$status" -eq 0 ]

	run rg -n 'CUSTOM_RELEASE_CODESIGN_IDENTITY=\$codesign_identity' "$WORKFLOW"
	[ "$status" -eq 0 ]

	run rg -n 'CUSTOM_RELEASE_CODESIGN_IDENTITY_SHA1=\$codesign_identity_sha1' "$WORKFLOW"
	[ "$status" -eq 0 ]

	run rg -n 'CUSTOM_RELEASE_KEYCHAIN_PASSWORD=\$keychain_password' "$WORKFLOW"
	[ "$status" -eq 0 ]

	run rg -n 'codesign --force --dryrun --keychain "\$keychain_path" --sign "\$codesign_identity" --options runtime --timestamp "\$probe_binary"' "$WORKFLOW"
	[ "$status" -eq 0 ]

	run rg -n 'CUSTOM_RELEASE_CODESIGN_IDENTITY: "Developer ID Application' "$WORKFLOW"
	[ "$status" -ne 0 ]

	run rg -n 'security create-keychain' "$WORKFLOW"
	[ "$status" -eq 0 ]

	run rg -n 'security import' "$WORKFLOW"
	[ "$status" -eq 0 ]

	run rg -n 'security delete-keychain' "$WORKFLOW"
	[ "$status" -eq 0 ]
}

@test "custom release carries per-target cgo mode" {
	run rg -n 'darwin/arm64/zip/1' "$WORKFLOW" "$RELEASE_SCRIPT"
	[ "$status" -eq 0 ]

	run rg -n 'linux/amd64/tar/0' "$WORKFLOW" "$RELEASE_SCRIPT"
	[ "$status" -eq 0 ]

	run rg -n 'CUSTOM_RELEASE_CGO_ENABLED' "$WORKFLOW"
	[ "$status" -ne 0 ]
}

@test "custom release signs darwin assets with hardened runtime and timestamp" {
	run rg -n 'codesign_args\+=\(--sign "\$codesign_identity" --options runtime --timestamp\)' "$RELEASE_SCRIPT"
	[ "$status" -eq 0 ]

	run rg -n -- '--keychain "\$CUSTOM_RELEASE_KEYCHAIN_PATH"' "$RELEASE_SCRIPT"
	[ "$status" -eq 0 ]

	run rg -n 'security unlock-keychain -p "\$CUSTOM_RELEASE_KEYCHAIN_PASSWORD" "\$CUSTOM_RELEASE_KEYCHAIN_PATH"' "$RELEASE_SCRIPT"
	[ "$status" -eq 0 ]

	run rg -n 'security find-identity -v -p codesigning "\$CUSTOM_RELEASE_KEYCHAIN_PATH"' "$RELEASE_SCRIPT"
	[ "$status" -eq 0 ]

	run awk '
		/codesign_args=\(--force\)/ { base = NR }
		/codesign_args\+=\(--keychain "\$CUSTOM_RELEASE_KEYCHAIN_PATH"\)/ { keychain = NR }
		/codesign_args\+=\(--sign "\$codesign_identity" --options runtime --timestamp\)/ { sign = NR }
		END { exit !(base && keychain && sign && base < keychain && keychain < sign) }
	' "$RELEASE_SCRIPT"
	[ "$status" -eq 0 ]

	run rg -n 'Developer ID Application' "$WORKFLOW" "$RELEASE_SCRIPT"
	[ "$status" -eq 0 ]

	run rg -n 'CUSTOM_RELEASE_CODESIGN_IDENTITY' "$WORKFLOW" "$RELEASE_SCRIPT"
	[ "$status" -eq 0 ]
}

@test "custom release validates darwin binaries before publishing" {
	run rg -n 'modernc-sqlite' "$RELEASE_SCRIPT"
	[ "$status" -eq 0 ]

	run rg -n 'codesign --verify --strict --verbose=2' "$RELEASE_SCRIPT"
	[ "$status" -eq 0 ]

	run rg -n 'TeamIdentifier=NG5W75WE8U|TeamIdentifier.*NG5W75WE8U' "$RELEASE_SCRIPT"
	[ "$status" -eq 0 ]

	run rg -n 'spctl -a -vv --type execute' "$RELEASE_SCRIPT"
	[ "$status" -eq 0 ]
}