import { describe, expect, it } from "@effect/vitest";
import { readFileSync } from "node:fs";
import { resolve } from "node:path";

import { validateReleaseTag, validateReleaseVersion } from "../scripts/validate-release-ref";

const workflow = (name: string): string =>
  readFileSync(resolve(import.meta.dirname, "..", ".github/workflows", name), "utf8");

describe("release workflow hardening", () => {
  it("accepts only semver release versions and v-prefixed semver tags", () => {
    expect(validateReleaseVersion("1.2.3")).toBe("1.2.3");
    expect(validateReleaseVersion("1.2.3-beta.4")).toBe("1.2.3-beta.4");
    expect(validateReleaseTag("v1.2.3")).toBe("v1.2.3");
    expect(validateReleaseTag("v1.2.3-beta.4+build.5")).toBe("v1.2.3-beta.4+build.5");

    expect(() => validateReleaseVersion("v1.2.3")).toThrow();
    expect(() => validateReleaseVersion("1.2")).toThrow();
    expect(() => validateReleaseTag("1.2.3")).toThrow();
    expect(() => validateReleaseTag("v1.2.3; echo unsafe")).toThrow();
    expect(() => validateReleaseTag("v01.2.3")).toThrow();
  });

  it("validates release values through environment variables before shell use", () => {
    const publishExecutor = workflow("publish-executor-package.yml");
    const release = workflow("release.yml");
    const publishDesktop = workflow("publish-desktop.yml");

    expect(publishExecutor).toContain(
      "bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG",
    );
    expect(release).toContain(
      "bun run scripts/validate-release-ref.ts --version-env RELEASE_VERSION --output tag",
    );
    expect(publishDesktop).toContain(
      "bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG",
    );

    expect(release).not.toContain('tag="v${{ steps.detect_release.outputs.version }}"');
    expect(publishDesktop).not.toContain("ref: refs/tags/${{ inputs.tag }}");
    expect(publishDesktop).not.toContain('gh release download "${{ inputs.tag }}"');
    expect(publishExecutor).not.toMatch(/\n\s+RELEASE_TAG: \$\{\{ github\.event_name/u);
  });

  it("does not persist checkout credentials in release workflows", () => {
    for (const name of [
      "publish-executor-package.yml",
      "release.yml",
      "publish-desktop.yml",
      "pkg-pr-new.yml",
    ]) {
      expect(workflow(name)).toContain("persist-credentials: false");
    }
  });
});