"""ORCH-058 TC-07/08: static guarantees of the Strategy-B provenance plumbing.

These assert the *shape* of the deploy artefacts that can't be unit-tested by
running them (they shell out to docker/ssh on the host):

  * TC-07 — the deploy hook fail-closes BEFORE `docker tag` when the staging
            image's git-revision label != EXPECTED_REVISION (exit 1), and the
            new `--build-staging` rebuild mode stamps GIT_SHA into the image.
  * TC-08 — the Dockerfile declares `ARG GIT_SHA` and stamps it into the
            `org.opencontainers.image.revision` OCI label (the anchor B reads).
"""

import pathlib

_ROOT = pathlib.Path(__file__).resolve().parents[1]
_HOOK = _ROOT / "scripts" / "orchestrator-deploy-hook.sh"
_DOCKERFILE = _ROOT / "Dockerfile"


# ---------------------------------------------------------------------------
# TC-07: hook fail-closed provenance guard + --build-staging rebuild mode
# ---------------------------------------------------------------------------
def test_tc07_hook_has_fail_closed_provenance_guard():
    text = _HOOK.read_text(encoding="utf-8")
    # The label key the hook inspects must be the OCI revision label.
    assert 'REVISION_LABEL="org.opencontainers.image.revision"' in text
    # EXPECTED_REVISION is read (default unset -> backward compatible).
    assert 'EXPECTED_REVISION="${EXPECTED_REVISION:-}"' in text
    # The guard must inspect the source image's label and normalise <no value>.
    assert "docker image inspect --format" in text
    assert '"<no value>"' in text
    # Fail-closed: empty OR mismatch -> abort with exit 1.
    assert '-z "$IMG_REV" || "$IMG_REV" != "$EXPECTED_REVISION"' in text


def test_tc07_provenance_guard_precedes_docker_tag():
    """The fail-closed `exit 1` must sit BEFORE the `docker tag` retag line."""
    text = _HOOK.read_text(encoding="utf-8")
    guard = text.index("$EXPECTED_REVISION")
    retag = text.index('docker tag "$SOURCE_IMAGE" "$TARGET_IMAGE"')
    assert guard < retag, "provenance guard must run before the prod retag"


def test_tc07_build_staging_mode_stamps_git_sha():
    text = _HOOK.read_text(encoding="utf-8")
    # The new Strategy-A rebuild mode exists and is keyed on --build-staging.
    assert '"${1:-}" == "--build-staging"' in text
    # It rebuilds the staging image stamping the validated commit as a build-arg.
    assert 'docker build --build-arg GIT_SHA="$GIT_SHA"' in text


# ---------------------------------------------------------------------------
# TC-08: Dockerfile stamps the OCI revision label from a build-arg
# ---------------------------------------------------------------------------
def test_tc08_dockerfile_stamps_revision_label():
    text = _DOCKERFILE.read_text(encoding="utf-8")
    assert "ARG GIT_SHA" in text
    assert "LABEL org.opencontainers.image.revision=$GIT_SHA" in text