#!/usr/bin/env bash
set -euo pipefail

repo=""
workflow=""
ref="main"
scale_set="awp-untrusted"
namespace="awp-runners-untrusted"
run=false
yes=false
while [[ $# -gt 0 ]]; do
  case "$1" in
    --run) run=true ;;
    --yes) yes=true ;;
    --repo) repo="$2"; shift ;;
    --workflow) workflow="$2"; shift ;;
    --ref) ref="$2"; shift ;;
    --scale-set) scale_set="$2"; shift ;;
    --namespace) namespace="$2"; shift ;;
    *) echo "unknown argument: $1" >&2; exit 2 ;;
  esac
  shift
done

if [[ "$run" != true || -z "$repo" || -z "$workflow" ]]; then
  cat <<'TXT'
ARC live proof harness. It requires an already-installed scale set and a project-owned
workflow that targets that scale-set name. It snapshots runner pods, dispatches the
workflow through GitHub CLI, waits for completion, inspects runner security, and proves
the ephemeral runner pod is removed.

Usage:
  tools/preflight/arc-ephemeral-proof.sh --run --repo OWNER/REPO --workflow FILE_OR_NAME [--ref main] [--yes]
TXT
  exit 0
fi
command -v kubectl >/dev/null 2>&1 || { echo "kubectl required" >&2; exit 2; }
command -v gh >/dev/null 2>&1 || { echo "gh required" >&2; exit 2; }
ctx="$(kubectl config current-context)"
printf 'context=%s\nrepo=%s\nworkflow=%s\nscaleSet=%s\nnamespace=%s\n' "$ctx" "$repo" "$workflow" "$scale_set" "$namespace"
if [[ "$yes" != true ]]; then
  read -r -p "Dispatch one real CI proof workflow? [y/N] " answer
  [[ "$answer" =~ ^[Yy]$ ]] || exit 3
fi

kubectl get namespace "$namespace" >/dev/null
kubectl get autoscalingrunnersets.actions.github.com -n "$namespace" 2>/dev/null | grep -F "$scale_set" >/dev/null || {
  echo "scale set $scale_set is not installed in $namespace" >&2; exit 4;
}
before="$(mktemp)"; after="$(mktemp)"
trap 'rm -f "$before" "$after"' EXIT
kubectl get pods -n "$namespace" -o name | sort >"$before"

dispatch_time="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
gh workflow run "$workflow" --repo "$repo" --ref "$ref"
run_id=""
for _ in $(seq 1 30); do
  run_id="$(gh run list --repo "$repo" --workflow "$workflow" --event workflow_dispatch --limit 10 --json databaseId,createdAt --jq ".[] | select(.createdAt >= \"$dispatch_time\") | .databaseId" | head -1)"
  [[ -n "$run_id" ]] && break
  sleep 2
done
[[ -n "$run_id" ]] || { echo "could not correlate dispatched workflow run" >&2; exit 5; }
printf 'runId=%s\n' "$run_id"

runner_pod=""
for _ in $(seq 1 90); do
  runner_pod="$(kubectl get pods -n "$namespace" -l actions.github.com/scale-set-name="$scale_set" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)"
  [[ -n "$runner_pod" ]] && break
  sleep 2
done
[[ -n "$runner_pod" ]] || { echo "no ephemeral runner pod observed" >&2; exit 6; }
printf 'runnerPod=%s\n' "$runner_pod"

pod_json="$(kubectl get pod -n "$namespace" "$runner_pod" -o json)"
printf '%s' "$pod_json" | grep -q '"runtimeClassName":"gvisor"'
printf '%s' "$pod_json" | grep -q '"automountServiceAccountToken":false'
if printf '%s' "$pod_json" | grep -Eq 'GH_TOKEN|GITHUB_TOKEN|github_pat_|ghp_'; then
  echo "runner pod contains a reusable-looking Git credential marker" >&2; exit 7
fi

gh run watch "$run_id" --repo "$repo" --exit-status
for _ in $(seq 1 90); do
  kubectl get pod -n "$namespace" "$runner_pod" >/dev/null 2>&1 || break
  sleep 2
done
kubectl get pod -n "$namespace" "$runner_pod" >/dev/null 2>&1 && {
  echo "runner pod still exists after completed job" >&2; exit 8;
}
kubectl get pods -n "$namespace" -o name | sort >"$after"
echo "PASS: real GitHub workflow completed on an ephemeral ARC runner; observed pod was removed and exposed no reusable publication credential marker."