import { readFileSync } from "node:fs";
import { resolve } from "node:path";
import { describe, expect, it } from "vitest";

const root = resolve(import.meta.dirname, "../../..");
const read = (path: string) => readFileSync(resolve(root, path), "utf8");

describe("ARC trust substrate", () => {
  it("uses separate namespaces and scale sets for untrusted, trusted and privileged profiles", () => {
    const namespaces = read("infra/arc/runner-namespaces.yaml");
    expect(namespaces).toContain("awp-runners-untrusted");
    expect(namespaces).toContain("awp-runners-trusted");
    expect(namespaces).toContain("awp-runners-privileged");

    expect(read("infra/arc/scale-set-untrusted-values.yaml")).toContain(
      "runnerScaleSetName: awp-untrusted",
    );
    expect(read("infra/arc/scale-set-trusted-values.yaml")).toContain(
      "runnerScaleSetName: awp-trusted-internal",
    );
    expect(read("infra/arc/scale-set-privileged-build-values.yaml")).toContain(
      "runnerScaleSetName: awp-privileged-build",
    );
  });

  it("keeps the default runner ephemeral, gVisor-backed and unprivileged", () => {
    const values = read("infra/arc/scale-set-untrusted-values.yaml");
    expect(values).toContain("minRunners: 0");
    expect(values).toContain("runtimeClassName: gvisor");
    expect(values).toContain("automountServiceAccountToken: false");
    expect(values).toContain("allowPrivilegeEscalation: false");
    expect(values).toContain("privileged: false");
    expect(values).toContain('drop: ["ALL"]');
  });

  it("runs repository CI for trusted AWP publication branches without Agent credentials", () => {
    const workflow = read(".github/workflows/ci.yml");
    expect(workflow).toContain('      - "awp/**"');
    expect(workflow).toContain("branches:");
    expect(workflow).toContain("      - main");
  });

  it("stores only a GitHub auth secret reference in versioned values", () => {
    for (const path of [
      "infra/arc/scale-set-untrusted-values.yaml",
      "infra/arc/scale-set-trusted-values.yaml",
      "infra/arc/scale-set-privileged-build-values.yaml",
    ]) {
      const source = read(path);
      expect(source).toContain("githubConfigSecret: awp-arc-github-app");
      expect(source).not.toMatch(/github_app_private_key|github_token:|BEGIN (RSA|PRIVATE) KEY/);
    }
  });
});