#!/usr/bin/env bash
set -u

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
TEST_ROOT="$(mktemp -d "${XDG_CACHE_HOME:-$HOME/.cache}/overdeck-immutable-test.XXXXXX")"
DEPLOY="$TEST_ROOT/deploy"
cleanup() { chmod -R u+w "$TEST_ROOT" 2>/dev/null || true; rm -rf "$TEST_ROOT"; }
trap cleanup EXIT

mkdir -p "$DEPLOY/.git" "$DEPLOY/packaging"
printf 'release\n' >"$DEPLOY/packaging/artifact"
printf 'metadata\n' >"$DEPLOY/.git/state"
# shellcheck source=../lib/release-tree.sh
source "$ROOT/packaging/lib/release-tree.sh"

deploy_tree_readonly || exit 1
if { : >"$DEPLOY/packaging/artifact"; } 2>/dev/null; then
  echo 'not ok - a write into the locked release tree succeeded'
  exit 1
fi
printf 'metadata-updated\n' >"$DEPLOY/.git/state" || exit 1
echo 'ok - locked release bytes reject writes while .git remains writable'

deploy_tree_writable || exit 1
printf 'next-release\n' >"$DEPLOY/packaging/artifact" || exit 1
deploy_tree_readonly || exit 1
if { : >"$DEPLOY/packaging/artifact"; } 2>/dev/null; then
  echo 'not ok - the release tree stayed writable after deployment'
  exit 1
fi
echo 'ok - deploy ownership reopens and relocks the release tree'