from pathlib import Path


def test_external_forks_do_not_execute_on_nas_runner():
    workflow = Path(".github/workflows/verify.yml").read_text()
    assert (
        "github.event.pull_request.head.repo.full_name == github.repository" in workflow
    )
    assert "needs: verify" in workflow


def test_private_production_configuration_uses_secrets():
    workflow = Path(".github/workflows/verify.yml").read_text()
    for key in (
        "PROD_DATA_DIR",
        "PROD_CONFIG_DIR",
        "PROD_PHOTOS_DIR",
        "PROD_WEB_BIND",
        "SYNOLOGY_PHOTOS_URL",
        "SYNOLOGY_PHOTOS_CERT_SHA256",
    ):
        assert "${{ secrets." + key + " }}" in workflow
        assert "${{ vars." + key + " }}" not in workflow