from pathlib import Path


def test_external_forks_do_not_execute_on_nas_runner():
    workflow = Path(".github/workflows/verify.yml").read_text()
    assert (
        "github.event.pull_request.head.repo.full_name == github.repository" in workflow
    )
    assert "python scripts/production-deploy.py" not in workflow


def test_verification_runner_receives_no_production_configuration():
    workflow = Path(".github/workflows/verify.yml").read_text()
    for key in (
        "PROD_DATA_DIR",
        "PROD_CONFIG_DIR",
        "PROD_PHOTOS_DIR",
        "PROD_WEB_BIND",
        "SYNOLOGY_PHOTOS_URL",
        "SYNOLOGY_PHOTOS_CERT_SHA256",
    ):
        assert "${{ secrets." + key + " }}" not in workflow
        assert "${{ vars." + key + " }}" not in workflow


def test_actions_downloads_do_not_depend_on_personal_server():
    import re

    workflow = Path(".github/workflows/verify.yml").read_text()
    actions = re.findall(r"uses:\s*(\S+)", workflow)
    assert len(actions) == 2
    for action in actions:
        assert re.fullmatch(
            r"https://github\.com/actions/(checkout|setup-python)@[0-9a-f]{40}",
            action,
        )


def test_community_checks_are_isolated_from_private_runners():
    import yaml

    private = yaml.safe_load(Path(".github/workflows/verify.yml").read_text())
    public = yaml.safe_load(Path(".github/workflows/community.yml").read_text())
    assert (
        "github.server_url != 'https://github.com'" in private["jobs"]["verify"]["if"]
    )
    job = public["jobs"]["verify"]
    assert job["if"] == "github.server_url == 'https://github.com'"
    assert job["runs-on"] == "ubuntu-latest"
    assert public["permissions"] == {"contents": "read"}
    workflow = Path(".github/workflows/community.yml").read_text()
    assert "secrets." not in workflow
    assert "production-deploy" not in workflow
    assert "pull_request_target" not in workflow
    assert "persist-credentials: false" in workflow