from pathlib import Path
import subprocess
import sys
import tempfile
import unittest


ROOT = Path(__file__).parents[2]
CHECKER = ROOT / "scripts" / "verify_supply_chain.py"


class SupplyChainTest(unittest.TestCase):
    def run_checker(self, *args):
        return subprocess.run([sys.executable, str(CHECKER), *args], cwd=ROOT, text=True, capture_output=True)

    def test_checked_in_references_are_digest_pinned(self):
        result = self.run_checker()
        self.assertEqual(result.returncode, 0, result.stderr)

    def test_checker_rejects_tags_plaintext_secrets_and_template_release(self):
        with tempfile.TemporaryDirectory() as directory:
            root = Path(directory)
            dockerfile = root / "Dockerfile"
            manifests = root / "manifests"
            manifests.mkdir()
            dockerfile.write_text("FROM example.invalid/game:latest\n")
            (manifests / "bad.yaml").write_text("image: example.invalid/game@sha256:" + "0" * 64 + "\npassword: leaked\n")
            result = self.run_checker("--dockerfile", str(dockerfile), "--manifest-dir", str(manifests), "--require-concrete")
            self.assertNotEqual(result.returncode, 0)
            self.assertIn("not digest-pinned", result.stderr)
            self.assertIn("plaintext credential", result.stderr)
            self.assertIn("not a release artifact", result.stderr)


if __name__ == "__main__":
    unittest.main()