#!/bin/sh
# Tests for the CI gate workflow.
#
# The regression these exist for: this repo had a release workflow that
# auto-tagged every push to main, and a `task check` / `task test` suite that
# nothing ever ran. CI reported green having tested nothing — a gate that
# fails *open*. These assertions pin the wiring so it cannot silently regress.

set -u

ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
SUT="$ROOT/.gitea/workflows/ci.yml"

pass=0
fail=0

ok() { pass=$((pass + 1)); printf '  ok   %s\n' "$1"; }
no() { fail=$((fail + 1)); printf '  FAIL %s\n' "$1"; }

if [ ! -f "$SUT" ]; then
  printf 'FAIL: %s does not exist\n' "$SUT"
  exit 1
fi
ok 'ci.yml exists'

# A pull_request trigger is what gives tbd_ship a CI run to read on the head
# commit of a branch; without one it fails closed and never merges (#22).
grep -qE '^  pull_request:' "$SUT" \
  && ok 'runs on pull_request' \
  || no 'runs on pull_request'

grep -qE '^ +push:' "$SUT" \
  && ok 'runs on push' \
  || no 'runs on push'

grep -qE '^ +- *(run: *)?task check$|task check' "$SUT" \
  && ok 'gate runs task check' \
  || no 'gate runs task check'

grep -qE 'task test' "$SUT" \
  && ok 'gate runs task test' \
  || no 'gate runs task test'

# The point of the gate: tagging must not happen on a red check.
tag_job=$(awk '/^  tag:/{f=1} f&&/^  [a-z][a-z_-]*:/&&!/^  tag:/{f=0} f' "$SUT")
printf '%s' "$tag_job" | grep -qE '^ +needs: *gate' \
  && ok 'tag job needs the gate' \
  || no 'tag job needs the gate'

# The old workflow file must be gone, or two workflows race on the same push
# and the ungated one still tags.
[ ! -f "$ROOT/.gitea/workflows/release.yml" ] \
  && ok 'ungated release.yml removed' \
  || no 'ungated release.yml removed'

printf '\nci_gate: %d passed, %d failed\n' "$pass" "$fail"
[ "$fail" -eq 0 ]