#!/usr/bin/env bash
# shellcheck disable=SC2016 # Assertions intentionally match literal workflow variables.
set -euo pipefail

root=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
workflow=$root/.gitea/workflows/ci.yml
runner_service=$root/deploy/ci/easyai-gateway-act-runner.service
runner_config=$root/deploy/ci/act-runner-config.yaml
provision=$root/scripts/provision-ci-runner.sh
build_images=$root/scripts/ci-build-images.sh

for file in "$workflow" "$runner_service" "$runner_config" "$provision" "$build_images"; do
  [[ -f $file ]] || {
    printf 'missing CI/CD file: %s\n' "$file" >&2
    exit 1
  }
done

grep -q '^name: ci$' "$workflow"
grep -q '^    branches: \[main\]$' "$workflow"
grep -q "^    tags: \['v\*'\]$" "$workflow"
grep -q '^  pull_request:$' "$workflow"
grep -q '^    runs-on: easyai-gateway-linux$' "$workflow"
grep -q '^      - name: Checkout without external Actions$' "$workflow"
grep -q '^      - name: Verify release tag ancestry$' "$workflow"
grep -Fq "if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')" "$workflow"
grep -Fq 'git merge-base --is-ancestor "$CI_SHA" refs/remotes/origin/main' "$workflow"
grep -q '^      - run: ./scripts/ci-build-images.sh$' "$workflow"
grep -q '^      - name: Deploy verified release to Production$' "$workflow"
grep -q '^          sudo -n /usr/local/sbin/easyai-ai-gateway-release "$CI_SHA"$' "$workflow"

for gate in \
  'gofmt -l' \
  'go vet ./...' \
  'go test ./...' \
  'pnpm install --frozen-lockfile' \
  'pnpm lint' \
  'pnpm test' \
  'pnpm build' \
  'docker compose -f docker-compose.yml config --quiet' \
  'govulncheck ./...' \
  'trivy fs'; do
  grep -Fq "$gate" "$workflow" || {
    printf 'workflow is missing quality gate: %s\n' "$gate" >&2
    exit 1
  }
done

grep -q '^User=easyai-gateway-runner$' "$runner_service"
grep -q '^Group=easyai-gateway-runner$' "$runner_service"
grep -q '^NoNewPrivileges=false$' "$runner_service"
grep -q '^ProtectSystem=strict$' "$runner_service"
grep -q '^ProtectHome=true$' "$runner_service"
grep -q '^ReadWritePaths=/var/lib/easyai-gateway-runner$' "$runner_service"
grep -q '^ExecStart=/opt/easyai-gateway-ci/bin/gitea-runner --config /etc/easyai-gateway-runner/config.yaml daemon --once$' "$runner_service"
grep -q 'easyai-gateway-linux:host' "$runner_config"
grep -q '^  capacity: 1$' "$runner_config"

grep -q '^GITEA_RUNNER_VERSION=2.0.0$' "$provision"
grep -q '^GO_VERSION=1.26.5$' "$provision"
grep -q '^NODE_VERSION=24.16.0$' "$provision"
grep -q '^TRIVY_VERSION=0.70.0$' "$provision"
grep -Fq 'usermod -aG docker "$RUNNER_USER"' "$provision"
grep -Fq 'RUNNER_REGISTRATION_TOKEN is required for first registration' "$provision"

grep -Fq 'docker buildx build --builder "$builder"' "$build_images"
grep -q -- '--target api' "$build_images"
grep -q -- '--target web' "$build_images"
grep -Fq 'docker buildx prune --builder "$builder" --force --max-used-space "$cache_limit"' "$build_images"
grep -Fq 'trivy image' "$build_images"

if rg -n '(password|secret|token):[[:space:]]+[^$<{]' "$workflow"; then
  echo 'workflow contains a literal credential' >&2
  exit 1
fi

echo 'gateway_ci_pipeline_tests=PASS'