"""Mechanical checks on the deployment manifest's image pinning.

These exist because the manifest drifted in a way review did not catch: the
release was published and pinned, while three documents went on instructing an
operator to replace a placeholder that no longer existed. A pin is exactly the
kind of property a test can hold and prose cannot.
"""

from __future__ import annotations

import re
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
MANIFEST = ROOT / "deploy" / "approval-engine.yaml"

IMAGE_LINE = re.compile(r"^\s*image:\s*(\S+)\s*$", re.MULTILINE)
DIGEST_PIN = re.compile(r"^[^\s@]+@sha256:[0-9a-f]{64}$")


def image_refs() -> list[str]:
    return IMAGE_LINE.findall(MANIFEST.read_text(encoding="utf-8"))


def test_manifest_declares_both_images():
    """The init container and the server are two references, not one."""
    refs = image_refs()
    assert len(refs) == 2, f"expected 2 image references, found {len(refs)}: {refs}"


def test_images_are_digest_pinned_not_tagged():
    """A tag would let the migration and the server run different code.

    They share one database: the init container migrates it and the server then
    serves it. A floating tag makes 'the schema the migration wrote' and 'the
    schema the server expects' independently resolvable, which is the failure
    the digest pin exists to prevent.
    """
    for ref in image_refs():
        assert DIGEST_PIN.match(ref), f"image is not digest-pinned: {ref!r}"


def test_both_images_are_identical():
    """Two different digests here is a split-brain migration waiting to happen."""
    refs = image_refs()
    assert len(set(refs)) == 1, f"image references differ: {sorted(set(refs))}"


def test_no_release_placeholder_remains():
    """Catches the drift that motivated this file.

    A placeholder left in the manifest is caught by the digest-pin check above;
    this asserts the specific token is gone so a half-applied release cannot
    reintroduce it silently.
    """
    text = MANIFEST.read_text(encoding="utf-8")
    assert "REPLACE_WITH_RELEASE_DIGEST" not in text


def test_deploy_readme_does_not_instruct_replacing_a_pinned_placeholder():
    """The runbook and the manifest must not disagree about what is left to do.

    While the manifest carries a real digest, an operator instruction to replace
    a placeholder is an instruction to undo the pin.
    """
    manifest = MANIFEST.read_text(encoding="utf-8")
    readme = (ROOT / "deploy" / "README.md").read_text(encoding="utf-8")
    if "REPLACE_WITH_RELEASE_DIGEST" not in manifest:
        assert "replace `REPLACE_WITH_RELEASE_DIGEST`" not in readme