#!/usr/bin/env python3
"""Fail when an enablement template creates a public Kubernetes path."""

from __future__ import annotations

import argparse
import re
import sys
from pathlib import Path


FORBIDDEN = {
    "Ingress resource": re.compile(r"(?m)^\s*kind:\s*(Ingress|IngressRoute)\s*$"),
    "public Service type": re.compile(r"(?m)^\s*type:\s*(LoadBalancer|NodePort)\s*$"),
    "direct kubectl apply": re.compile(r"\bkubectl\s+(?:[^\n]*\s)?apply\b"),
    "direct helm deployment": re.compile(r"\bhelm\s+(upgrade|install)\b"),
}


def violations(paths: list[Path]) -> list[str]:
    found: list[str] = []
    for path in paths:
        text = path.read_text(encoding="utf-8")
        for label, pattern in FORBIDDEN.items():
            if pattern.search(text):
                found.append(f"{path}: {label}")
    return found


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("paths", nargs="*", type=Path)
    args = parser.parse_args()
    paths = args.paths or sorted(Path("workflows").glob("*.yaml"))
    problems = violations(paths)
    if problems:
        print("\n".join(problems), file=sys.stderr)
        return 1
    print(f"private-default template check passed: {len(paths)} file(s)")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())