// Tests for the release tooling. They live in the module root because that is
// where the script is, and because a broken release script is only discovered
// at the worst possible moment otherwise.
package main

import (
	"os"
	"os/exec"
	"path/filepath"
	"strings"
	"testing"
)

// skipInsideARelease stops a test that runs the release script from running
// while the release script is running it.
//
// The script sets this before `make check`, and `make check` runs this suite.
// Without the guard the two call each other forever — which is not a test-only
// hazard: a real release would recurse in exactly the same way.
func skipInsideARelease(t *testing.T) {
	t.Helper()
	if os.Getenv("TURBO_CORE_RELEASING") != "" {
		t.Skip("running inside a release; not starting another one")
	}
}

// readReleaseScript returns the tag script's text.
func readReleaseScript(t *testing.T) string {
	t.Helper()

	data, err := os.ReadFile("01-release.tag.sh")
	if err != nil {
		t.Fatalf("reading the release script: %v", err)
	}
	return string(data)
}

func TestTheReleaseScriptStopsOnTheFirstFailure(t *testing.T) {
	// Without this, `git tag` refusing an existing tag is skipped in silence
	// and the push that follows pushes the *old* one. It happened in turbo-go.
	if got := readReleaseScript(t); !strings.Contains(got, "set -euo pipefail") {
		t.Error("the script does not stop on failure")
	}
}

func TestTheReleaseScriptChecksBothRefsForTheTag(t *testing.T) {
	// A tag deleted locally after a failed attempt still exists on origin, and
	// that state is invisible from the local repository alone.
	script := readReleaseScript(t)

	for _, want := range []string{"refs/tags/${TAG}", "git ls-remote --tags origin"} {
		if !strings.Contains(script, want) {
			t.Errorf("the script never looks for %q", want)
		}
	}
}

func TestTheReleaseScriptRunsTheSuiteBeforePublishing(t *testing.T) {
	// A version two editors will pin is the wrong place to find out the suite
	// was red.
	if got := readReleaseScript(t); !strings.Contains(got, "make --no-print-directory check") {
		t.Error("the script publishes without running make check")
	}
}

func TestTheReleaseScriptRefusesAReplaceDirective(t *testing.T) {
	// The proxy serves go.mod as written, so a published library carrying a
	// replace tells every consumer to look for turbo-core in a directory that
	// does not exist on their machine.
	if got := readReleaseScript(t); !strings.Contains(got, "replace") {
		t.Error("the script does not check go.mod for a replace directive")
	}
}

func TestThisModuleHasNoReplaceDirective(t *testing.T) {
	// The check above only helps if it is true today as well.
	data, err := os.ReadFile("go.mod")
	if err != nil {
		t.Fatalf("reading go.mod: %v", err)
	}
	for _, line := range strings.Split(string(data), "\n") {
		if strings.HasPrefix(strings.TrimSpace(line), "replace ") {
			t.Errorf("go.mod carries %q; a published library must not", line)
		}
	}
}

func TestTheReleaseScriptTagsOnlyAfterPushing(t *testing.T) {
	// A rejected push must not leave a tag behind pointing at a commit the
	// remote has never seen.
	script := readReleaseScript(t)

	push := strings.Index(script, "git push origin \"$(git rev-parse")
	tag := strings.Index(script, "git tag -a")
	if push < 0 || tag < 0 {
		t.Fatal("the script neither pushes nor tags")
	}
	if tag < push {
		t.Error("the script tags before it pushes")
	}
}

func TestTheReleaseScriptSaysHowToPointTheEditorsAtTheNewVersion(t *testing.T) {
	// Publishing is half the job; an editor still pinning the old version and
	// a replace directive is the state this is designed to get out of.
	script := readReleaseScript(t)

	for _, want := range []string{"go mod edit -require", "-dropreplace"} {
		if !strings.Contains(script, want) {
			t.Errorf("the script never mentions %q", want)
		}
	}
}

func TestMakeVersionReportsSomethingUsable(t *testing.T) {
	out, err := exec.Command("make", "--no-print-directory", "version").Output()
	if err != nil {
		t.Fatalf("make version: %v", err)
	}
	if strings.TrimSpace(string(out)) == "" {
		t.Error("make version printed nothing")
	}
}

func TestTheReleaseScriptTagsAndPushesForReal(t *testing.T) {
	// The whole flow, in a throwaway clone with its own bare remote, so no tag
	// is ever created in the real repository. Reading the script is not the
	// same as running it: every guard above was added because one of them was
	// wrong once.
	skipInsideARelease(t)
	if _, err := exec.LookPath("git"); err != nil {
		t.Skip("git is not available")
	}

	root := t.TempDir()
	remote := filepath.Join(root, "remote.git")
	clone := filepath.Join(root, "clone")

	run(t, root, "git", "init", "--bare", "--initial-branch=main", remote)
	run(t, root, "git", "clone", remote, clone)
	copyModuleInto(t, clone)
	run(t, clone, "git", "config", "user.email", "test@example.test")
	run(t, clone, "git", "config", "user.name", "Release Test")
	writeFile(t, filepath.Join(clone, "release.env"), "TAG=v0.0.1-test\nABOUT=\"a throwaway release\"\n")

	out, err := runAllowingFailure(t, clone, "./01-release.tag.sh")
	if err != nil {
		t.Fatalf("the release script failed:\n%s", out)
	}
	if !strings.Contains(out, "published") {
		t.Errorf("the script did not report publishing:\n%s", out)
	}

	tags, _ := runAllowingFailure(t, remote, "git", "tag")
	if !strings.Contains(tags, "v0.0.1-test") {
		t.Errorf("the remote has tags %q, want v0.0.1-test", strings.TrimSpace(tags))
	}
}

func TestTheReleaseScriptRefusesATagItAlreadyPublished(t *testing.T) {
	// Moving a published version is not an option: two editors may pin it, and
	// the proxy caches what it fetched.
	skipInsideARelease(t)
	if _, err := exec.LookPath("git"); err != nil {
		t.Skip("git is not available")
	}

	root := t.TempDir()
	remote := filepath.Join(root, "remote.git")
	clone := filepath.Join(root, "clone")

	run(t, root, "git", "init", "--bare", "--initial-branch=main", remote)
	run(t, root, "git", "clone", remote, clone)
	copyModuleInto(t, clone)
	run(t, clone, "git", "config", "user.email", "test@example.test")
	run(t, clone, "git", "config", "user.name", "Release Test")
	writeFile(t, filepath.Join(clone, "release.env"), "TAG=v0.0.1-test\nABOUT=\"a throwaway release\"\n")

	if out, err := runAllowingFailure(t, clone, "./01-release.tag.sh"); err != nil {
		t.Fatalf("the first release failed:\n%s", out)
	}

	out, err := runAllowingFailure(t, clone, "./01-release.tag.sh")

	if err == nil {
		t.Fatalf("the script published the same tag twice:\n%s", out)
	}
	if !strings.Contains(out, "already exists") {
		t.Errorf("the refusal does not say the tag is taken:\n%s", out)
	}
}

// copyModuleInto copies the module's source into a directory, so the script can
// be run against a real checkout without touching this one.
//
// .git is left out because the target has its own, and *.env because those hold
// the release token — a test has no use for it, and copying a secret into a
// temporary directory is how it ends up somewhere nobody looks.
func copyModuleInto(t *testing.T, target string) {
	t.Helper()

	entries, err := os.ReadDir(".")
	if err != nil {
		t.Fatalf("reading the module: %v", err)
	}
	for _, entry := range entries {
		if entry.Name() == ".git" || strings.HasSuffix(entry.Name(), ".env") {
			continue
		}
		run(t, ".", "cp", "-r", entry.Name(), target)
	}
}

// run executes a command in a directory, failing the test if it does not
// succeed.
func run(t *testing.T, dir string, name string, args ...string) {
	t.Helper()

	if out, err := runAllowingFailure(t, dir, name, args...); err != nil {
		t.Fatalf("%s %v: %v\n%s", name, args, err, out)
	}
}

// runAllowingFailure executes a command and returns its combined output along
// with whether it succeeded.
func runAllowingFailure(t *testing.T, dir string, name string, args ...string) (string, error) {
	t.Helper()

	command := exec.Command(name, args...)
	command.Dir = dir
	out, err := command.CombinedOutput()
	return string(out), err
}

// writeFile creates a file, failing the test if it cannot.
func writeFile(t *testing.T, path, contents string) {
	t.Helper()

	if err := os.WriteFile(path, []byte(contents), 0o644); err != nil {
		t.Fatalf("writing %s: %v", path, err)
	}
}

// readPublishScript returns the release-page script's text.
func readPublishScript(t *testing.T) string {
	t.Helper()

	data, err := os.ReadFile("02-release.publish.sh")
	if err != nil {
		t.Fatalf("reading the publish script: %v", err)
	}
	return string(data)
}

func TestThePublishScriptBuildsItsJSONWithJq(t *testing.T) {
	// Hand-written JSON in a heredoc breaks silently the day ABOUT contains a
	// quote, a newline or a backtick — and the release notes are exactly where
	// somebody puts a backtick.
	script := readPublishScript(t)

	if !strings.Contains(script, "jq -n") {
		t.Error("the script builds its payload by hand rather than with jq")
	}
	// Comment lines are skipped: the script's own comment explains why it
	// avoids that idiom, and a grep over the whole file matches the
	// explanation. This test failed on its own prose before it was narrowed.
	for _, line := range codeLines(script) {
		if strings.Contains(line, `read -r -d ''`) {
			t.Errorf("the script uses the read -r -d '' idiom, which always exits non-zero: %s", line)
		}
	}
}

func TestThePublishScriptStopsOnTheFirstFailure(t *testing.T) {
	// Safe here precisely because it does not use that idiom.
	if got := readPublishScript(t); !strings.Contains(got, "set -euo pipefail") {
		t.Error("the script does not stop on failure")
	}
}

func TestThePublishScriptTellsUnreachableFromAbsent(t *testing.T) {
	// git ls-remote exits 2 when a ref is absent and 128 when it cannot reach
	// the remote. Conflating them refuses a good release from any machine with
	// no key loaded — which is how this was found.
	script := readPublishScript(t)

	if !strings.Contains(script, "lookup=$?") {
		t.Error("the script does not look at ls-remote's exit code")
	}
	for _, want := range []string{"is not on origin", "cannot reach origin"} {
		if !strings.Contains(script, want) {
			t.Errorf("the script never says %q", want)
		}
	}
}

func TestThePublishScriptTellsTheHTTPStatusesApart(t *testing.T) {
	// "❌ something went wrong" plus the API's raw JSON leaves the reader to
	// guess which of four quite different problems this is.
	script := readPublishScript(t)

	for _, status := range []string{"201", "409", "401", "404"} {
		if !strings.Contains(script, status) {
			t.Errorf("the script does not handle HTTP %s", status)
		}
	}
}

func TestThePublishScriptDryRunSendsNothing(t *testing.T) {
	// The only way to exercise this script here: the real call publishes on
	// somebody's behalf, which a test may not do.
	skipInsideARelease(t)
	if _, err := exec.LookPath("jq"); err != nil {
		t.Skip("jq is not installed")
	}

	dir := t.TempDir()
	copyModuleInto(t, dir)
	writeFile(t, filepath.Join(dir, "release.env"),
		"TAG=\"v0.0.1-test\"\nABOUT=\"notes with a \\\" quote\"\nOWNER=\"turbo-editors\"\nREPO=\"turbo-core\"\n")
	writeFile(t, filepath.Join(dir, "turbo-core.token.env"), "TOKEN=not-a-real-token\n")

	out, err := runAllowingFailure(t, dir, "./02-release.publish.sh", "--dry-run")

	if err != nil {
		t.Fatalf("the dry run failed:\n%s", out)
	}
	if !strings.Contains(out, "nothing was sent") {
		t.Errorf("the dry run does not say it sent nothing:\n%s", out)
	}
	if !strings.Contains(out, "POST https://codeberg.org/api/v1/repos/turbo-editors/turbo-core/releases") {
		t.Errorf("the dry run does not show the request it would make:\n%s", out)
	}
	// The quote in ABOUT must have survived as data rather than breaking the
	// JSON, which is the whole reason jq is in there.
	if !strings.Contains(out, `notes with a \" quote`) {
		t.Errorf("the quote in the notes was not escaped:\n%s", out)
	}
}

func TestThePublishScriptRefusesWithoutAToken(t *testing.T) {
	skipInsideARelease(t)

	dir := t.TempDir()
	copyModuleInto(t, dir)
	writeFile(t, filepath.Join(dir, "release.env"),
		"TAG=\"v0.0.1-test\"\nABOUT=\"notes\"\nOWNER=\"turbo-editors\"\nREPO=\"turbo-core\"\n")

	out, err := runAllowingFailure(t, dir, "./02-release.publish.sh", "--dry-run")

	if err == nil {
		t.Fatalf("the script ran without a token:\n%s", out)
	}
	if !strings.Contains(out, "TOKEN is not set") {
		t.Errorf("the refusal does not say the token is missing:\n%s", out)
	}
}

func TestThePublishScriptLinksToTheDocumentationAtThatTag(t *testing.T) {
	// A release page is not inside the repository tree, so a relative path from
	// it 404s — and a link to the branch would rot as the branch moves.
	script := readPublishScript(t)

	if !strings.Contains(script, "/src/tag/${TAG}/docs/") {
		t.Error("the release notes do not link to the documentation at the released tag")
	}
}

// codeLines returns the lines of a shell script that are not comments.
func codeLines(script string) []string {
	var out []string
	for _, line := range strings.Split(script, "\n") {
		if trimmed := strings.TrimSpace(line); trimmed != "" && !strings.HasPrefix(trimmed, "#") {
			out = append(out, line)
		}
	}
	return out
}