#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
SRC_SCRIPTS="${PROJECT_DIR}/src/scripts"
PASS=0
FAIL=0

# Test helper functions
pass() {
  echo "PASS"
  PASS=$((PASS + 1))
}

fail() {
  local msg="${1:-}"
  echo "FAIL${msg:+ ($msg)}"
  FAIL=$((FAIL + 1))
}

# =============================================================================
# Test: node_test.sh - Custom test commands
# =============================================================================
echo "=== node_test.sh Tests ==="

echo -n "  TEST: runs custom test commands via bash -c (not eval)... "
# Verify the script uses bash -c, not eval
if grep -q 'bash -c "\${CMD}"' "${SRC_SCRIPTS}/node_test.sh"; then
  pass
else
  fail "script should use 'bash -c' not 'eval'"
fi

echo -n "  TEST: creates reports/junit directory... "
if grep -q 'mkdir -p reports/junit' "${SRC_SCRIPTS}/node_test.sh"; then
  pass
else
  fail "should create reports/junit"
fi

echo -n "  TEST: handles empty TEST_COMMANDS_JSON... "
if grep -q '\[\]' "${SRC_SCRIPTS}/node_test.sh" && grep -q 'null' "${SRC_SCRIPTS}/node_test.sh"; then
  pass
else
  fail "should handle empty/null JSON"
fi

# =============================================================================
# Test: docker_push_ghcr.sh - Secret validation
# =============================================================================
echo ""
echo "=== docker_push_ghcr.sh Tests ==="

echo -n "  TEST: validates DOCKER_IMAGE is set... "
if grep -q 'DOCKER_IMAGE:?' "${SRC_SCRIPTS}/docker_push_ghcr.sh"; then
  pass
else
  fail "should validate DOCKER_IMAGE"
fi

echo -n "  TEST: validates DOCKER_TAG is set... "
if grep -q 'DOCKER_TAG:?' "${SRC_SCRIPTS}/docker_push_ghcr.sh"; then
  pass
else
  fail "should validate DOCKER_TAG"
fi

echo -n "  TEST: validates GHCR credentials... "
if grep -q 'if \[\[ -z "\${TOKEN}"' "${SRC_SCRIPTS}/docker_push_ghcr.sh"; then
  pass
else
  fail "should validate TOKEN"
fi

echo -n "  TEST: uses --password-stdin for docker login... "
if grep -q '\-\-password-stdin' "${SRC_SCRIPTS}/docker_push_ghcr.sh"; then
  pass
else
  fail "should use --password-stdin"
fi

# =============================================================================
# Test: github_release.sh - Secret validation
# =============================================================================
echo ""
echo "=== github_release.sh Tests ==="

echo -n "  TEST: validates GITHUB_TOKEN is set... "
if grep -q 'GITHUB_TOKEN' "${SRC_SCRIPTS}/github_release.sh" && grep -q 'ERROR.*GITHUB_TOKEN' "${SRC_SCRIPTS}/github_release.sh"; then
  pass
else
  fail "should validate GITHUB_TOKEN"
fi

echo -n "  TEST: validates PROJECT_VERSION is set... "
if grep -q 'PROJECT_VERSION' "${SRC_SCRIPTS}/github_release.sh"; then
  pass
else
  fail "should validate PROJECT_VERSION"
fi

echo -n "  TEST: creates GitHub Release with --generate-notes... "
if grep -q 'gh release create' "${SRC_SCRIPTS}/github_release.sh" && grep -q '\-\-generate-notes' "${SRC_SCRIPTS}/github_release.sh"; then
  pass
else
  fail "should create GitHub Release with --generate-notes"
fi

echo -n "  TEST: uses dynamic --target (not hardcoded main)... "
if grep -q '\-\-target "\${TARGET}"' "${SRC_SCRIPTS}/github_release.sh"; then
  pass
else
  fail "should use dynamic --target"
fi

echo -n "  TEST: supports --prerelease flag for RC versions... "
if grep -q '\-\-prerelease' "${SRC_SCRIPTS}/github_release.sh" && grep -q 'PRERELEASE_FLAG' "${SRC_SCRIPTS}/github_release.sh"; then
  pass
else
  fail "should support --prerelease flag"
fi

echo -n "  TEST: detects RC/alpha/beta/SNAPSHOT versions... "
if grep -q 'RC|alpha|beta|SNAPSHOT' "${SRC_SCRIPTS}/github_release.sh"; then
  pass
else
  fail "should detect pre-release version patterns"
fi

echo -n "  TEST: uses CIRCLE_BRANCH for pre-release target... "
if grep -q 'CIRCLE_BRANCH' "${SRC_SCRIPTS}/github_release.sh"; then
  pass
else
  fail "should use CIRCLE_BRANCH for pre-release target"
fi

echo -n "  TEST: skips if release already exists... "
if grep -q 'already exists, skipping' "${SRC_SCRIPTS}/github_release.sh"; then
  pass
else
  fail "should skip existing releases"
fi

# =============================================================================
# Test: calculate_version.sh - Munitor-managed GitVersion config
# =============================================================================
echo ""
echo "=== calculate_version.sh Tests ==="

echo -n "  TEST: writes GitVersion.yml before running GitVersion... "
if grep -q 'cat > GitVersion.yml' "${SRC_SCRIPTS}/calculate_version.sh"; then
  pass
else
  fail "should write GitVersion.yml"
fi

echo -n "  TEST: includes tag-prefix: v in GitVersion config... "
if grep -q 'tag-prefix: v' "${SRC_SCRIPTS}/calculate_version.sh"; then
  pass
else
  fail "should include tag-prefix: v"
fi

echo -n "  TEST: warns if repo already has GitVersion.yml... "
if grep -q 'WARNING.*GitVersion.yml' "${SRC_SCRIPTS}/calculate_version.sh"; then
  pass
else
  fail "should warn about existing GitVersion.yml"
fi

echo -n "  TEST: enables commit-message-incrementing... "
if grep -q 'commit-message-incrementing: Enabled' "${SRC_SCRIPTS}/calculate_version.sh"; then
  pass
else
  fail "should enable commit-message-incrementing"
fi

# =============================================================================
# Test: npm_auth.sh - Secret validation
# =============================================================================
echo ""
echo "=== npm_auth.sh Tests ==="

echo -n "  TEST: validates NPM_TOKEN is set... "
if grep -q 'if \[\[ -z "\${NPM_TOKEN:-}"' "${SRC_SCRIPTS}/npm_auth.sh"; then
  pass
else
  fail "should validate NPM_TOKEN"
fi

echo -n "  TEST: configures .npmrc securely... "
if grep -q '_authToken=\${NPM_TOKEN}' "${SRC_SCRIPTS}/npm_auth.sh"; then
  pass
else
  fail "should use NPM_TOKEN in .npmrc"
fi

echo -n "  TEST: always includes @koftwentytwo scope... "
if grep -q '@koftwentytwo' "${SRC_SCRIPTS}/npm_auth.sh"; then
  pass
else
  fail "should always include @koftwentytwo scope"
fi

echo -n "  TEST: supports additional scopes via NPM_SCOPES... "
if grep -q 'NPM_SCOPES' "${SRC_SCRIPTS}/npm_auth.sh"; then
  pass
else
  fail "should read NPM_SCOPES env var"
fi

# =============================================================================
# Test: health_check.sh - Generic PG env vars
# =============================================================================
echo ""
echo "=== health_check.sh Tests ==="

echo -n "  TEST: passes Liquibase env vars for java-webapp compat... "
if grep -q 'LIQUIBASE_USERNAME' "${SRC_SCRIPTS}/health_check.sh"; then
  pass
else
  fail "should pass Liquibase env vars"
fi

echo -n "  TEST: passes generic PG env vars for non-Liquibase apps... "
if grep -q 'PG_HOST' "${SRC_SCRIPTS}/health_check.sh"; then
  pass
else
  fail "should pass PG_HOST env var"
fi

echo -n "  TEST: passes PG_SSL=false for sidecar... "
if grep -q 'PG_SSL=false' "${SRC_SCRIPTS}/health_check.sh"; then
  pass
else
  fail "should pass PG_SSL=false"
fi

echo -n "  TEST: passes complete RDBMS env vars for sidecar... "
if grep -q 'RDBMS_VENDOR=postgresql' "${SRC_SCRIPTS}/health_check.sh" \
  && grep -q 'RDBMS_DATABASE_NAME=postgres' "${SRC_SCRIPTS}/health_check.sh" \
  && grep -q 'RDBMS_USERNAME=postgres' "${SRC_SCRIPTS}/health_check.sh" \
  && grep -q 'RDBMS_PASSWORD=postgres' "${SRC_SCRIPTS}/health_check.sh"; then
  pass
else
  fail "should pass all six RDBMS_* env vars"
fi

# =============================================================================
# Test: mvn_sonar.sh - Secret validation
# =============================================================================
echo ""
echo "=== mvn_sonar.sh Tests ==="

echo -n "  TEST: validates SONAR_PROJECT_KEY is set... "
if grep -q 'SONAR_PROJECT_KEY:?' "${SRC_SCRIPTS}/mvn_sonar.sh"; then
  pass
else
  fail "should validate SONAR_PROJECT_KEY"
fi

echo -n "  TEST: validates TOKEN is set... "
if grep -q 'if \[\[ -z "\${TOKEN}"' "${SRC_SCRIPTS}/mvn_sonar.sh"; then
  pass
else
  fail "should validate TOKEN"
fi

# =============================================================================
# Test: start_services.sh - Security
# =============================================================================
echo ""
echo "=== start_services.sh Tests ==="

echo -n "  TEST: uses bash -c for healthcheck (not eval)... "
if grep -q 'bash -c "\${HEALTHCHECK}"' "${SRC_SCRIPTS}/start_services.sh"; then
  pass
else
  fail "should use 'bash -c' not 'eval'"
fi

echo -n "  TEST: has health timeout... "
if grep -q 'HEALTH_TIMEOUT' "${SRC_SCRIPTS}/start_services.sh"; then
  pass
else
  fail "should have health timeout"
fi

# =============================================================================
# Test: node_coverage_check.sh - Security
# =============================================================================
echo ""
echo "=== node_coverage_check.sh Tests ==="

echo -n "  TEST: uses bash -c for coverage command (not eval)... "
if grep -q 'bash -c "\${COVERAGE_COMMAND}"' "${SRC_SCRIPTS}/node_coverage_check.sh"; then
  pass
else
  fail "should use 'bash -c' not 'eval'"
fi

# =============================================================================
# Test: update_cd_repo.sh - CD_ENVIRONMENT support
# =============================================================================
echo ""
echo "=== update_cd_repo.sh Tests ==="

echo -n "  TEST: reads CD_ENVIRONMENT from env... "
if grep -q 'CD_ENVIRONMENT' "${SRC_SCRIPTS}/update_cd_repo.sh"; then
  pass
else
  fail "should reference CD_ENVIRONMENT"
fi

echo -n "  TEST: resolves environment-specific values path... "
if grep -q 'environments/' "${SRC_SCRIPTS}/update_cd_repo.sh"; then
  pass
else
  fail "should resolve environments/<env>/values.yaml"
fi

echo -n "  TEST: supports a validated explicit Kustomize path... "
if grep -q 'CONFIGURED_PATH="${CD_PATH:-}"' "${SRC_SCRIPTS}/update_cd_repo.sh" &&
   grep -q 'cd.path must be a relative path' "${SRC_SCRIPTS}/update_cd_repo.sh"; then
  pass
else
  fail "should support and validate an explicit Kustomize path"
fi

echo -n "  TEST: retries concurrent shared-repository commits against the new head... "
if grep -q 'for attempt in 1 2 3' "${SRC_SCRIPTS}/update_cd_repo.sh" &&
   grep -q 'expectedHeadOid' "${SRC_SCRIPTS}/update_cd_repo.sh" &&
   grep -q 'git reset -q --hard "origin/${BRANCH}"' "${SRC_SCRIPTS}/update_cd_repo.sh"; then
  pass
else
  fail "should retry commit races against the refreshed branch head"
fi

echo -n "  TEST: commits through the signed GraphQL API, never git push... "
if grep -q 'createCommitOnBranch' "${SRC_SCRIPTS}/update_cd_repo.sh" &&
   ! grep -q 'git push' "${SRC_SCRIPTS}/update_cd_repo.sh"; then
  pass
else
  fail "should create GitOps commits with createCommitOnBranch so GitHub signs them"
fi

echo -n "  TEST: deletes digest field when setting newTag (kustomize)... "
if grep -q 'del((.images\[\] | select(.name == \\"${IMAGE_NAME}\\")).digest)' "${SRC_SCRIPTS}/update_cd_repo.sh"; then
  pass
else
  fail "should delete digest field to prevent kustomize from ignoring newTag"
fi

echo -n "  TEST: upserts supplemental images (creates new entry)... "
if grep -q '.images += \[{' "${SRC_SCRIPTS}/update_cd_repo.sh"; then
  pass
else
  fail "should create new image entries for supplemental images"
fi

echo -n "  TEST: checks for existing entry before upsert... "
if grep -q 'EXISTING=' "${SRC_SCRIPTS}/update_cd_repo.sh" && grep -q 'if \[\[ -z "${EXISTING}"' "${SRC_SCRIPTS}/update_cd_repo.sh"; then
  pass
else
  fail "should check if image entry exists before deciding to create or update"
fi

# Functional test: verify upsert creates entries in a real kustomization file
echo -n "  TEST: upsert creates new image entry in kustomization (functional)... "
UPSERT_TMPDIR=$(mktemp -d)
cat > "${UPSERT_TMPDIR}/kustomization.yaml" <<'KUSTYAML'
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
images:
  - name: ghcr.io/koftwentytwo/website-backend
    newTag: "0.1.0"
KUSTYAML
SUPP_CD_IMAGE="ghcr.io/koftwentytwo/website-backend-migrations"
VERSION_TEST="0.2.0-SNAPSHOT.abc1234"
EXISTING=$(yq ".images[] | select(.name == \"${SUPP_CD_IMAGE}\") | .name" "${UPSERT_TMPDIR}/kustomization.yaml")
if [[ -z "${EXISTING}" ]]; then
  yq -i ".images += [{\"name\": \"${SUPP_CD_IMAGE}\", \"newTag\": \"${VERSION_TEST}\"}]" "${UPSERT_TMPDIR}/kustomization.yaml"
fi
RESULT_TAG=$(yq ".images[] | select(.name == \"${SUPP_CD_IMAGE}\") | .newTag" "${UPSERT_TMPDIR}/kustomization.yaml")
if [[ "${RESULT_TAG}" == "${VERSION_TEST}" ]]; then
  pass
else
  fail "expected newTag=${VERSION_TEST}, got ${RESULT_TAG}"
fi

echo -n "  TEST: upsert updates existing image entry in kustomization (functional)... "
VERSION_TEST2="0.3.0-SNAPSHOT.def5678"
EXISTING=$(yq ".images[] | select(.name == \"${SUPP_CD_IMAGE}\") | .name" "${UPSERT_TMPDIR}/kustomization.yaml")
if [[ -n "${EXISTING}" ]]; then
  yq -i "(.images[] | select(.name == \"${SUPP_CD_IMAGE}\")).newTag = \"${VERSION_TEST2}\"" "${UPSERT_TMPDIR}/kustomization.yaml"
fi
RESULT_TAG2=$(yq ".images[] | select(.name == \"${SUPP_CD_IMAGE}\") | .newTag" "${UPSERT_TMPDIR}/kustomization.yaml")
ENTRY_COUNT=$(yq "[.images[] | select(.name == \"${SUPP_CD_IMAGE}\")] | length" "${UPSERT_TMPDIR}/kustomization.yaml")
if [[ "${RESULT_TAG2}" == "${VERSION_TEST2}" && "${ENTRY_COUNT}" == "1" ]]; then
  pass
else
  fail "expected newTag=${VERSION_TEST2} with 1 entry, got tag=${RESULT_TAG2} count=${ENTRY_COUNT}"
fi
rm -rf "${UPSERT_TMPDIR}"

# =============================================================================
# Test: docker_build.sh - DOCKER_ENV_TAG support
# =============================================================================
echo ""
echo "=== docker_build.sh Tests ==="

echo -n "  TEST: reads DOCKER_ENV_TAG from env... "
if grep -q 'DOCKER_ENV_TAG' "${SRC_SCRIPTS}/docker_build.sh"; then
  pass
else
  fail "should reference DOCKER_ENV_TAG"
fi

echo -n "  TEST: exports DOCKER_ENV_TAG to BASH_ENV... "
if grep -q "DOCKER_ENV_TAG" "${SRC_SCRIPTS}/docker_build.sh" && grep -q 'BASH_ENV' "${SRC_SCRIPTS}/docker_build.sh"; then
  pass
else
  fail "should export DOCKER_ENV_TAG"
fi

# =============================================================================
# Test: docker_push_ghcr.sh - DOCKER_ENV_TAG support
# =============================================================================
echo ""
echo "=== docker_push_ghcr.sh DOCKER_ENV_TAG Tests ==="

echo -n "  TEST: reads DOCKER_ENV_TAG from env... "
if grep -q 'DOCKER_ENV_TAG' "${SRC_SCRIPTS}/docker_push_ghcr.sh"; then
  pass
else
  fail "should reference DOCKER_ENV_TAG"
fi

echo -n "  TEST: conditionally pushes env tag... "
if grep -q 'ENV_TAG' "${SRC_SCRIPTS}/docker_push_ghcr.sh" && grep -q 'docker push.*ENV_TAG' "${SRC_SCRIPTS}/docker_push_ghcr.sh"; then
  pass
else
  fail "should conditionally push env tag"
fi

# =============================================================================
# Test: export_version_vars.sh - DOCKER_ENV_TAG export
# =============================================================================
echo ""
echo "=== export_version_vars.sh DOCKER_ENV_TAG Tests ==="

echo -n "  TEST: exports DOCKER_ENV_TAG to BASH_ENV... "
if grep -q 'DOCKER_ENV_TAG' "${SRC_SCRIPTS}/export_version_vars.sh" && grep -q 'BASH_ENV' "${SRC_SCRIPTS}/export_version_vars.sh"; then
  pass
else
  fail "should export DOCKER_ENV_TAG to BASH_ENV"
fi

echo -n "  TEST: handles staging branch... "
if grep -q 'staging)' "${SRC_SCRIPTS}/export_version_vars.sh"; then
  pass
else
  fail "should handle staging branch"
fi

# =============================================================================
# Test: generate_dockerfile.sh - Dockerfile generation
# =============================================================================
echo ""
echo "=== generate_dockerfile.sh Tests ==="

echo -n "  TEST: reads .munitor.yml config... "
if grep -q '\.munitor\.yml' "${SRC_SCRIPTS}/generate_dockerfile.sh"; then
  pass
else
  fail "should read .munitor.yml"
fi

echo -n "  TEST: handles node-api pipeline... "
if grep -q 'node-api)' "${SRC_SCRIPTS}/generate_dockerfile.sh"; then
  pass
else
  fail "should handle node-api"
fi

echo -n "  TEST: handles java-webapp pipeline... "
if grep -q 'java-webapp)' "${SRC_SCRIPTS}/generate_dockerfile.sh"; then
  pass
else
  fail "should handle java-webapp"
fi

echo -n "  TEST: handles node-webapp pipeline... "
if grep -q 'node-webapp)' "${SRC_SCRIPTS}/generate_dockerfile.sh"; then
  pass
else
  fail "should handle node-webapp"
fi

echo -n "  TEST: fails on unsupported pipeline... "
if grep -q 'Unsupported pipeline type' "${SRC_SCRIPTS}/generate_dockerfile.sh"; then
  pass
else
  fail "should fail on unsupported type"
fi

echo -n "  TEST: uses multi-stage build for node-api... "
if grep -q 'AS deps' "${SRC_SCRIPTS}/generate_dockerfile.sh" && grep -q 'AS builder' "${SRC_SCRIPTS}/generate_dockerfile.sh"; then
  pass
else
  fail "should use multi-stage build"
fi

echo -n "  TEST: uses Alpine JRE for java-webapp... "
if grep -q 'eclipse-temurin.*jre-alpine' "${SRC_SCRIPTS}/generate_dockerfile.sh" && grep -q 'USER appuser' "${SRC_SCRIPTS}/generate_dockerfile.sh"; then
  pass
else
  fail "should use Alpine JRE with non-root user"
fi

echo ""
echo "=== node_install_deps.sh pnpm support ==="

echo -n "  TEST: node_install_deps.sh handles pnpm case... "
if grep -q 'pnpm install --frozen-lockfile' "${SRC_SCRIPTS}/node_install_deps.sh"; then
  pass
else
  fail "missing pnpm install --frozen-lockfile"
fi

echo -n "  TEST: node_install_deps.sh has Prisma auto-detection... "
if grep -q 'prisma/schema.prisma' "${SRC_SCRIPTS}/node_install_deps.sh"; then
  pass
else
  fail "missing Prisma auto-detection"
fi

echo -n "  TEST: node_test.sh handles pnpm fallback... "
if grep -q 'pnpm test' "${SRC_SCRIPTS}/node_test.sh"; then
  pass
else
  fail "missing pnpm test fallback"
fi

echo -n "  TEST: run_test_setup.sh supports inline commands... "
if grep -q 'bash -c' "${SRC_SCRIPTS}/run_test_setup.sh"; then
  pass
else
  fail "missing bash -c inline command support"
fi

echo -n "  TEST: generate_dockerfile.sh has pnpm Dockerfile variant... "
if grep -q 'pnpm install --frozen-lockfile' "${SRC_SCRIPTS}/generate_dockerfile.sh"; then
  pass
else
  fail "missing pnpm Dockerfile variant"
fi

# =============================================================================
# Test: install_kustomize.sh - Pinned binary install
# =============================================================================
echo ""
echo "=== install_kustomize.sh Tests ==="

echo -n "  TEST: uses munitor_download_with_retry... "
if grep -q 'munitor_download_with_retry' "${SRC_SCRIPTS}/install_kustomize.sh"; then
  pass
else
  fail "should use munitor_download_with_retry"
fi

echo -n "  TEST: pins version via KUSTOMIZE_VERSION... "
if grep -q 'KUSTOMIZE_VERSION' "${SRC_SCRIPTS}/install_kustomize.sh"; then
  pass
else
  fail "should use KUSTOMIZE_VERSION env var"
fi

echo -n "  TEST: uses URL-encoded path segment... "
if grep -q 'kustomize%2Fv' "${SRC_SCRIPTS}/install_kustomize.sh"; then
  pass
else
  fail "should use kustomize%2Fv in URL"
fi

echo -n "  TEST: has cleanup trap... "
if grep -q 'trap cleanup EXIT' "${SRC_SCRIPTS}/install_kustomize.sh"; then
  pass
else
  fail "should have cleanup trap"
fi

# =============================================================================
# Test: kustomize_validate.sh - Build base + overlays
# =============================================================================
echo ""
echo "=== kustomize_validate.sh Tests ==="

echo -n "  TEST: auto-detects overlays when KUSTOMIZE_OVERLAYS is empty... "
if grep -q '/\*/kustomization.yaml' "${SRC_SCRIPTS}/kustomize_validate.sh"; then
  pass
else
  fail "should auto-detect overlays"
fi

echo -n "  TEST: supports load restrictor flag... "
if grep -q 'LoadRestrictionsNone' "${SRC_SCRIPTS}/kustomize_validate.sh"; then
  pass
else
  fail "should support LoadRestrictionsNone"
fi

echo -n "  TEST: outputs to /tmp/kustomize-output... "
if grep -q '/tmp/kustomize-output' "${SRC_SCRIPTS}/kustomize_validate.sh"; then
  pass
else
  fail "should output to /tmp/kustomize-output"
fi

echo -n "  TEST: supports KUSTOMIZE_OVERLAY_DIR env var... "
if grep -q 'KUSTOMIZE_OVERLAY_DIR' "${SRC_SCRIPTS}/kustomize_validate.sh"; then
  pass
else
  fail "should support KUSTOMIZE_OVERLAY_DIR"
fi

echo -n "  TEST: skips base build when BASE_PATH is empty... "
if grep -q 'if \[\[ -n "\${BASE_PATH}" \]\]' "${SRC_SCRIPTS}/kustomize_validate.sh"; then
  pass
else
  fail "should conditionally skip base build"
fi

echo -n "  TEST: uses OVERLAY_DIR variable for overlay path... "
if grep -q '"\${OVERLAY_DIR}/' "${SRC_SCRIPTS}/kustomize_validate.sh"; then
  pass
else
  fail "should use OVERLAY_DIR variable"
fi

# =============================================================================
# Test: install_kubesec.sh - Pinned binary install
# =============================================================================
echo ""
echo "=== install_kubesec.sh Tests ==="

echo -n "  TEST: uses munitor_download_with_retry... "
if grep -q 'munitor_download_with_retry' "${SRC_SCRIPTS}/install_kubesec.sh"; then
  pass
else
  fail "should use munitor_download_with_retry"
fi

echo -n "  TEST: has cleanup trap... "
if grep -q 'trap cleanup EXIT' "${SRC_SCRIPTS}/install_kubesec.sh"; then
  pass
else
  fail "should have cleanup trap"
fi

# =============================================================================
# Test: run_kubesec.sh - Soft-fail scan
# =============================================================================
echo ""
echo "=== run_kubesec.sh Tests ==="

echo -n "  TEST: reads scan overlay from env... "
if grep -q 'KUBESEC_SCAN_OVERLAY' "${SRC_SCRIPTS}/run_kubesec.sh"; then
  pass
else
  fail "should read KUBESEC_SCAN_OVERLAY"
fi

echo -n "  TEST: soft-fails (|| true)... "
if grep -q '|| true' "${SRC_SCRIPTS}/run_kubesec.sh"; then
  pass
else
  fail "should soft-fail"
fi

# =============================================================================
# Test: install_kube_linter.sh - Pinned binary install
# =============================================================================
echo ""
echo "=== install_kube_linter.sh Tests ==="

echo -n "  TEST: uses munitor_download_with_retry... "
if grep -q 'munitor_download_with_retry' "${SRC_SCRIPTS}/install_kube_linter.sh"; then
  pass
else
  fail "should use munitor_download_with_retry"
fi

echo -n "  TEST: has cleanup trap... "
if grep -q 'trap cleanup EXIT' "${SRC_SCRIPTS}/install_kube_linter.sh"; then
  pass
else
  fail "should have cleanup trap"
fi

# =============================================================================
# Test: run_kube_linter.sh - Soft-fail lint
# =============================================================================
echo ""
echo "=== run_kube_linter.sh Tests ==="

echo -n "  TEST: reads scan overlay from env... "
if grep -q 'KUBE_LINTER_SCAN_OVERLAY' "${SRC_SCRIPTS}/run_kube_linter.sh"; then
  pass
else
  fail "should read KUBE_LINTER_SCAN_OVERLAY"
fi

echo -n "  TEST: supports optional config file... "
if grep -q 'KUBE_LINTER_CONFIG' "${SRC_SCRIPTS}/run_kube_linter.sh"; then
  pass
else
  fail "should read KUBE_LINTER_CONFIG"
fi

echo -n "  TEST: soft-fails (|| true)... "
if grep -q '|| true' "${SRC_SCRIPTS}/run_kube_linter.sh"; then
  pass
else
  fail "should soft-fail"
fi

# =============================================================================
# Test: yaml_lint_cd.sh - YAML linting
# =============================================================================
echo ""
echo "=== yaml_lint_cd.sh Tests ==="

echo -n "  TEST: installs yamllint via apt... "
if grep -q 'apt-get install.*yamllint' "${SRC_SCRIPTS}/yaml_lint_cd.sh"; then
  pass
else
  fail "should install yamllint via apt"
fi

echo -n "  TEST: uses relaxed config with line-length disabled... "
if grep -q 'line-length: disable' "${SRC_SCRIPTS}/yaml_lint_cd.sh"; then
  pass
else
  fail "should disable line-length rule"
fi

echo -n "  TEST: skips missing directories... "
if grep -q '! -d' "${SRC_SCRIPTS}/yaml_lint_cd.sh"; then
  pass
else
  fail "should skip missing directories"
fi

# =============================================================================
# Test: build_push_supplemental.sh - Supplemental image build
# =============================================================================
echo ""
echo "=== build_push_supplemental.sh Tests ==="

echo -n "  TEST: sources munitor_helpers... "
if grep -q 'MUNITOR_HELPERS' "${SRC_SCRIPTS}/build_push_supplemental.sh"; then
  pass
else
  fail "should source munitor_helpers"
fi

echo -n "  TEST: calls munitor_header... "
if grep -q 'munitor_header' "${SRC_SCRIPTS}/build_push_supplemental.sh"; then
  pass
else
  fail "should call munitor_header"
fi

echo -n "  TEST: reads SUPPLEMENTAL_IMAGES_JSON... "
if grep -q 'SUPPLEMENTAL_IMAGES_JSON' "${SRC_SCRIPTS}/build_push_supplemental.sh"; then
  pass
else
  fail "should read SUPPLEMENTAL_IMAGES_JSON"
fi

echo -n "  TEST: skips when JSON is empty... "
if grep -q 'exit 0' "${SRC_SCRIPTS}/build_push_supplemental.sh"; then
  pass
else
  fail "should exit 0 when no supplemental images"
fi

echo -n "  TEST: uses jq to parse JSON... "
if grep -q 'jq' "${SRC_SCRIPTS}/build_push_supplemental.sh"; then
  pass
else
  fail "should use jq"
fi

echo -n "  TEST: builds Docker images... "
if grep -q 'docker build' "${SRC_SCRIPTS}/build_push_supplemental.sh"; then
  pass
else
  fail "should run docker build"
fi

echo -n "  TEST: scans with Trivy... "
if grep -q 'trivy image' "${SRC_SCRIPTS}/build_push_supplemental.sh"; then
  pass
else
  fail "should scan with trivy"
fi

echo -n "  TEST: pushes images... "
if grep -q 'docker push' "${SRC_SCRIPTS}/build_push_supplemental.sh"; then
  pass
else
  fail "should push images"
fi

echo -n "  TEST: supports custom Dockerfile... "
if grep -q 'dockerfile' "${SRC_SCRIPTS}/build_push_supplemental.sh"; then
  pass
else
  fail "should support custom dockerfile"
fi

echo -n "  TEST: auto-generates Dockerfile from base+copy... "
if grep -q 'Dockerfile\.' "${SRC_SCRIPTS}/build_push_supplemental.sh" && grep -q 'FROM' "${SRC_SCRIPTS}/build_push_supplemental.sh"; then
  pass
else
  fail "should auto-generate Dockerfile"
fi

echo -n "  TEST: uses set -euo pipefail... "
if grep -q 'set -euo pipefail' "${SRC_SCRIPTS}/build_push_supplemental.sh"; then
  pass
else
  fail "should use strict mode"
fi

# =============================================================================
# Test: Scripts have proper error handling
# =============================================================================
echo ""
echo "=== Error Handling Tests ==="

echo -n "  TEST: all scripts use set -euo pipefail... "
# munitor_helpers.sh is a sourced library, not a standalone script -- exclude it
SCRIPTS_WITHOUT_STRICT=$(find "${SRC_SCRIPTS}" -name "*.sh" ! -name "munitor_helpers.sh" -exec grep -L 'set -euo pipefail' {} \;)
if [[ -z "${SCRIPTS_WITHOUT_STRICT}" ]]; then
  pass
else
  fail "missing in: ${SCRIPTS_WITHOUT_STRICT}"
fi

# =============================================================================
# Test: Cleanup traps
# =============================================================================
echo ""
echo "=== Cleanup Trap Tests ==="

echo -n "  TEST: install_gitleaks.sh has cleanup trap... "
if grep -q 'trap cleanup EXIT' "${SRC_SCRIPTS}/install_gitleaks.sh"; then
  pass
else
  fail "should have cleanup trap"
fi

echo -n "  TEST: install_gh.sh has cleanup trap... "
if grep -q 'trap cleanup EXIT' "${SRC_SCRIPTS}/install_gh.sh"; then
  pass
else
  fail "should have cleanup trap"
fi

echo -n "  TEST: update_cd_repo.sh has cleanup trap... "
if grep -q 'trap cleanup EXIT' "${SRC_SCRIPTS}/update_cd_repo.sh"; then
  pass
else
  fail "should have cleanup trap"
fi

echo -n "  TEST: sdk_post_validate.sh has cleanup trap... "
if grep -q 'trap cleanup EXIT' "${SRC_SCRIPTS}/sdk_post_validate.sh"; then
  pass
else
  fail "should have cleanup trap"
fi

echo -n "  TEST: generate_config.sh has cleanup trap... "
if grep -q 'trap cleanup EXIT' "${SRC_SCRIPTS}/generate_config.sh"; then
  pass
else
  fail "should have cleanup trap"
fi

# =============================================================================
# Test: All scripts source munitor_helpers and call munitor_header
# =============================================================================
echo ""
echo "=== Munitor Helpers Integration Tests ==="

# Scripts that are excluded from the munitor_header requirement:
# - munitor_helpers.sh: the library itself
# - extract_munitor_vars.sh: low-level helper, sourced by other scripts
# - packed_*: auto-generated, embed helpers differently
EXCLUDED_PATTERN="munitor_helpers.sh|extract_munitor_vars.sh|packed_"

echo -n "  TEST: all scripts source munitor_helpers... "
MISSING_SOURCE=""
while IFS= read -r script; do
  name=$(basename "${script}")
  if echo "${name}" | grep -qE "${EXCLUDED_PATTERN}"; then continue; fi
  if ! grep -q 'MUNITOR_HELPERS' "${script}"; then
    MISSING_SOURCE="${MISSING_SOURCE} ${name}"
  fi
done < <(find "${SRC_SCRIPTS}" -maxdepth 1 -name "*.sh" -type f)
if [[ -z "${MISSING_SOURCE}" ]]; then
  pass
else
  fail "missing sourcing:${MISSING_SOURCE}"
fi

echo -n "  TEST: all scripts call munitor_header... "
MISSING_HEADER=""
while IFS= read -r script; do
  name=$(basename "${script}")
  if echo "${name}" | grep -qE "${EXCLUDED_PATTERN}"; then continue; fi
  if ! grep -q 'munitor_header' "${script}"; then
    MISSING_HEADER="${MISSING_HEADER} ${name}"
  fi
done < <(find "${SRC_SCRIPTS}" -maxdepth 1 -name "*.sh" -type f)
if [[ -z "${MISSING_HEADER}" ]]; then
  pass
else
  fail "missing munitor_header:${MISSING_HEADER}"
fi

# =============================================================================
# Test: External download URLs are reachable
# =============================================================================
echo ""
echo "=== External Download URL Tests ==="

# Extract pinned versions from scripts (single source of truth)
extract_version() { sed -n "s/.*${1}:-\([v0-9.]*\).*/\1/p" "$2" | head -1; }
TRIVY_VER=$(extract_version TRIVY_VERSION "${SRC_SCRIPTS}/run_trivy.sh")
GH_VER=$(extract_version GH_VERSION "${SRC_SCRIPTS}/install_gh.sh")
GITLEAKS_VER=$(extract_version GITLEAKS_VERSION "${SRC_SCRIPTS}/install_gitleaks.sh")
KUBE_LINTER_VER=$(extract_version KUBE_LINTER_VERSION "${SRC_SCRIPTS}/install_kube_linter.sh")
TERRAGRUNT_VER=$(extract_version TERRAGRUNT_VERSION "${SRC_SCRIPTS}/install_terragrunt.sh")
YQ_VER=$(extract_version YQ_VERSION "${SRC_SCRIPTS}/install_yq.sh")
KUSTOMIZE_VER=$(extract_version KUSTOMIZE_VERSION "${SRC_SCRIPTS}/install_kustomize.sh")
KUBESEC_VER=$(extract_version KUBESEC_VERSION "${SRC_SCRIPTS}/install_kubesec.sh")
TFSEC_TRIVY_VER=$(extract_version TRIVY_VERSION "${SRC_SCRIPTS}/install_tfsec.sh")
SONAR_VER=$(extract_version SONAR_SCANNER_VERSION "${SRC_SCRIPTS}/node_sonar.sh")

# All URLs target linux/amd64 -- matches the CI executor
URLS=(
  "Trivy ${TRIVY_VER}|https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VER}/trivy_${TRIVY_VER}_Linux-64bit.tar.gz"
  "Trivy/tfsec ${TFSEC_TRIVY_VER}|https://github.com/aquasecurity/trivy/releases/download/v${TFSEC_TRIVY_VER}/trivy_${TFSEC_TRIVY_VER}_Linux-64bit.tar.gz"
  "gh ${GH_VER}|https://github.com/cli/cli/releases/download/v${GH_VER}/gh_${GH_VER}_linux_amd64.tar.gz"
  "gitleaks ${GITLEAKS_VER}|https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VER}/gitleaks_${GITLEAKS_VER}_linux_x64.tar.gz"
  "kube-linter ${KUBE_LINTER_VER}|https://github.com/stackrox/kube-linter/releases/download/v${KUBE_LINTER_VER}/kube-linter-linux.tar.gz"
  "terragrunt ${TERRAGRUNT_VER}|https://github.com/gruntwork-io/terragrunt/releases/download/v${TERRAGRUNT_VER}/terragrunt_linux_amd64"
  "yq ${YQ_VER}|https://github.com/mikefarah/yq/releases/download/${YQ_VER}/yq_linux_amd64"
  "kustomize ${KUSTOMIZE_VER}|https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${KUSTOMIZE_VER}/kustomize_v${KUSTOMIZE_VER}_linux_amd64.tar.gz"
  "kubesec ${KUBESEC_VER}|https://github.com/controlplaneio/kubesec/releases/download/v${KUBESEC_VER}/kubesec_linux_amd64.tar.gz"
  "OpenTofu installer|https://get.opentofu.org/install-opentofu.sh"
  "sonar-scanner ${SONAR_VER}|https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-${SONAR_VER}-linux-x64.zip"
)

for entry in "${URLS[@]}"; do
  LABEL="${entry%%|*}"
  URL="${entry##*|}"
  echo -n "  TEST: ${LABEL} download URL is reachable... "
  HTTP_CODE=$(curl -sI -o /dev/null -w "%{http_code}" -L --retry 2 "${URL}" 2>/dev/null || echo "000")
  if [[ "${HTTP_CODE}" == "200" ]]; then
    pass
  else
    fail "HTTP ${HTTP_CODE} for ${URL}"
  fi
done

# =============================================================================
# Test: Gradle scripts - structural tests
# =============================================================================
echo ""
echo "=== Gradle Scripts Tests ==="

for GRADLE_SCRIPT in gradle_build gradle_test gradle_jacoco gradle_checkstyle gradle_spotbugs gradle_pmd; do
  SCRIPT_FILE="${SRC_SCRIPTS}/${GRADLE_SCRIPT}.sh"

  echo -n "  TEST: ${GRADLE_SCRIPT}.sh exists... "
  if [[ -f "${SCRIPT_FILE}" ]]; then
    pass
  else
    fail "file not found"
    continue
  fi

  echo -n "  TEST: ${GRADLE_SCRIPT}.sh is executable... "
  if [[ -x "${SCRIPT_FILE}" ]]; then
    pass
  else
    fail "not executable"
  fi

  echo -n "  TEST: ${GRADLE_SCRIPT}.sh sources munitor_helpers.sh... "
  if grep -q 'munitor_helpers.sh' "${SCRIPT_FILE}"; then
    pass
  else
    fail "should source munitor_helpers.sh"
  fi

  echo -n "  TEST: ${GRADLE_SCRIPT}.sh uses set -euo pipefail... "
  if grep -q 'set -euo pipefail' "${SCRIPT_FILE}"; then
    pass
  else
    fail "should use set -euo pipefail"
  fi

  echo -n "  TEST: ${GRADLE_SCRIPT}.sh uses gradlew... "
  if grep -q 'gradlew' "${SCRIPT_FILE}"; then
    pass
  else
    fail "should use ./gradlew"
  fi
done

echo -n "  TEST: gradle_build.sh uses --no-daemon... "
if grep -q '\-\-no-daemon' "${SRC_SCRIPTS}/gradle_build.sh"; then
  pass
else
  fail "should use --no-daemon"
fi

echo -n "  TEST: gradle_build.sh skips tests (-x test)... "
if grep -q '\-x test' "${SRC_SCRIPTS}/gradle_build.sh"; then
  pass
else
  fail "should skip tests with -x test"
fi

echo -n "  TEST: gradle_jacoco.sh validates MIN_INSTRUCTION... "
if grep -q 'MIN_INSTRUCTION' "${SRC_SCRIPTS}/gradle_jacoco.sh"; then
  pass
else
  fail "should use MIN_INSTRUCTION"
fi

echo -n "  TEST: gradle_jacoco.sh aggregates multi-module CSVs... "
if grep -q 'find' "${SRC_SCRIPTS}/gradle_jacoco.sh" && grep -q 'jacocoTestReport.csv' "${SRC_SCRIPTS}/gradle_jacoco.sh"; then
  pass
else
  fail "should find jacocoTestReport.csv files"
fi

echo -n "  TEST: gradle_checkstyle.sh detects plugin availability... "
if grep -q 'tasks --all' "${SRC_SCRIPTS}/gradle_checkstyle.sh" && grep -q 'checkstyleMain' "${SRC_SCRIPTS}/gradle_checkstyle.sh"; then
  pass
else
  fail "should detect checkstyleMain task"
fi

echo -n "  TEST: gradle_checkstyle.sh skips gracefully... "
if grep -q 'skipping\|Skipping\|skip\|not applied' "${SRC_SCRIPTS}/gradle_checkstyle.sh"; then
  pass
else
  fail "should skip gracefully when plugin not applied"
fi

echo -n "  TEST: gradle_spotbugs.sh detects plugin availability... "
if grep -q 'tasks --all' "${SRC_SCRIPTS}/gradle_spotbugs.sh" && grep -q 'spotbugsMain' "${SRC_SCRIPTS}/gradle_spotbugs.sh"; then
  pass
else
  fail "should detect spotbugsMain task"
fi

echo -n "  TEST: gradle_pmd.sh detects plugin availability... "
if grep -q 'tasks --all' "${SRC_SCRIPTS}/gradle_pmd.sh" && grep -q 'pmdMain' "${SRC_SCRIPTS}/gradle_pmd.sh"; then
  pass
else
  fail "should detect pmdMain task"
fi

# =============================================================================
# Test: github_release.sh - Release artifact upload support
# =============================================================================
echo ""
echo "=== github_release.sh Artifact Upload Tests ==="

echo -n "  TEST: supports MUNITOR_RELEASE_ARTIFACTS env var... "
if grep -q 'MUNITOR_RELEASE_ARTIFACTS' "${SRC_SCRIPTS}/github_release.sh"; then
  pass
else
  fail "should support MUNITOR_RELEASE_ARTIFACTS"
fi

echo -n "  TEST: uses gh release upload for artifacts... "
if grep -q 'gh release upload' "${SRC_SCRIPTS}/github_release.sh"; then
  pass
else
  fail "should use gh release upload"
fi

echo -n "  TEST: validates artifact files exist before upload... "
if grep -q 'not found' "${SRC_SCRIPTS}/github_release.sh" && grep -q '! -f' "${SRC_SCRIPTS}/github_release.sh"; then
  pass
else
  fail "should validate artifact files exist"
fi

echo -n "  TEST: uses --clobber for idempotent uploads... "
if grep -q '\-\-clobber' "${SRC_SCRIPTS}/github_release.sh"; then
  pass
else
  fail "should use --clobber flag"
fi

echo -n "  TEST: skips upload when MUNITOR_RELEASE_ARTIFACTS is empty... "
if grep -q 'if \[\[ -n "\${MUNITOR_RELEASE_ARTIFACTS:-}"' "${SRC_SCRIPTS}/github_release.sh"; then
  pass
else
  fail "should skip upload when artifacts is empty"
fi

# =============================================================================
# Summary
# =============================================================================
echo ""
echo "=== Results: ${PASS} passed, ${FAIL} failed ==="

if [[ ${FAIL} -gt 0 ]]; then
  exit 1
fi