#!/usr/bin/env bash
# Platform-authored launcher for the captured, unchanged policy-validate.py (the legacy policy-verify action's validator). It does exactly what that
# action did and nothing more: run the validator with the repository root as the working directory (it lists `git ls-files` there), the interpreter
# isolated (-P: the repository is not on sys.path, -s: no user site, -B: no bytecode) and PYTHONPATH holding only the image's pinned PyYAML. The
# validator's one option, QQQ_POLICY_SHELL, is cleared because the legacy action never set it; no tool is downloaded and no network is used.
# env: PYYAML_DIR  directory holding the pinned `yaml` package under lib/ (the same one blueprint-lint.sh uses)
set -eu
here=$(cd "$(dirname "$0")" && pwd)
unset QQQ_POLICY_SHELL
pypath=""
[ -n "${PYYAML_DIR:-}" ] && pypath="$PYYAML_DIR/lib"
PYTHONPATH="$pypath" PYTHONSTARTUP= PYTHONDONTWRITEBYTECODE=1 exec python3 -P -s -B "$here/policy-validate.py"