"""Unit tests for ``_drift._ci_install_safety_drift`` (Finding C of the 2026-06-18
fleet CI audit).

Pure-string checks — no sibling templates required, so unlike the rest of
``test_drift`` these run in a single-repo CI clone too. They pin the two hazards
the install-safety gate guards: bare project/extras installs without index
steering (dependency-confusion / stale mgf-*), and a ``pip-audit`` step that
doesn't upgrade pip first (base-image-pip CVE).
"""

from __future__ import annotations

from typing import Any

from mgf.fed._drift import _ci_install_safety_drift

_BARE_EXTRAS = 'steps:\n  - name: test\n    commands:\n      - pip install --quiet -e ".[dev]"\n'

_STEERED_EXTRAS = (
    "steps:\n  - name: test\n    commands:\n"
    '      - pip install --quiet -e ".[dev]" --extra-index-url https://pypi.org/simple/ '
    "--index-url https://codeberg.org/x "
    '|| (sleep 15 && pip install --quiet -e ".[dev]" --extra-index-url https://pypi.org/simple/ '
    "--index-url https://codeberg.org/x)\n"
)


def _kinds(items: list[Any]) -> set[str]:
    return {i.kind for i in items}


def test_flags_bare_extras_install() -> None:
    items = _ci_install_safety_drift(_BARE_EXTRAS, {})
    assert any(i.kind == "ci-unsafe-install" and "bare" in i.detail for i in items)


def test_clean_when_index_steered() -> None:
    assert _ci_install_safety_drift(_STEERED_EXTRAS, {}) == []


def test_opt_out_via_extra_index_false() -> None:
    """A repo that opts out of index steering ([tool.mgf-fed] extra_index=false) —
    the cornerstone / editable-pinned case — is not flagged for bare installs."""
    pyproject = {"tool": {"mgf-fed": {"extra_index": False}}}
    assert _ci_install_safety_drift(_BARE_EXTRAS, pyproject) == []


def test_opt_out_via_pip_index_env_anchor() -> None:
    """A PIP_INDEX_URL env anchor steers every step file-wide (the mgf-hrb pattern),
    so bare-looking install lines are fine."""
    text = (
        "steps:\n  - name: test\n    environment:\n"
        "      PIP_INDEX_URL: https://codeberg.org/x\n"
        '    commands:\n      - pip install --quiet -e ".[dev]"\n'
    )
    assert _ci_install_safety_drift(text, {}) == []


def test_flags_pipaudit_without_pip_upgrade() -> None:
    text = (
        "steps:\n  - name: vuln-scan\n    commands:\n"
        '      - pip install --quiet pip-audit -e ".[dev]" --index-url https://codeberg.org/x\n'
        "      - pip-audit --strict\n"
    )
    items = _ci_install_safety_drift(text, {})
    assert any(i.kind == "ci-unsafe-install" and "upgrade pip" in i.detail for i in items)


def test_clean_pipaudit_with_pip_upgrade() -> None:
    text = (
        "steps:\n  - name: vuln-scan\n    commands:\n"
        "      - pip install --quiet --upgrade pip\n"
        '      - pip install --quiet pip-audit -e ".[dev]" --index-url https://codeberg.org/x\n'
        "      - pip-audit --strict\n"
    )
    assert _ci_install_safety_drift(text, {}) == []


def test_tool_install_lines_are_not_flagged() -> None:
    """A bare `pip install build twine` (public tools, no -e / .[ ) is legitimate."""
    text = (
        "steps:\n  - name: build\n    commands:\n"
        "      - pip install --quiet --upgrade pip\n"
        "      - pip install --quiet build twine\n"
    )
    assert _kinds(_ci_install_safety_drift(text, {})) == set()
