import { readFile } from 'node:fs/promises';

import { describe, expect, it } from 'vitest';

const workflowPath = new URL('../../.gitea/workflows/ci.yml', import.meta.url);

describe('untrusted pull request CI', () => {
  it('does not use a privileged PR trigger or shared npm cache', async () => {
    const workflow = await readFile(workflowPath, 'utf8');

    expect(workflow).not.toMatch(/\bpull_request_target\s*:/);
    expect(workflow).not.toMatch(/^\s+cache:\s*npm\s*$/m);
    expect(workflow).toMatch(/\bpermissions:\s*\n\s+contents:\s*read\b/);
  });

  it('checks lockfiles before installing without lifecycle scripts', async () => {
    const workflow = await readFile(workflowPath, 'utf8');
    const policyIndex = workflow.indexOf('node scripts/security/dependency-policy.mjs');
    const installIndex = workflow.indexOf('npm ci --ignore-scripts');

    expect(policyIndex).toBeGreaterThan(-1);
    expect(installIndex).toBeGreaterThan(policyIndex);
    expect(workflow).toContain('npm --prefix ui ci --ignore-scripts');
    expect(workflow).toContain('node scripts/security/rebuild-native.mjs');
    expect(workflow).toContain('persist-credentials: false');
    expect(workflow).not.toMatch(/^\s+npm ci\s*$/m);
  });
});