devflow 2.3.0

//! Integration tests for `devflow release --check` (20d) — the read-only
//! release-cut preflight. Drives the real binary against temp-workspace
//! fixtures rather than calling internal handlers directly (the checks are
//! `pub(crate)` inside `devflow-cli`, and driving the actual CLI is what
//! proves the `--check` gate and the self-pin comparison end-to-end).

use std::path::Path;
use std::process::{Command, Output};

fn devflow_bin() -> &'static str {
    env!("CARGO_BIN_EXE_devflow")
}

/// Runs `devflow release <args> <project>` with an ISOLATED `HOME` (a fresh
/// empty directory, no `.gitconfig`) and no inherited `SSH_AUTH_SOCK`/
/// `SSH_AGENT_PID` — the signing-viability check (Task 3) reads
/// `git config gpg.format`/`user.signingkey`, which git resolves through
/// the OPERATOR's global `~/.gitconfig` even inside a throwaway fixture
/// repo. Without this isolation, these tests would be non-deterministic on
/// any machine whose global config sets `gpg.format=ssh` (this project's
/// own dev machine does — the exact Pattern 4 research finding).
fn run_release(project: &Path, args: &[&str]) -> Output {
    let isolated_home = tempfile::tempdir().unwrap();
    Command::new(devflow_bin())
        .arg("release")
        .args(args)
        .arg(project)
        .env("HOME", isolated_home.path())
        .env_remove("SSH_AUTH_SOCK")
        .env_remove("SSH_AGENT_PID")
        .output()
        .expect("spawn devflow release")
}

fn git(root: &Path, args: &[&str]) {
    // Hermetic: pinning cwd alone does not stop an inherited GIT_DIR from
    // retargeting the real repository (999.37).
    let output = devflow_core::test_support::git_command(root)
        .args(args)
        .output()
        .expect("spawn git");
    assert!(
        output.status.success(),
        "git {args:?} failed: {}",
        String::from_utf8_lossy(&output.stderr)
    );
}

fn init_repo(root: &Path) {
    git(root, &["init", "-q"]);
    git(root, &["config", "user.email", "test@example.com"]);
    git(root, &["config", "user.name", "Test"]);
    git(root, &["config", "commit.gpgsign", "false"]);
    git(root, &["config", "tag.gpgsign", "false"]);
    git(root, &["config", "core.hooksPath", "/dev/null"]);
    git(root, &["checkout", "-q", "-b", "develop"]);
}

fn commit(root: &Path, name: &str) {
    std::fs::write(root.join(name), name).unwrap();
    git(root, &["add", "."]);
    git(root, &["commit", "-q", "-m", &format!("add {name}")]);
}

fn rev_parse(root: &Path, rev: &str) -> String {
    let output = devflow_core::test_support::git_command(root)
        .args(["rev-parse", rev])
        .output()
        .expect("git rev-parse");
    String::from_utf8_lossy(&output.stdout).trim().to_string()
}

/// A workspace Cargo.toml whose `[workspace.dependencies]` self-pin either
/// matches or diverges from `[workspace.package] version`.
fn write_workspace_fixture(dir: &Path, package_version: &str, pin_version: &str) {
    std::fs::write(
        dir.join("Cargo.toml"),
        format!(
            "[workspace]\nmembers = [\"crates/devflow-core\"]\n\n\
             [workspace.package]\nversion = \"{package_version}\"\nedition = \"2024\"\n\n\
             [workspace.dependencies]\n\
             devflow-core = {{ path = \"crates/devflow-core\", version = \"{pin_version}\" }}\n"
        ),
    )
    .unwrap();
}

#[test]
fn release_check_passes_when_pins_match() {
    let dir = tempfile::tempdir().unwrap();
    write_workspace_fixture(dir.path(), "1.7.0", "1.7.0");

    let output = run_release(dir.path(), &["--check"]);
    let stdout = String::from_utf8_lossy(&output.stdout);
    assert!(
        output.status.success(),
        "expected release --check to pass on matching pins, got: {stdout}\nstderr: {}",
        String::from_utf8_lossy(&output.stderr)
    );
    assert!(
        stdout.contains("release preflight passed"),
        "expected a passing report, got: {stdout}"
    );
}

#[test]
fn release_check_flags_self_pin_drift() {
    let dir = tempfile::tempdir().unwrap();
    // The exact defect class 20a fixes: the workspace version moved to
    // 1.7.0, but the self-pin was left on the previous release's 1.6.0.
    write_workspace_fixture(dir.path(), "1.7.0", "1.6.0");

    let output = run_release(dir.path(), &["--check"]);
    let stdout = String::from_utf8_lossy(&output.stdout);
    let stderr = String::from_utf8_lossy(&output.stderr);
    assert!(
        !output.status.success(),
        "expected release --check to fail on a drifted self-pin, got: {stdout}\nstderr: {stderr}"
    );
    assert!(
        stdout.contains("1.6.0") && stdout.contains("1.7.0"),
        "expected the drifted pin (1.6.0) and the workspace version (1.7.0) both named in \
         the report, got: {stdout}"
    );
}

#[test]
fn release_without_check_is_rejected() {
    let dir = tempfile::tempdir().unwrap();
    // No Cargo.toml needed — the bare-release rejection happens before any
    // check runs.
    let output = run_release(dir.path(), &[]);
    let stderr = String::from_utf8_lossy(&output.stderr);
    assert!(
        !output.status.success(),
        "expected bare `devflow release` (no --check) to be rejected, got success. stdout: {}",
        String::from_utf8_lossy(&output.stdout)
    );
    assert!(
        stderr.contains("DEN-50"),
        "expected the rejection to name the deferred release-cut executor (DEN-50), got: {stderr}"
    );
    assert!(
        stderr.contains("--check"),
        "expected the rejection to mention --check, got: {stderr}"
    );
}

/// Task 2: `origin/main` resolves locally but is NOT an ancestor of
/// `HEAD` — develop has diverged and `scripts/sync-main-to-develop.sh`
/// should be run before the next release PR. No `git fetch` is issued;
/// `refs/remotes/origin/main` is set directly to simulate an
/// already-fetched-but-diverged remote-tracking ref.
#[test]
fn release_check_reports_divergence_when_main_not_ancestor() {
    let dir = tempfile::tempdir().unwrap();
    let root = dir.path();
    init_repo(root);
    commit(root, "base.txt");

    // Simulate origin/main at a commit that is NOT reachable from the
    // current branch — a sibling line of history, not an ancestor.
    git(root, &["checkout", "-q", "-b", "main-line"]);
    commit(root, "main-only.txt");
    let main_sha = rev_parse(root, "HEAD");
    git(root, &["update-ref", "refs/remotes/origin/main", &main_sha]);

    git(root, &["checkout", "-q", "develop"]);
    commit(root, "develop-only.txt");

    let output = run_release(root, &["--check"]);
    let stdout = String::from_utf8_lossy(&output.stdout);
    let stderr = String::from_utf8_lossy(&output.stderr);
    assert!(
        !output.status.success(),
        "expected release --check to fail on a real divergence, got: {stdout}\nstderr: {stderr}"
    );
    assert!(
        stdout.contains("sync-main-to-develop.sh"),
        "expected the divergence failure to name the sync script, got: {stdout}"
    );
}

/// Task 2 edge-probe (20d/empty, network independence): `origin/main` was
/// never fetched at all — no remote-tracking ref exists locally. The check
/// must degrade to an actionable message, never crash and never issue an
/// implicit `git fetch`.
#[test]
fn release_check_divergence_degrades_when_origin_main_absent() {
    let dir = tempfile::tempdir().unwrap();
    let root = dir.path();
    init_repo(root);
    commit(root, "base.txt");
    // No `refs/remotes/origin/main` created at all.

    let output = run_release(root, &["--check"]);
    let stdout = String::from_utf8_lossy(&output.stdout);
    assert!(
        stdout.contains("origin/main not fetched"),
        "expected an actionable 'origin/main not fetched' message, got: {stdout}\nstderr: {}",
        String::from_utf8_lossy(&output.stderr)
    );
    assert!(
        stdout.contains("git fetch"),
        "expected the degrade message to direct the operator to `git fetch`, got: {stdout}"
    );
}

/// Task 2: the publish-order check states `devflow-core` before `devflow`
/// (path dependency `devflow` -> `devflow-core`), derived from the
/// workspace's own `[workspace] members` list and each member's own
/// `[dependencies]` section — never a hardcoded prose string.
#[test]
fn release_check_states_publish_order() {
    let dir = tempfile::tempdir().unwrap();
    let root = dir.path();
    std::fs::write(
        root.join("Cargo.toml"),
        "[workspace]\nmembers = [\n    \"crates/devflow-core\",\n    \"crates/devflow-cli\",\n]\n\n\
         [workspace.package]\nversion = \"1.0.0\"\nedition = \"2024\"\n\n\
         [workspace.dependencies]\n\
         devflow-core = { path = \"crates/devflow-core\", version = \"1.0.0\" }\n",
    )
    .unwrap();
    std::fs::create_dir_all(root.join("crates/devflow-core")).unwrap();
    std::fs::write(
        root.join("crates/devflow-core/Cargo.toml"),
        "[package]\nname = \"devflow-core\"\nversion.workspace = true\n\n[dependencies]\n",
    )
    .unwrap();
    std::fs::create_dir_all(root.join("crates/devflow-cli")).unwrap();
    std::fs::write(
        root.join("crates/devflow-cli/Cargo.toml"),
        "[package]\nname = \"devflow\"\nversion.workspace = true\n\n\
         [dependencies]\ndevflow-core.workspace = true\n",
    )
    .unwrap();

    let output = run_release(root, &["--check"]);
    let stdout = String::from_utf8_lossy(&output.stdout);
    assert!(
        stdout.contains("devflow-core -> devflow") && !stdout.contains("devflow -> devflow-core"),
        "expected the publish order to state devflow-core before devflow, got: {stdout}\nstderr: {}",
        String::from_utf8_lossy(&output.stderr)
    );
}

/// Task 3 (T-20-04, ASVS V6 / WR-02): the signing-viability check's
/// rendered output must never contain private-key material or a full
/// filesystem path — a REAL disposable ed25519 keypair (private + public)
/// is written directly inside the fixture, proving the check never echoes
/// either, regardless of what's sitting alongside the public key on disk.
/// `SSH_AUTH_SOCK` is removed (via `run_release`'s isolation) so this
/// resolves deterministically to the "no ssh-agent reachable" branch
/// rather than depending on any locally running agent.
#[test]
fn release_check_signing_output_leaks_no_key_material_or_path() {
    let dir = tempfile::tempdir().unwrap();
    let root = dir.path();
    init_repo(root);
    commit(root, "base.txt");
    git(root, &["config", "gpg.format", "ssh"]);

    let key_path = root.join("release-signing-key");
    let keygen = Command::new("ssh-keygen")
        .args([
            "-t",
            "ed25519",
            "-f",
            key_path.to_str().unwrap(),
            "-N",
            "",
            "-q",
        ])
        .output()
        .expect("spawn ssh-keygen");
    assert!(
        keygen.status.success(),
        "ssh-keygen fixture setup failed: {}",
        String::from_utf8_lossy(&keygen.stderr)
    );
    let pub_key_path = root.join("release-signing-key.pub");
    git(
        root,
        &["config", "user.signingkey", pub_key_path.to_str().unwrap()],
    );

    let output = run_release(root, &["--check"]);
    let stdout = String::from_utf8_lossy(&output.stdout);

    assert!(
        !stdout.contains("PRIVATE KEY"),
        "signing check output must never contain private key material, got: {stdout}"
    );
    assert!(
        !stdout.contains(root.to_str().unwrap()),
        "signing check output must never contain a full filesystem path, got: {stdout}"
    );
    assert!(
        !stdout.contains("panicked"),
        "signing check must never panic, got: {stdout}"
    );
}

/// D-08/D-10/D-11 (24-02 Task 1): the operator-boundary proof for plan
/// 24-01's inline-key classification. Before 24-01, ANY `user.signingkey`
/// value was treated as a filesystem path, so a legitimately-shaped inline
/// value (`key::`-prefixed or the deprecated raw `ssh-` form) was always
/// reported as a missing key file — a false hard fail. This test proves
/// both inline forms are now classified correctly at the CLI boundary and
/// that the configured blob never reaches stdout, in whole or in part.
/// `SSH_AUTH_SOCK`/`SSH_AGENT_PID` are removed (via `run_release`'s
/// isolation), so both runs deterministically reach the shared
/// "no ssh-agent reachable" arm rather than depending on a locally running
/// agent — which also proves the inline value travelled all the way to
/// that shared code path instead of short-circuiting on the path-existence
/// check.
#[test]
fn release_check_inline_signingkey_is_not_reported_missing_and_leaks_no_key_material() {
    let dir = tempfile::tempdir().unwrap();
    let root = dir.path();
    init_repo(root);
    commit(root, "base.txt");
    git(root, &["config", "gpg.format", "ssh"]);

    let key_path = root.join("inline-signing-key");
    let keygen = Command::new("ssh-keygen")
        .args([
            "-t",
            "ed25519",
            "-f",
            key_path.to_str().unwrap(),
            "-N",
            "",
            "-q",
        ])
        .output()
        .expect("spawn ssh-keygen");
    assert!(
        keygen.status.success(),
        "ssh-keygen fixture setup failed: {}",
        String::from_utf8_lossy(&keygen.stderr)
    );
    let pub_key_path = root.join("inline-signing-key.pub");
    let blob = std::fs::read_to_string(&pub_key_path)
        .expect("read generated public key")
        .trim()
        .to_string();
    let mut tokens = blob.split_whitespace();
    let key_type_token = tokens.next().expect("public key has a key-type token");
    let base64_body_token = tokens.next().expect("public key has a base64 body token");
    let comment_token = tokens.next().expect("public key has a comment token");
    assert!(
        blob.starts_with("ssh-ed25519"),
        "expected an ed25519 public key blob, got: {blob}"
    );

    const MISSING_FILE_REASON: &str = "user.signingkey is set but the key file does not exist";

    // Form 1 (D-01 rule 1): `key::`-prefixed inline value.
    git(
        root,
        &["config", "user.signingkey", &format!("key::{blob}")],
    );
    let output = run_release(root, &["--check"]);
    let stdout = String::from_utf8_lossy(&output.stdout);
    assert!(
        !stdout.contains(MISSING_FILE_REASON),
        "key:: form: expected no missing-key-file diagnostic for an inline value, got: {stdout}"
    );
    assert!(
        !stdout.contains(&blob),
        "key:: form: expected no part of the configured blob in output, got: {stdout}"
    );
    assert!(
        !stdout.contains(base64_body_token),
        "key:: form: expected no part of the key's base64 body in output, got: {stdout}"
    );
    assert!(
        !stdout.contains(comment_token),
        "key:: form: expected no part of the key's comment token in output, got: {stdout}"
    );
    assert!(
        !stdout.contains("PRIVATE KEY"),
        "key:: form: expected no private key material in output, got: {stdout}"
    );
    assert!(
        !stdout.contains(root.to_str().unwrap()),
        "key:: form: expected no filesystem path in output, got: {stdout}"
    );
    assert!(
        !stdout.contains("panicked"),
        "key:: form: must never panic, got: {stdout}"
    );
    assert!(
        stdout.contains("no ssh-agent reachable"),
        "key:: form: expected the inline value to reach the shared agent-status arm, got: {stdout}"
    );

    // Form 2 (D-01 rule 2): the raw deprecated `ssh-` form (no `key::` prefix).
    assert!(
        key_type_token.starts_with("ssh-"),
        "sanity: raw form must itself start with ssh- to exercise D-01 rule 2, got: {key_type_token}"
    );
    git(root, &["config", "user.signingkey", &blob]);
    let output = run_release(root, &["--check"]);
    let stdout = String::from_utf8_lossy(&output.stdout);
    assert!(
        !stdout.contains(MISSING_FILE_REASON),
        "raw ssh- form: expected no missing-key-file diagnostic for an inline value, got: {stdout}"
    );
    assert!(
        !stdout.contains(&blob),
        "raw ssh- form: expected no part of the configured blob in output, got: {stdout}"
    );
    assert!(
        !stdout.contains(base64_body_token),
        "raw ssh- form: expected no part of the key's base64 body in output, got: {stdout}"
    );
    assert!(
        !stdout.contains(comment_token),
        "raw ssh- form: expected no part of the key's comment token in output, got: {stdout}"
    );
    assert!(
        !stdout.contains("PRIVATE KEY"),
        "raw ssh- form: expected no private key material in output, got: {stdout}"
    );
    assert!(
        !stdout.contains(root.to_str().unwrap()),
        "raw ssh- form: expected no filesystem path in output, got: {stdout}"
    );
    assert!(
        !stdout.contains("panicked"),
        "raw ssh- form: must never panic, got: {stdout}"
    );
    assert!(
        stdout.contains("no ssh-agent reachable"),
        "raw ssh- form: expected the inline value to reach the shared agent-status arm, got: {stdout}"
    );
}

/// A `PATH` containing ONLY a symlink to the real `git` binary — unlike a
/// bare directory restriction (e.g. `/usr/bin`), this guarantees `ssh-add`/
/// `ssh-keygen` are genuinely absent regardless of the host (some distros,
/// including this one, ship both alongside `git` in `/usr/bin`).
fn git_only_path() -> tempfile::TempDir {
    let dir = tempfile::tempdir().unwrap();
    let which = Command::new("which")
        .arg("git")
        .output()
        .expect("locate git via `which`");
    assert!(which.status.success(), "`which git` failed");
    let real_git = String::from_utf8_lossy(&which.stdout).trim().to_string();
    std::os::unix::fs::symlink(real_git, dir.path().join("git"))
        .expect("symlink git into the minimal PATH fixture");
    dir
}

/// Task 3 fail-soft edge (20d/empty): `ssh-add` itself is unavailable. The
/// check must degrade to an actionable message, never crash.
#[test]
fn release_check_signing_degrades_when_ssh_add_absent() {
    let dir = tempfile::tempdir().unwrap();
    let root = dir.path();
    init_repo(root);
    commit(root, "base.txt");
    git(root, &["config", "gpg.format", "ssh"]);
    let key_path = root.join("fake-signing-key.pub");
    std::fs::write(&key_path, "ssh-ed25519 AAAAfixture placeholder\n").unwrap();
    git(
        root,
        &["config", "user.signingkey", key_path.to_str().unwrap()],
    );

    let isolated_home = tempfile::tempdir().unwrap();
    let path_dir = git_only_path();
    let output = Command::new(devflow_bin())
        .arg("release")
        .arg("--check")
        .arg(root)
        .env("HOME", isolated_home.path())
        .env("PATH", path_dir.path())
        .output()
        .expect("spawn devflow release");
    let stdout = String::from_utf8_lossy(&output.stdout);

    assert!(
        stdout.contains("ssh-add not found"),
        "expected a fail-soft 'tool not found' message, got: {stdout}\nstderr: {}",
        String::from_utf8_lossy(&output.stderr)
    );
    assert!(
        !stdout.contains("panicked"),
        "must not panic, got: {stdout}"
    );
}

/// D-06/D-08/D-10/D-11 (24-02 Task 2): the fail-soft proof for an inline
/// `user.signingkey` when the ssh tooling itself is absent from `PATH`. No
/// real keypair is generated — the point under test is the classification
/// (inline vs. path), not fingerprinting, and the tooling that would
/// fingerprint it is deliberately absent here.
///
/// The load-bearing assertion is the absence of the signing check's
/// `NotViable` remediation hint (copied character-for-character from
/// `check_signing` in `commands.rs`): `install_hint` is `None` on the
/// `Unknown` arm and `Some(...)` only on `NotViable`, so a hard-failing
/// signing check always prints this hint and a fail-soft one never does.
/// Before 24-01, an inline value on this same fixture hit the path branch's
/// missing-key-file `NotViable` and printed exactly this hint — that is the
/// headline defect this assertion falsifies.
#[test]
fn release_check_inline_signingkey_degrades_to_warn_when_ssh_tooling_absent() {
    let dir = tempfile::tempdir().unwrap();
    let root = dir.path();
    init_repo(root);
    commit(root, "base.txt");
    git(root, &["config", "gpg.format", "ssh"]);
    let inline_blob = "key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFAKEFIXTUREKEYMATERIALZZZZZZZZZZZZZZZZZZZZZZ devflow-fixture";
    git(root, &["config", "user.signingkey", inline_blob]);

    let isolated_home = tempfile::tempdir().unwrap();
    let path_dir = git_only_path();
    let output = Command::new(devflow_bin())
        .arg("release")
        .arg("--check")
        .arg(root)
        .env("HOME", isolated_home.path())
        .env("PATH", path_dir.path())
        .output()
        .expect("spawn devflow release");
    let stdout = String::from_utf8_lossy(&output.stdout);

    assert!(
        stdout.contains("ssh-add not found"),
        "expected the fail-soft 'ssh-add not found' reason (D-06), got: {stdout}\nstderr: {}",
        String::from_utf8_lossy(&output.stderr)
    );
    assert!(
        !stdout.contains("resolve before attempting the signed release tag"),
        "expected NO signing remediation hint — its presence would mean the inline value \
         produced a hard NotViable fail instead of a fail-soft warn, got: {stdout}"
    );
    assert!(
        !stdout.contains("user.signingkey is set but the key file does not exist"),
        "expected no missing-key-file diagnostic for an inline value, got: {stdout}"
    );
    assert!(
        !stdout.contains(
            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFAKEFIXTUREKEYMATERIALZZZZZZZZZZZZZZZZZZZZZZ"
        ),
        "expected no part of the configured inline blob in output, got: {stdout}"
    );
    assert!(
        !stdout.contains("AAAAC3NzaC1lZDI1NTE5AAAAIFAKEFIXTUREKEYMATERIALZZZZZZZZZZZZZZZZZZZZZZ"),
        "expected no part of the key's base64 body token in output, got: {stdout}"
    );
    assert!(
        !stdout.contains("panicked"),
        "must not panic, got: {stdout}"
    );
}