"""`artifacts.sh revision` is what decides whether a build gets skipped.

Milestone 318 step 3: each image carries its revision as an `fc.revision`
label, and build.yml reads that label back off the moving channel tag. Equal
to the derived revision means the bytes this push would produce are already
published, so the build is skipped.

That makes the revision load-bearing in a way a version string is not — it is
compared for equality against a value stamped into a real published artifact.
Both ways of getting it wrong are silent:

* **it does not identify the content** — a revision that moves when the source
  did not (a HEAD-derived value, say) never matches, nothing is ever skipped,
  and the mechanism quietly buys nothing while every lane stays green.
* **it identifies the wrong content** — a revision that holds still when the
  source DID change matches a stale label, the build is skipped, and the
  channel serves bytes that do not correspond to the commit. This is the
  dangerous direction, and it is what `test_artifact_paths.py` guards from the
  other side by pinning the path sets.

This module owns the narrower claim: whatever the path sets say, the revision
is genuinely the commit those paths last changed in.

The identity-TAG tests this file used to hold are gone with the tag. There is
no longer a `CHANNELLED` list to drift (the channel is which tag you inspect),
and no `identity` subcommand to refuse an unqualified call.
"""
from __future__ import annotations

import re
import subprocess
from pathlib import Path

import pytest

ROOT = Path(__file__).resolve().parent.parent

ARTIFACTS = ("web", "ml", "agent", "extension")

# 12 hex chars — the prefix build.yml stamps and compares.
_REVISION = re.compile(r"^[0-9a-f]{12}$")


# Everything here goes through artifacts.sh rather than importing a sibling
# test module. That is the interface build.yml actually calls, so the tests
# exercise the contract instead of a Python re-implementation of it — and no
# other test module in this repo imports another, so a cross-test import would
# be a new convention introduced for no gain.
def artifacts(*args: str) -> str:
    return subprocess.run(
        ["sh", str(ROOT / "scripts" / "artifacts.sh"), *args],
        capture_output=True, text=True, check=True, cwd=ROOT,
    ).stdout


def revision(artifact: str) -> str:
    return artifacts("revision", artifact).strip()


def newest_by_commit_time(artifact: str) -> str:
    """The full SHA of the newest commit touching this artifact's shipped set.

    Ordered by committer TIME, matching what artifacts.sh means. Deliberately
    not `git log -1`: git's default order is reverse-chronological only within
    topological constraints, so on a merged history it can name a different
    commit than the newest timestamp does. They agree on this repo today, and
    a test that silently depends on them continuing to agree would be a flake
    waiting for the branch shape that separates them.
    """
    paths = artifacts("paths", artifact).split()
    log = subprocess.run(
        ["git", "log", "--format=%ct %H", "HEAD", "--", *paths],
        capture_output=True, text=True, check=True, cwd=ROOT,
    ).stdout.split("\n")
    commits = [line.split(" ", 1) for line in log if line.strip()]
    assert commits, (
        f"no commit in this history touches the {artifact} path set — the "
        f"derivation has nothing to stand on"
    )
    return max(commits, key=lambda c: int(c[0]))[1]


@pytest.mark.parametrize("artifact", ARTIFACTS)
def test_revision_is_the_commit_its_own_shipped_files_last_changed_in(artifact):
    """The claim the whole skip decision rests on.

    Computed from git rather than asked of the script, so it fails if the
    derivation ever stops meaning what it says — switching to HEAD, to a build
    clock, or to a path set it did not actually use. Each of those still
    produces a plausible 12-hex value, which is why this is worth asserting
    rather than eyeballing.
    """
    expected = newest_by_commit_time(artifact)
    got = revision(artifact)
    assert expected.startswith(got), (
        f"{artifact} derives {got!r}, but the newest commit touching its "
        f"shipped files is {expected[:12]!r}. The label stamped into the image "
        f"would not identify its own content."
    )


@pytest.mark.parametrize("artifact", ARTIFACTS)
def test_revision_is_a_legal_label_value_and_is_stable(artifact):
    """It is stamped as a docker label and compared for string equality, so a
    stray newline or a varying value breaks the comparison rather than the
    build — the mechanism would simply stop hitting, silently."""
    first = revision(artifact)
    assert _REVISION.match(first), f"{first!r} is not a 12-char hex revision"
    assert first == revision(artifact), "revision is not stable across calls"