name: Rho Action Fixture

on:
  pull_request:
    paths:
      - ".github/workflows/rho-action-fixture.yml"
      - "action/**"
      - "src/**"
      - "tests/e2e/rho-check-pr.sh"
      - "Cargo.toml"
      - "Cargo.lock"
      - "rho"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  action-fixture:
    runs-on: namespace-profile-linux-medium
    steps:
      - uses: actions/checkout@v4

      - uses: ./action/setup-rho

      - name: Create Rho policy fixture
        shell: bash
        run: |
          set -euo pipefail

          sandbox="${RUNNER_TEMP}/rho-action-fixture"
          repo="${sandbox}/repo"
          owner_home="${sandbox}/owner-home"
          member_home="${sandbox}/member-home"
          guest_home="${sandbox}/guest-home"
          blocked_home="${sandbox}/blocked-home"

          owner_id="rho://id/github/rho-owner"
          member_id="rho://id/github/rho-member"
          blocked_id="rho://id/github/rho-blocked"

          rm -rf "$sandbox"
          mkdir -p "$repo"
          git -C "$repo" init
          git -C "$repo" config user.name "Rho Action Fixture"
          git -C "$repo" config user.email "rho-action-fixture@example.test"
          git -C "$repo" config commit.gpgsign false
          git -C "$repo" switch -c main

          RHO_HOME="$owner_home" ./rho id init \
            --github rho-owner \
            --display-name "Rho Owner" \
            --generate-ssh-key >/dev/null
          RHO_HOME="$member_home" ./rho id init \
            --github rho-member \
            --display-name "Rho Member" \
            --generate-ssh-key >/dev/null
          RHO_HOME="$guest_home" ./rho id init \
            --github rho-guest \
            --display-name "Rho Guest" \
            --generate-ssh-key >/dev/null
          RHO_HOME="$blocked_home" ./rho id init \
            --github rho-blocked \
            --display-name "Rho Blocked" \
            --generate-ssh-key >/dev/null

          ./rho repo init \
            --root "$repo" \
            --repo-id rho://repo/local/action-fixture \
            --owner "$owner_id" \
            --yes >/dev/null

          cat > "$repo/rho/membership.yaml" <<EOF
          version: 1
          members:
            - identity: $owner_id
              role: owner
            - identity: $member_id
              role: collaborator
          EOF

          cat > "$repo/rho/policy/revocations.yaml" <<EOF
          version: 1
          revocations:
            - identity: $blocked_id
              decision: blocked
          EOF

          git -C "$repo" add .
          git -C "$repo" commit -m "Initialize Rho action fixture"

          cat > "$sandbox/member-event.json" <<EOF
          {
            "pull_request": {
              "user": {
                "login": "rho-member"
              }
            },
            "rho_changed_files": [
              "workspace/member-script.py"
            ]
          }
          EOF

          cat > "$sandbox/guest-event.json" <<EOF
          {
            "pull_request": {
              "user": {
                "login": "rho-guest"
              }
            },
            "rho_changed_files": [
              "rho/participants/rho-guest.yaml",
              "rho/requests/join-rho-guest.yaml"
            ]
          }
          EOF

          cat > "$sandbox/blocked-event.json" <<EOF
          {
            "pull_request": {
              "user": {
                "login": "rho-blocked"
              }
            },
            "rho_changed_files": [
              "workspace/blocked-script.py"
            ]
          }
          EOF

          {
            echo "RHO_ACTION_FIXTURE_REPO=$repo"
            echo "RHO_ACTION_FIXTURE_MEMBER_EVENT=$sandbox/member-event.json"
            echo "RHO_ACTION_FIXTURE_GUEST_EVENT=$sandbox/guest-event.json"
            echo "RHO_ACTION_FIXTURE_BLOCKED_EVENT=$sandbox/blocked-event.json"
          } >> "$GITHUB_ENV"

      - name: Member workspace change passes
        id: member
        uses: ./action/check-pr
        with:
          root: ${{ env.RHO_ACTION_FIXTURE_REPO }}
          event-path: ${{ env.RHO_ACTION_FIXTURE_MEMBER_EVENT }}

      - name: Assert member result
        shell: bash
        run: |
          set -euo pipefail
          test "${{ steps.member.outputs.status }}" = "pass"

      - name: Unknown join request is pending
        id: guest
        uses: ./action/check-pr
        with:
          root: ${{ env.RHO_ACTION_FIXTURE_REPO }}
          event-path: ${{ env.RHO_ACTION_FIXTURE_GUEST_EVENT }}
          fail-on-pending: "false"

      - name: Assert guest result
        shell: bash
        run: |
          set -euo pipefail
          test "${{ steps.guest.outputs.status }}" = "pending"

      - name: Blocked actor is blocked
        id: blocked
        uses: ./action/check-pr
        with:
          root: ${{ env.RHO_ACTION_FIXTURE_REPO }}
          event-path: ${{ env.RHO_ACTION_FIXTURE_BLOCKED_EVENT }}
          fail-on-blocked: "false"

      - name: Assert blocked result
        shell: bash
        run: |
          set -euo pipefail
          test "${{ steps.blocked.outputs.status }}" = "blocked"
          test "${{ steps.blocked.outputs['close-recommended'] }}" = "true"
