#!/usr/bin/env python3
import importlib.util,json,os,shutil,subprocess,time
from pathlib import Path
from types import SimpleNamespace
R=Path(__file__).resolve().parent
spec=importlib.util.spec_from_file_location('driver',R.parent/'devsecops-drone/scripts/lib/e2e_driver.py'); d=importlib.util.module_from_spec(spec);spec.loader.exec_module(d)
cred=json.loads((R.parent/'devsecops-gitea/credentials.json').read_text()); state=json.loads((R/'config/state.json').read_text())
a=SimpleNamespace(gitea='http://localhost:3000',drone='http://localhost:8085',user=cred['username'],password=cred['password'],token=state['token'],evidence=str(R/'evidence'))
d.oauth_login(a); auth={'Authorization':'Bearer '+a.token}
repos=d.api('GET',a.gitea+'/api/v1/user/repos?limit=100',headers=d.basic(a.user,a.password))
existing=next((x for x in repos if x['name']=='my-app'),None)
if existing and not existing.get('empty',existing.get('size',0)==0):
 raise RuntimeError('Existing nonempty my-app repository detected; leave its content unchanged')
if not existing: d.api('POST',a.gitea+'/api/v1/user/repos',{'name':'my-app','private':True,'auto_init':False,'default_branch':'main'},d.basic(a.user,a.password))
d.api('POST',a.drone+'/api/user/repos?async=false',headers=auth)
r=d.api('POST',a.drone+f'/api/repos/{a.user}/my-app',headers=auth);assert r['active']
d.api('PATCH',a.drone+f'/api/repos/{a.user}/my-app',{'trusted':True},headers=auth)
hooks=d.api('GET',a.gitea+f'/api/v1/repos/{a.user}/my-app/hooks',headers=d.basic(a.user,a.password))
assert any(x['config']['url'].startswith(a.drone+'/hook') for x in hooks)
repo=R/'my-app'
if not repo.exists(): shutil.copytree(R.parent/'my-devsecops/my-app',repo)
p=repo/'.drone.yml';p.write_text(p.read_text().replace('/run/podman/podman.sock','/run/devsecops-local-engine.sock'))
ask=R/'config/askpass';ask.write_text('#!/bin/sh\ncase "$1" in *Username*) printf "%s\\n" "$MY_APP_USER";; *) printf "%s\\n" "$MY_APP_PASSWORD";; esac\n');ask.chmod(0o700)
env=dict(os.environ,GIT_ASKPASS=str(ask),GIT_TERMINAL_PROMPT='0',MY_APP_USER=a.user,MY_APP_PASSWORD=a.password,GIT_CONFIG_COUNT='1',GIT_CONFIG_KEY_0='credential.helper',GIT_CONFIG_VALUE_0='')
def git(*cmd):
 p=subprocess.run(['git',*cmd],cwd=repo,env=env,text=True,capture_output=True)
 if p.returncode: raise RuntimeError('Git failed: '+p.stderr[:1000])
 return p.stdout.strip()
git('init','-q','-b','main');git('config','user.name',a.user);git('config','user.email','devsecops-local@example.invalid');git('remote','add','origin',a.gitea+f'/{a.user}/my-app.git')
git('add','.');git('commit','-qm','Enable automatic my-app image build and Syft Grype Trivy checks');sha=git('rev-parse','HEAD');git('push','-q','-u','origin','main')
print('Pushed my-app commit '+sha+'; waiting for automatic Drone build',flush=True)
build=d.wait_build(a,'my-app',auth,timeout=1200)
steps=d.save_logs(a,'my-app',build,auth)
summary={'gitea':a.gitea,'drone':a.drone,'repository':a.user+'/my-app','commit':sha,'build':build['number'],'status':build['status'],'steps':{k:v['status'] for k,v in steps.items()}}
(R/'evidence/live-build.json').write_text(json.dumps(summary,indent=2)+'\n')
print(json.dumps(summary),flush=True)
assert build['status']=='success','Live build did not pass; inspect saved step logs'