#!/usr/bin/env bash
# Run with network disabled: unshare --net bash scripts/smoke-test.sh
set -euo pipefail
root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
tmp="$(mktemp -d /tmp/devsecops-smoke.XXXXXXXX)"
export PATH="$root/bin:$PATH"
mkdir -p "$tmp/source" "$tmp/reports"
printf 'requests==2.19.1\n' > "$tmp/source/requirements.txt"
printf 'FROM ubuntu:22.04\nUSER root\n' > "$tmp/source/Dockerfile"
if "$root/scripts/scan-source.sh" "$tmp/source" "$tmp/reports"; then
    echo 'ERROR: vulnerable fixture passed the security gate' >&2; exit 1
fi
python3 - "$tmp/reports" <<'PY'
import json, sys
from pathlib import Path
p=Path(sys.argv[1])
r=json.loads((p/'trivy-source.json').read_text())
assert any(v.get('Severity') in ('HIGH','CRITICAL') for t in r.get('Results',[]) for v in t.get('Vulnerabilities',[]))
assert json.loads((p/'source.cdx.json').read_text())['bomFormat']=='CycloneDX'
PY
mkdir -p "$tmp/secret-fixture"
python3 - "$tmp/secret-fixture/token.txt" <<'PY'
from pathlib import Path
import random, string, sys
r = random.Random(1729)
token = 'ghp_' + ''.join(r.choices(string.ascii_letters + string.digits, k=36))
Path(sys.argv[1]).write_text('github_token = "' + token + '"\n')
PY
secret_rc=0
gitleaks dir "$tmp/secret-fixture" --redact --report-format json \
    --report-path "$tmp/secret-findings.json" || secret_rc=$?
[[ "$secret_rc" == 1 ]] || { echo 'Secret fixture was not detected' >&2; exit 1; }
echo "PASS: vulnerable dependency blocked, SBOM generated, secret detected. Test files: $tmp"