import { describe, expect, test } from 'bun:test';
import { readFileSync } from 'node:fs';
import { join } from 'node:path';

/**
 * No command this script sends into a container may use `$?`.
 *
 * dockerExec wraps the command as `bash -c ${JSON.stringify(cmd)}` and hands
 * that to a HOST shell (container-manager.ts:636), so a `$?` inside it is
 * expanded by the host BEFORE the container sees it — to the host's own last
 * status, which is 0.
 *
 * Measured on celilo-builder run 7262, where one layer printed both lines:
 *
 *   curl: (60) SSL certificate problem: unable to get local issuer certificate
 *   curl-exit=0
 *
 * The bake's HTTPS probe read that 0 and passed. It had passed on every run in
 * celilo#1365's history — first hiding the defect behind a 30s timeout, later
 * behind a green step and an unexplained install.sh failure. A probe that
 * cannot fail is not a probe, and the failure it hid was the real one.
 *
 * curl's own `%{exitcode}` carries the status with no shell variable to expand.
 */
describe('no container command relies on host-expanded shell variables', () => {
  const src = readFileSync(join(import.meta.dir, '..', 'bin', 'e2e-bake-management'), 'utf-8');
  // Comments explain the hazard and must be allowed to name it.
  const code = src
    .split('\n')
    .filter((line) => !line.trim().startsWith('//') && !line.trim().startsWith('*'))
    .join('\n');

  test('`$?` appears in no executed command', () => {
    expect(code).not.toContain('$?');
  });

  test("the probe reads curl's exit code from curl itself", () => {
    expect(code).toContain('curl-exit=%{exitcode}');
  });
});