import { spawnSync } from "node:child_process";
import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
import path from "node:path";

const fixtureDirectory = path.resolve(".tmp/supply-chain-provider-fixture");
await rm(fixtureDirectory, { recursive: true, force: true });
await mkdir(fixtureDirectory, { recursive: true });
const inventory = JSON.parse(
  await readFile("artifacts/release/dependency-inventory.json", "utf8"),
);
const verification = JSON.parse(
  await readFile(
    "artifacts/security/supply-chain-verification.json",
    "utf8",
  ),
);
const vulnerabilityPath = path.join(
  fixtureDirectory,
  "vulnerability-report.json",
);
const attestationPath = path.join(fixtureDirectory, "attestation.json");
await writeFile(
  vulnerabilityPath,
  `${JSON.stringify(
    {
      schemaVersion: 1,
      provider: "fixture-scanner",
      scannedLockfileSha256: inventory.lockfileSha256,
      generatedAt: "2026-07-26T00:00:00.000Z",
      findings: [],
    },
    null,
    2,
  )}\n`,
);
await writeFile(
  attestationPath,
  `${JSON.stringify(
    {
      schemaVersion: 1,
      provider: "fixture-attestor",
      signer: "fixture-workload-identity",
      subject: {
        name: "dist",
        digest: { sha256: verification.distSha256 },
      },
    },
    null,
    2,
  )}\n`,
);
const providerRun = spawnSync(
  "node",
  ["scripts/generate-supply-chain.mjs"],
  {
    env: {
      ...process.env,
      VULNERABILITY_REPORT_PATH: vulnerabilityPath,
      PROVENANCE_ATTESTATION_PATH: attestationPath,
    },
    encoding: "utf8",
  },
);
let promotionStatus = "MISSING";
if (providerRun.status === 0) {
  promotionStatus = JSON.parse(
    await readFile(
      "artifacts/security/supply-chain-verification.json",
      "utf8",
    ),
  ).promotionStatus;
}
const restore = spawnSync(
  "node",
  ["scripts/generate-supply-chain.mjs"],
  { encoding: "utf8" },
);
await rm(fixtureDirectory, { recursive: true, force: true });
const passed =
  providerRun.status === 0 &&
  promotionStatus === "PASS" &&
  restore.status === 0;
await writeFile(
  "artifacts/security/supply-chain-provider-fixtures.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      providerAccepted: providerRun.status === 0,
      promotionStatus,
      unverifiedDefaultRestored: restore.status === 0,
      status: passed ? "PASS" : "FAIL",
    },
    null,
    2,
  )}\n`,
);
if (!passed) {
  process.stderr.write(
    `Supply-chain provider fixture failed: ${providerRun.stderr || restore.stderr}\n`,
  );
  process.exit(1);
}
process.stdout.write(
  "Supply-chain provider fixture: verified PASS and unconfigured default restored\n",
);