import { mkdir, readFile, writeFile } from "node:fs/promises";

const verification = JSON.parse(
  await readFile(
    "artifacts/security/supply-chain-verification.json",
    "utf8",
  ),
);
const passed = verification.promotionStatus === "PASS";
const report = {
  schemaVersion: 1,
  status: passed ? "PASS" : "FAIL_UNVERIFIED",
  vulnerabilityStatus: verification.vulnerabilityStatus,
  provenanceAttestationStatus:
    verification.provenanceAttestationStatus,
  lockfileSha256: verification.lockfileSha256,
  distSha256: verification.distSha256,
};
await mkdir("artifacts/security", { recursive: true });
await writeFile(
  "artifacts/security/promotion-verification.json",
  `${JSON.stringify(report, null, 2)}\n`,
);
if (!passed) {
  process.stderr.write(
    "Supply-chain promotion is FAIL_UNVERIFIED: external vulnerability and signed provenance evidence are required.\n",
  );
  process.exit(1);
}
process.stdout.write("Supply-chain promotion evidence: PASS\n");