import { mkdir, writeFile } from "node:fs/promises";
import path from "node:path";

import { evaluateRepositorySecretScan } from "./lib/secret-scan-evaluator.ts";

function argumentValue(name: string, fallback: string): string {
  const index = process.argv.indexOf(name);
  return index >= 0 && process.argv[index + 1]
    ? process.argv[index + 1]
    : fallback;
}

const policyPath = argumentValue(
  "--policy",
  "config/security/secret-scan-policy.json",
);
const artifactPath = argumentValue(
  "--artifact",
  "artifacts/security/scan.sarif",
);
const evaluation = await evaluateRepositorySecretScan({ policyPath });

await mkdir(path.dirname(artifactPath), { recursive: true });
await writeFile(
  artifactPath,
  `${JSON.stringify(evaluation.sarif, null, 2)}\n`,
);
const blockingCount =
  evaluation.findings.length + evaluation.policyFailures.length;
if (blockingCount > 0) {
  process.stderr.write(
    `Security scan found ${blockingCount} blocking result(s).\n`,
  );
  process.exit(1);
}
process.stdout.write(
  `Tracked source, config, built asset and artifact secret scan: PASS (${evaluation.scanFiles.length} files)\n`,
);