#!/usr/bin/env bash
#
# check-workflow-concurrency-selftest.sh
#
# Proves `check-workflow-concurrency.sh` can fail. A check that cannot fail is
# decoration, and this repo has a documented history of gates that passed
# because nothing they guarded was ever read.
#
# Both ways the property can break are exercised against a scratch copy, never
# the working tree:
#
#   1. a workflow with no top-level `concurrency:` block;
#   2. a group that does not vary by `github.ref` — which would serialise every
#      branch against every other, worse than having no group at all.
#
# In a script rather than inline in the workflow on purpose. The first version
# embedded a Python heredoc in a `run:` block, and the heredoc body sat at
# column zero, which made the workflow file invalid YAML. An unparseable
# workflow means no CI at all — the exact failure this change exists to
# prevent, reintroduced by the fix for it.

set -euo pipefail

cd "$(dirname "$0")/.."
root=$(pwd)
target=.github/workflows/repo-checks.yml

tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
cp -R .github scripts "$tmp/"

# ── 1. remove the block entirely ────────────────────────────────────────────
python3 - "$tmp/$target" <<'PY'
import re, sys
p = sys.argv[1]
s = open(p).read()
out = re.sub(r"^concurrency:\n(  .*\n)+", "", s, count=1, flags=re.M)
assert out != s, "fixture unchanged: there was no concurrency block to remove"
open(p, "w").write(out)
PY
if ( cd "$tmp" && ./scripts/check-workflow-concurrency.sh ) >/dev/null 2>&1; then
  echo "::error::the check passed a workflow with no concurrency block"
  exit 1
fi

# ── 2. a group that does not vary by ref ────────────────────────────────────
cp -f "$root/$target" "$tmp/$target"
python3 - "$tmp/$target" <<'PY'
import re, sys
p = sys.argv[1]
s = open(p).read()
out = re.sub(r"^(  group:).*$", r"\1 fixed-for-the-whole-repo", s, count=1, flags=re.M)
assert out != s, "fixture unchanged: there was no group line to rewrite"
open(p, "w").write(out)
PY
if ( cd "$tmp" && ./scripts/check-workflow-concurrency.sh ) >/dev/null 2>&1; then
  echo "::error::the check passed a group that does not vary by ref"
  exit 1
fi

echo "self-test: the check rejects both a missing block and a fixed group"