"""Repository quarantine guards; these never certify actual runner isolation."""
from pathlib import Path
import re
import unittest

WORKFLOW = Path(__file__).resolve().parents[1] / '.gitea/workflows/mariadb-integration.yml'


class MariaDbWorkflowQuarantine(unittest.TestCase):
    def setUp(self):
        self.text = WORKFLOW.read_text(encoding='utf-8')

    def test_requires_dedicated_routing_instead_of_shared_deployment_label(self):
        self.assertRegex(self.text, r'(?m)^    runs-on: jobtracker-mariadb-isolated$')
        self.assertNotRegex(self.text, r'(?m)^    runs-on: ubuntu-latest$')

    def test_untrusted_pull_requests_cannot_automatically_prepare_a_job(self):
        self.assertNotRegex(self.text, r'(?m)^  pull_request(?:_target)?:')

    def test_operator_blocker_precedes_checkout_and_database_execution(self):
        guard = self.text.index('- name: Require verified runner isolation')
        checkout = self.text.index('- uses: actions/checkout')
        self.assertLess(guard, checkout)
        self.assertRegex(self.text[guard:checkout], r'(?m)^          exit 1$')

    def test_current_development_branch_keeps_a_visible_qualification_lane(self):
        self.assertIn('fix/p9-model-cache-and-ci-qualification', self.text)
        self.assertIn('python3 scripts/mariadb-integration.py', self.text)
        self.assertNotIn('privileged:', self.text)
        self.assertNotIn('/var/run/docker.sock', self.text)


if __name__ == '__main__':
    unittest.main()