#!/usr/bin/env bash
# ci/l0.sh — Stage 2+3: ServiceDefinition schema validation + Kyverno L0 policy gate.
# Both run in CI WITHOUT a cluster (docs/14 §"Where each layer runs") — live now.
#
#   Stage 2  schema : catalog/*.yaml validated against the ServiceDefinition
#                     schema (owner: T-0.3, schemas/).
#   Stage 3  L0     : `kyverno test` over platform/kyverno/ — default-deny baseline
#                     present, no plaintext secrets, required labels/egress-class,
#                     ServiceDefinition schema conformance (owner: T-0.5, ADR-0011).
#
# Integration seams are env-overridable (see ci/lib.sh + README). When an owning
# subtree is still a placeholder, this reports SKIPPED (exit 3) for that sub-stage
# rather than a false pass — the gate then knows the seam is unwired, not green.
set -euo pipefail
CI_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck disable=SC1091
source "${CI_DIR}/lib.sh"

rc=0

# ---- Stage 2: ServiceDefinition schema validation ---------------------------
log "Stage: ServiceDefinition schema validation (catalog/ against schemas/)"
if ! entrypoint_ready "$SCHEMA_VALIDATE_CMD"; then
  skip "schema validator not present at '${SCHEMA_VALIDATE_CMD}' (T-0.3 / schemas/ not delivered yet) — UNWIRED, not green"
  summary "- schema: **SKIPPED** (validator entrypoint \`${SCHEMA_VALIDATE_CMD}\` missing — T-0.3)"
else
  if [ -d "$CATALOG_DIR" ] && compgen -G "${CATALOG_DIR}/*.y*ml" >/dev/null 2>&1; then
    if "$SCHEMA_VALIDATE_CMD" "${CATALOG_DIR}"/*.y*ml; then
      ok "schema validation passed"
      summary "- schema: **passed**"
    else
      err "schema validation failed"; summary "- schema: **FAILED**"; rc=1
    fi
  else
    log "no ServiceDefinitions in ${CATALOG_DIR} yet — validating validator is callable only"
    "$SCHEMA_VALIDATE_CMD" --version >/dev/null 2>&1 || true
    ok "schema validator present; no catalog entries to validate"
    summary "- schema: **passed** (no catalog entries yet)"
  fi
fi

# ---- Stage 3: Kyverno L0 policy gate ----------------------------------------
log "Stage: Kyverno L0 policy gate (kyverno test ${KYVERNO_POLICY_DIR})"
# `kyverno test <dir>` discovers kyverno-test.yaml files recursively.
if ! have kyverno; then
  skip "kyverno CLI not installed (pin v${KYVERNO_VERSION}) — cannot run L0 gate"
  summary "- kyverno-l0: **SKIPPED** (kyverno CLI not installed)"
  # Missing tool is an environment gap, not a code pass -> exit 3 unless already failing.
  [ "$rc" -eq 0 ] && rc=3
elif [ ! -d "$KYVERNO_POLICY_DIR" ] || ! compgen -G "${KYVERNO_POLICY_DIR}/**/kyverno-test.yaml" >/dev/null 2>&1 \
     && ! find "$KYVERNO_POLICY_DIR" -name 'kyverno-test.yaml' 2>/dev/null | grep -q .; then
  skip "no kyverno-test.yaml under '${KYVERNO_POLICY_DIR}' (T-0.5 / platform/kyverno not delivered yet) — UNWIRED, not green"
  summary "- kyverno-l0: **SKIPPED** (no policy tests yet — T-0.5)"
else
  if kyverno test "$KYVERNO_POLICY_DIR"; then
    ok "Kyverno L0 policy tests passed"
    summary "- kyverno-l0: **passed**"
  else
    err "Kyverno L0 policy tests failed"; summary "- kyverno-l0: **FAILED**"; rc=1
  fi
fi

case "$rc" in
  0) ok "L0 stage complete" ;;
  3) skip "L0 stage incomplete (unwired seam / missing tool) — not a pass" ;;
  *) err "L0 stage failed" ;;
esac
exit "$rc"