# =============================================================================
# L3 FAULT-INJECTION SCAFFOLD — GitOps drift correction  (R-GITOPS-03)
# Catalog: docs/14 "GitOps drift (R-GITOPS-03, L3)"
#
# GIVEN a reconciled resource,
# WHEN  it is MUTATED live (out-of-band, simulating drift/click-ops),
# THEN  Flux reverts it to the git-declared state within a bounded window.
#
# Fault-injection style: we deliberately corrupt live state and assert the control
# loop heals it (converges back). `finally` leaves the resource in its declared
# state regardless of outcome.
#
# STATUS: scaffold — needs T-1.4 (Flux bootstrapped) + a reconciled sample resource.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: gitops-drift
  labels:
    conformance.home.k3s/R-GITOPS-03: "true"
  annotations:
    conformance.home.k3s/requirements: "R-GITOPS-03"
    conformance.home.k3s/layer: "L3"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/intent: >-
      A live mutation to a reconciled resource is reverted by Flux to git state.
spec:
  steps:
    - name: given-a-reconciled-resource
      try:
        - script:
            content: 'echo "TODO(T-1.4): pick a Flux-reconciled resource with a known git value"'
    - name: when-mutate-live-out-of-band
      try:
        # FAULT INJECTION: patch the live resource to a value that differs from git.
        - script:
            content: |
              set -euo pipefail
              echo "TODO: kubectl patch the resource to a drifted value (e.g. replicas/annotation)"
    - name: then-flux-reverts-to-git-state
      try:
        - script:
            # Bounded poll: assert the live value returns to the git-declared value.
            content: |
              set -euo pipefail
              echo "TODO: within Flux interval, assert live value == git-declared value"
              echo "DRIFT_REVERTED_OK"
            check: { ($stdout =~ 'DRIFT_REVERTED_OK'): true }
      finally:
        - script:
            content: 'echo "TODO: ensure resource left in git-declared state"'