"""Check upload candidates without copying secrets or developer machine artifacts."""
import os
from pathlib import Path
import shutil
import subprocess
import sys
import tempfile
import unittest

ROOT = Path(__file__).resolve().parents[2]


class CheckoutTests(unittest.TestCase):
    def test_git_upload_only_checkout_has_deployment_inputs(self):
        result = subprocess.run(['git', '-c', f'core.excludesFile={os.devnull}', 'ls-files', '-z',
                                 '--cached', '--others', '--exclude-standard'], cwd=ROOT,
                                capture_output=True, check=True)
        names = {os.fsdecode(name) for name in result.stdout.split(b'\0') if name}
        required = {'deploy.sh', '.python-version', 'pyproject.toml', 'uv.lock',
                    'scripts/deploy.py', 'scripts/deploy_models.py', 'scripts/check-runtime.py',
                    'src/step1_knowledge_prepare/summarize.py', 'src/step2_knowledge_ingest/__main__.py',
                    'src/step4_api/__main__.py', 'reference/qa.json'}
        self.assertTrue(required <= names, required - names)
        with tempfile.TemporaryDirectory() as temporary:
            root = Path(temporary) / 'uploaded checkout'
            root.mkdir()
            for name in names:
                # Never read or copy real dotenv even if a user explicitly tracked it.
                if Path(name).name.startswith('.env'):
                    continue
                source = ROOT / name
                if not source.is_file():  # An existing staged deletion is not an upload.
                    continue
                target = root / name
                target.parent.mkdir(parents=True, exist_ok=True)
                shutil.copyfile(source, target)
            for name in ('models', 'knowledge/prepared', '.venv', 'output', 'AGENTS.md',
                         'feature_list.json', 'scripts/check-harness.ps1'):
                self.assertFalse((root / name).exists(), name)
            (root / '.env').write_text('# synthetic server configuration\n')
            # -S proves the controller/help can load without this machine's packages.
            check = subprocess.run([sys.executable, '-S', str(root / 'scripts/deploy.py'), '--help'],
                                   cwd=temporary, capture_output=True, text=True, timeout=15)
            self.assertEqual(check.returncode, 0, check.stderr)
            self.assertIn('update-knowledge', check.stdout)


if __name__ == '__main__':
    unittest.main()