#!/usr/bin/env bash
# In-image assertions for the base image. Run via `docker build --target test`.
set -uo pipefail

ARTIFACTAPI=https://artifactapi.k8s.syd1.au.unkin.net
. ./distro.env

fail=0
check() {
  local name=$1; shift
  if out=$("$@" 2>&1); then
    echo "ok       $name"
  else
    echo "NOT OK   $name"
    printf '%s\n' "$out" | sed 's/^/           /'
    fail=1
  fi
}

# No -k and no --cacert: fails unless the bootstrapped internal CA is in the trust store.
check "internal CA trusted (artifactapi)" \
  curl -fsS -o /dev/null "$ARTIFACTAPI/api/v1/local/$ESTATE_REPO/repodata/repomd.xml"
check "unkin-ca-certificates installed" rpm -q unkin-ca-certificates

# Every configured repo must refresh, and a package that exists only in the estate's
# local repos must resolve.
check "dnf refreshes every estate repo" dnf -q makecache --refresh
check "dnf resolves an estate-only package" \
  dnf -q --disablerepo='*' --enablerepo="$ESTATE_REPO" list --available nfpm

for p in $PACKAGES; do
  check "package $p installed" rpm -q "$p"
done

for c in git jq make wget uv python3.11 python3.12; do
  check "$c runs" "$c" --version
done

[ "$fail" -eq 0 ] || { echo "FAILED"; exit 1; }
echo "PASS"