#!/usr/bin/env bash
set -euo pipefail
ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
find "$ROOT/webui" -type f -name '*.php' -print0 | xargs -0 -n1 php -l >/dev/null
find "$ROOT" \( -name '*.sh' -o -name '*.postinst' -o -name '*.prerm' -o -name '*.postrm' \) -type f -print0 | while IFS= read -r -d '' script; do bash -n "$script"; done
php "$ROOT/tests/test_webui_regressions.php"
BIN="$(mktemp /tmp/bastionguard-sandbox-regression-XXXXXX)"
trap 'rm -f "$BIN"' EXIT
g++ -std=c++17 -O2 -Wall -Wextra -Wpedantic -Werror \
  "$ROOT/tests/test_archive_sandbox.cpp" \
  "$ROOT/src/security/archive/ArchiveSandbox.cpp" \
  "$ROOT/src/security/archive/ArchiveInspector.cpp" -o "$BIN"
"$BIN"
# Lightweight gettext header stub for isolated command-argument regression.
# Real application compilation still requires the distribution GTK/GLib headers.
STUB="$(mktemp -d /tmp/bastionguard-glib-stub-XXXXXX)"
trap 'rm -f "$BIN"; rm -rf "$STUB"' EXIT
mkdir -p "$STUB/glib"
printf '#pragma once\n#define _(x) (x)\n' > "$STUB/glib/gi18n.h"
g++ -std=c++17 -O2 -Wall -Wextra -Wpedantic -Werror -I"$STUB" \
  "$ROOT/tests/test_firewall_args.cpp" \
  "$ROOT/src/firewall/FirewallRuleManager.cpp" -o "$BIN"
"$BIN"
echo "firewall argument regressions: OK"

# CA installer must use the vector-argv API for pkexec and sudo, not shell strings.
g++ -std=c++17 -O2 -Wall -Wextra -Wpedantic -Werror -I"$STUB" \
  "$ROOT/tests/test_ca_installer_args.cpp" -o "$BIN"
"$BIN"
echo "CA installer argv regression: OK"

# GLib-independent shell quoting shared by wizard codepaths.
g++ -std=c++17 -O2 -Wall -Wextra -Wpedantic -Werror \
  "$ROOT/tests/test_wizard_shell_quote.cpp" -o "$BIN"
"$BIN"

# Shell-free process execution and systemd security regressions.
g++ -std=c++17 -O2 -Wall -Wextra -Wpedantic -Werror \
  "$ROOT/tests/test_safe_process.cpp" -o "$BIN"
"$BIN"
bash "$ROOT/tests/test_systemd_policy.sh"

echo "All standalone regression tests passed."
bash "$ROOT/tests/test_arch_packaging.sh"

# User-supplied Clang 23 BPF source patch regression.
bash "$ROOT/tests/test_rootguard_clang23_patch.sh"

# Responsible-disclosure source guards for BG-01 through BG-05.
python3 "$ROOT/tests/test_coordinated_disclosure_bg01_bg05.py"