#!/usr/bin/env bash
set -euo pipefail
root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
bash -n "$root/pkgbuild/PKGBUILD"
bash -n "$root/pkgbuild/build-local-package.sh"
grep -Fq 'pkgver=2.0.3' "$root/pkgbuild/PKGBUILD"
grep -Fq 'option(BG_PACKAGING ' "$root/CMakeLists.txt"
grep -Fq 'option(BG_DEBIAN_NO_INSTALL_CODE ' "$root/CMakeLists.txt"
! grep -Fq '"pacman", "-Sy"' "$root/src/Backend.cpp"
# All installer side-effect blocks should use the packaging-aware wrapper.
python3 - "$root/CMakeLists.txt" <<'PY'
from pathlib import Path
import sys
s=Path(sys.argv[1]).read_text()
assert s.count('install(CODE "') == 1, 'only the wrapper itself may call install(CODE)'
assert s.count('bg_install_code("') >= 8
PY
out="$(mktemp -d "${TMPDIR:-/tmp}/bastionguard-test-arch-XXXXXX")"
trap 'rm -rf -- "$out"' EXIT
bash "$root/pkgbuild/build-local-package.sh" "$out" > /dev/null
sha="$(sha256sum -- "$out/BastionGuard-ci.tar.gz")"; sha="${sha%% *}"
grep -Fq "sha256sums=('${sha}')" "$out/PKGBUILD"
tar -tf "$out/BastionGuard-ci.tar.gz" > "$out/archive-contents.txt"
grep -Fxq 'BastionGuard-ci/pkgbuild/PKGBUILD' "$out/archive-contents.txt"
grep -Fxq 'BastionGuard-ci/pkgbuild/patches/rootguard-clang23-memcpy-inline.patch' "$out/archive-contents.txt"
echo 'Arch local PKGBUILD/archive/packaging isolation: OK'