#!/usr/bin/env python3
"""Security R419: keep CodeQL exclusions narrow and first-party coverage intact.

This fixture checks policy source only; switch existing GitHub default setup
to the tracked advanced workflow before treating vendor exclusions as active.
"""
from fnmatch import fnmatchcase
from pathlib import Path
import re

root = Path(__file__).resolve().parents[1]
config = (root / ".github/codeql/codeql-config.yml").read_text()
doc = (root / "docs/CODEQL_SECURITY_TRIAGE_R419.md").read_text()
advanced = (root / ".github/workflows/codeql-advanced.yml").read_text()
assert not (root / ".github/workflows/codeql.yml").exists(), "Remove duplicate autogenerated CodeQL workflow"
assert config.startswith("name: Eden Encore CodeQL")
patterns = re.findall(r"^\s+- '([^']+)'", config, flags=re.M)
expected = {
    "vendor/sources/**/libs/mpl/preprocessed/pp.py",
    "vendor/sources/**/tools/litre/cplusplus.py",
    "vendor/sources/**/bin/nir-test-runner.py",
    "vendor/sources/**/hb_test_tools.py",
    "vendor/sources/**/python/run_tests.py",
}
assert set(patterns) == expected, (patterns, expected)
# R428: c-cpp build-mode:none no longer traverses the immutable 40k-file
# vendored snapshots; Python and Actions still scan our active code.
scan_root = config.split("paths:\n", 1)[1].split("paths-ignore:", 1)[0]
included = set(re.findall(r"^\s+- ([^\s#]+)$", scan_root, flags=re.M))
assert included == {
    ".github", "headless", "src", "tools", "third_party", "fixtures",
    "vendor/encore-active",
}, included
assert "vendor/sources" not in included and "vendor/objects" not in included
def ignored(path: str) -> bool:
    return any(fnmatchcase(path, p) for p in patterns)

for path in (
    "vendor/sources/eden-cpm/boost/libs/mpl/preprocessed/pp.py",
    "vendor/sources/eden-cpm/boost/tools/litre/cplusplus.py",
    "vendor/sources/opengl-mesa-26-2/bin/nir-test-runner.py",
    "vendor/sources/ps5-mesa/bin/nir-test-runner.py",
    "vendor/sources/harfbuzz/test/shaping/hb_test_tools.py",
    "vendor/sources/harfbuzz/test/shaping/python/run_tests.py",
):
    assert ignored(path), path
for path in (
    "headless/main.cpp",
    "headless/network_domain_rules.c",
    "tools/ps-glyph-mod-discovery.py",
    "tools/check-guest-network-isolation.py",
    "tools/check-ps-glyph-curl-search.py",
    "vendor/encore-active/eden-vulkan/vulkan_scheduler.cpp",
    "vendor/encore-active/ps5-mesa/src/util/disk_cache_os.c",
    "vendor/sources/eden/src/video_core/renderer_vulkan/vk_scheduler.cpp",
    "vendor/sources/harfbuzz/src/hb-shape.cc",
    "vendor/sources/ps5-mesa/src/amd/vulkan/radv_device.c",
):
    assert not ignored(path), path
assert "Switch to advanced" in doc
assert "default" in doc
assert "config-file: ./.github/codeql/codeql-config.yml" in advanced
assert "security-events: write" in advanced
for language in ("actions", "python", "c-cpp"):
    assert "- language: " + language in advanced
assert "paths-ignore:" in config
assert "#23" in doc and "#28" in doc
print("R419 CodeQL scope policy: narrow third-party test exclusions PASS")