import subprocess
from pathlib import Path

PROJECT_ROOT = Path(__file__).resolve().parents[3]
SCANNER = PROJECT_ROOT / "scripts" / "check-secrets.sh"


def run_git(repository: Path, *arguments: str) -> None:
    subprocess.run(
        ["git", *arguments],
        cwd=repository,
        check=True,
        capture_output=True,
        text=True,
    )


def test_staged_scan_reads_index_blob_not_modified_worktree(tmp_path: Path) -> None:
    run_git(tmp_path, "init", "--quiet")
    run_git(tmp_path, "config", "user.email", "test@example.invalid")
    run_git(tmp_path, "config", "user.name", "Secret Scanner Test")
    candidate = tmp_path / "config.txt"
    candidate.write_text("sk-" + "A" * 30, encoding="utf-8")
    run_git(tmp_path, "add", "config.txt")
    candidate.write_text("safe working-tree replacement", encoding="utf-8")

    result = subprocess.run(
        [str(SCANNER), "--staged"],
        cwd=tmp_path,
        check=False,
        capture_output=True,
        text=True,
    )

    assert result.returncode == 1
    assert "config.txt" in result.stderr
    assert "safe working-tree replacement" not in result.stderr
    assert "A" * 30 not in result.stderr