"""githubdeploy OIDC trust pins the org reusable and the thin caller."""

from pathlib import Path

IAM = Path(__file__).resolve().parents[1] / "terraform" / "iam_github_deploy.tf"


def test_github_deploy_trust_uses_org_reusable_and_caller():
    text = IAM.read_text()
    assert "token.actions.githubusercontent.com:sub" in text
    assert "repo:Sea-Haven-Industries/meal-order-manager:environment:dev" in text
    assert "repo:Sea-Haven-Industries/meal-order-manager:environment:prod" in text
    assert (
        "Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@*"
        in text
    )
    assert "token.actions.githubusercontent.com:workflow_ref" in text
    assert (
        "Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/heads/main"
        in text
    )
    assert (
        "Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/tags/v*"
        in text
    )
    assert "cd-hcp-spa.yaml" not in text
    assert "token.actions.githubusercontent.com:workflow_ref" in text
    assert (
        "Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/heads/main"
        in text
    )
    assert (
        "Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/tags/v*"
        in text
    )
    assert "cd-hcp-spa.yaml" not in text