#!/usr/bin/env python3
# sloppatrol-scope: all
# sloppatrol-fix: pin the action to a full commit SHA with the version as a comment (uses: owner/repo@<40 hex> # vX.Y.Z). Some actions publish no major tags (setup-uv@v10 does not resolve), and a SHA cannot move under a consumer.
"""Every GitHub action this repo uses or writes into a consumer's workflow is pinned to a commit SHA."""

import os
import re
import sys
from pathlib import Path

USES = re.compile(r"\buses:\s*([^\s#]+)")
PINNED = re.compile(r"[^@]+@[0-9a-f]{40}")

root = Path(os.environ["SLOPPATROL_ROOT"])
hits = []
for path in Path(os.environ["SLOPPATROL_FILES"]).read_text().splitlines():
    if not (path.startswith(".github/workflows/") or path == "parallax/ci.py"):
        continue
    for number, line in enumerate((root / path).read_text().splitlines(), 1):
        match = USES.search(line)
        if match and not match[1].startswith("./") and not PINNED.fullmatch(match[1]):
            hits.append(f"{path}:{number}: pinned-actions {match[1]} is not pinned to a commit SHA")
print("\n".join(hits)) if hits else None
sys.exit(1 if hits else 0)
