#!/bin/sh
set -eu
suite=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
source_root=${VOTIAN_SOURCE_ROOT:-/data/0/votian-test/html}
runtime_container=${VOTIAN_PHP_CONTAINER:-votian-test}
[ -d "$source_root/include" ] || { echo "Missing source directory: $source_root" >&2; exit 2; }
[ -f "$suite/tools/phpunit.phar" ] || { echo 'Run ./setup-phpunit.sh first.' >&2; exit 2; }
expected=c704fdd37c6c6ab7adb386f31b4e186cd51156801fa9028b5ea8099a2cd7f106
actual=$(sha256sum "$suite/tools/phpunit.phar" | cut -d ' ' -f 1)
[ "$actual" = "$expected" ] || { echo 'PHPUnit checksum mismatch' >&2; exit 2; }
mkdir -p "$suite/reports"
image=$(docker inspect --format '{{.Image}}' "$runtime_container")
printf '%s\n' "$image" > "$suite/reports/runtime-image.txt"
# Use the exact deployed image, but no running application process, network or writable source.
docker run --rm --network none --read-only --cap-drop ALL \
    --security-opt no-new-privileges --pids-limit 64 --memory 256m --cpus 1 \
    --user "$(id -u):$(id -g)" --tmpfs /tmp:rw,nosuid,nodev,size=64m \
    --mount "type=bind,src=$source_root,dst=/legacy,readonly" \
    --mount "type=bind,src=$suite,dst=/suite,readonly" \
    --mount "type=bind,src=$suite/reports,dst=/reports" \
    --env VOTIAN_SOURCE_ROOT=/legacy --env VOTIAN_TEST_REPORT_DIR=/reports \
    --entrypoint php "$image" \
    -d auto_prepend_file= -d auto_append_file= -d allow_url_fopen=0 \
    -d max_execution_time=30 -d memory_limit=192M \
    -d disable_functions=mail,exec,shell_exec,system,passthru,popen,proc_open,pcntl_exec \
    /suite/tools/phpunit.phar --configuration /suite/phpunit.xml \
    --log-junit /reports/junit.xml --testdox "$@"