#!/bin/bash
set -euo pipefail

echo "== repository workflow =="
git ls-files .github/workflows/sonarcloud.yml || true
if [ -f .github/workflows/sonarcloud.yml ]; then
  nl -ba .github/workflows/sonarcloud.yml | sed -n '1,220p'
fi

echo
echo "== available git references for pinned reusable workflow =="
git ls-remote --heads --tags https://github.com/ByronWilliamsCPA/.github.git 4bd2d7c207a7fcf2dfcec8416c805d06d745c241 || true
git ls-remote https://github.com/ByronWilliamsCPA/.github.git main || true

echo
echo "== raw reusable workflow around checkout and job permissions =="
python3 - <<'PY'
import urllib.request
pinned = "4bd2d7c207a7fcf2dfcec8416c805d06d745c241"
url = f"https://raw.githubusercontent.com/ByronWilliamsCPA/.github/{pinned}/.github/workflows/python-sonarcloud.yml"
try:
    with urllib.request.urlopen(url, timeout=20) as r:
        data = r.read().decode()
    lines = data.splitlines()
    for i, line in enumerate(lines, 1):
        if "actions/checkout" in line or "permissions:" in line or "pull-requests:" in line or "sonar-python-version" in line:
            start=max(1,i-8); end=min(len(lines), i+10)
            print(f"--- matches line {i} range {start}-{end} ---")
            for j in range(start, end+1):
                print(f"{j:4}: {lines[j-1]}")
except Exception as e:
    print(f"ERROR fetching {url}: {e.__class__.__name__}: {e}")
PY

echo
echo "== checkout input defaults around persist-credentials =="
python3 - <<'PY'
import urllib.request
base = "https://raw.githubusercontent.com/actions/checkout"
for ref in ["v4", "main", "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"]:
    try:
        url = f"{base}/{ref}/action.yml"
        data = urllib.request.urlopen(url, timeout=20).read().decode()
        lines = data.splitlines()
        print(f"--- action.yml {ref} ---")
        for i,line in enumerate(lines,1):
            if "persist-credentials" in line:
                print(f"{i:4}: {line}")
    except Exception as e:
        print(f"ERROR for checkout {ref}: {e}")
PY

#!/bin/bash
set -euo pipefail

echo "== check workflow trigger and job contents =="
nl -ba .github/workflows/sonarcloud.yml | sed -n '1,220p'

echo
echo "== resolve exact reusable workflow workflow file by git API =="
git ls-remote https://github.com/ByronWilliamsCPA/.github.git 4bd2d7c207a7fcf2dfcec8416c805d06d745c241 || true
git ls-remote https://github.com/ByronWilliamsCPA/.github.git refs/tags/main || true
git ls-remote https://github.com/ByronWilliamsCPA/.github.git refs/heads/main || true

#!/bin/bash
set -euo pipefail

echo "== repository workflow =="
awk '{printf "%5d: %s\n", NR, $0}' .github/workflows/sonarcloud.yml | sed -n '1,220p'

echo
echo "== raw reusable workflow around checkout, permissions, and inputs =="
python3 - <<'PY'
import urllib.request
pinned = "4bd2d7c207a7fcf2dfcec8416c805d06d745c241"
url = f"https://raw.githubusercontent.com/ByronWilliamsCPA/.github/{pinned}/.github/workflows/python-sonarcloud.yml"
try:
    with urllib.request.urlopen(url, timeout=20) as r:
        data = r.read().decode()
except Exception as e:
    print(f"ERROR fetching {url}: {e.__class__.__name__}: {e}")
    raise SystemExit(1)
lines = data.splitlines()
for i, line in enumerate(lines, 1):
    if any(k in line for k in ("actions/checkout", "permissions:", "'pull-requests:', 'pull-requests:", "pull-requests:", "sonar-python-version", "GITHUB_TOKEN", "GITHUB_OUTPUT")):
        print(f"--- matches line {i} ---")
        for j in range(max(1, i-8), min(len(lines), i+10)+1):
            print(f"{j:4}: {lines[j-1]}")

echo
echo "== checkout persist-credentials input description from action.yml =="
python3 - <<'PY'
import urllib.request
base = "https://raw.githubusercontent.com/actions/checkout"
for ref in ["v4"]:
    try:
        data = urllib.request.urlopen(f"{base}/{ref}/action.yml", timeout=20).read().decode()
        print(f"--- {ref} ---")
        for i, line in enumerate(data.splitlines(), 1):
            if "persist-credentials" in line or line.strip() == "description:":
                print(f"{i:4}: {line}")
    except Exception as e:
        print(f"ERROR checkout {ref}: {e}")
PY

#!/bin/bash
set -euo pipefail

echo "== raw reusable workflow around sensitive lines =="
python3 - <<'PY'
import urllib.request
pinned = "4bd2d7c207a7fcf2dfcec8416c805d06d745c241"
url = f"https://raw.githubusercontent.com/ByronWilliamsCPA/.github/{pinned}/.github/workflows/python-sonarcloud.yml"
try:
    lines = urllib.request.urlopen(url, timeout=20).read().decode().splitlines()
except Exception as e:
    print(f"ERROR fetching {url}: {e.__class__.__name__}: {e}")
else:
    for i, line in enumerate(lines, 1):
        if "actions/checkout" in line or "GITHUB_TOKEN" in line or "pull-requests" in line or "sonar-python-version" in line or "uv sync" in line or "pytest" in line or "GH_TOKEN" in line:
            start=max(1,i-10); end=min(len(lines), i+12)
            print(f"--- matches line {i} range {start}-{end} ---")
            for j in range(start, end+1):
                print(f"{j:4}: {lines[j-1]}")

echo
echo "== GitHub action checkout persist-credentials from v4 == "
python3 - <<'PY'
import urllib.request
data = urllib.request.urlopen("https://raw.githubusercontent.com/actions/checkout/v4/action.yml", timeout=20).read().decode()
for i, line in enumerate(data.splitlines(), 1):
    if "persist-credentials" in line:
        print(f"{i:4}: {line}")
PY

#!/bin/bash
set -euo pipefail

echo "== reusable workflow relevant sections =="
python3 - <<'PY'
import urllib.request
sha = "4bd2d7c207a7fcf2dfcec8416c805d06d745c241"
url = f"https://raw.githubusercontent.com/ByronWilliamsCPA/.github/{sha}/.github/workflows/python-sonarcloud.yml"
try:
    text = urllib.request.urlopen(url, timeout=20).read().decode()
except Exception as e:
    print(f"ERROR fetching {url}: {e.__class__.__name__}: {e}")
    raise SystemExit(1)
lines = text.splitlines()
keywords = ["actions/checkout", "persist-credentials", "GITHUB_TOKEN", "pull-requests", "uv sync", "pytest", "sonar-python-version", "GH_TOKEN"]
for i, line in enumerate(lines, 1):
    if any(k in line for k in keywords):
        start=max(1,i-10); end=min(len(lines), i+12)
        print(f"--- matches line {i} range {start}-{end} ---")
        for j in range(start, end+1):
            print(f"{j:4}: {lines[j-1]}")
PY

echo
echo "== actions/checkout persist-credentials reference from v4 =="
python3 - <<'PY'
import urllib.request
text = urllib.request.urlopen("https://raw.githubusercontent.com/actions/checkout/v4/action.yml", timeout=20).read().decode()
for i, line in enumerate(text.splitlines(), 1):
    if "persist-credentials" in line:
        print(f"{i:4}: {line}")
PY