#!/usr/bin/env bash

export MISE_LOCKFILE=1

detect_platform
PLATFORM="$MISE_PLATFORM"

echo "=== Testing SLSA without signer identity is omitted on every platform ==="
cat <<EOF >mise.toml
[tools]
sops = "3.12.1"
EOF

# Lock for current platform + a cross-platform target
if [[ $PLATFORM == "macos-arm64" ]]; then
  CROSS_PLATFORM="linux-x64"
else
  CROSS_PLATFORM="macos-arm64"
fi

mise lock --platform "$PLATFORM,$CROSS_PLATFORM"
assert "test -f mise.lock"

# Both platform entries still have artifact URLs and no unsupported SLSA lock.
assert_contains "cat mise.lock" "\"platforms.$PLATFORM\""
assert_contains "cat mise.lock" "\"platforms.$CROSS_PLATFORM\""
assert_contains "cat mise.lock" 'url = "https://'
assert_not_contains "cat mise.lock" 'provenance.slsa'
assert_not_contains "cat mise.lock" 'provenance = "slsa"'

echo "=== Testing lockfile is deterministic across runs ==="
cp mise.lock mise.lock.first

mise lock --platform "$PLATFORM,$CROSS_PLATFORM"

# Second run should produce identical output
assert "diff mise.lock mise.lock.first"

echo "mise lockfile provenance determinism tests passed!"
