name: IAM integration

on:
  pull_request:
    branches:
      - master

# This ensures that previous jobs for the PR are canceled when the PR is
# updated.
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  iam-matrix-test:
    name: "[Go=${{ matrix.go-version }}|ldap=${{ matrix.ldap }}|etcd=${{ matrix.etcd }}|openid=${{ matrix.openid }}]"

            // Verify the model version and namespace - use the updated document from pomMap
            Document updatedDocument = pomMap.get(Paths.get("pom.xml"));
            Editor editor = new Editor(updatedDocument);
            Element root = editor.root();
            assertEquals(expectedNamespace, root.namespaceURI(), "Namespace should be updated: " + description);

        // Verify that dec_ndr_hyper was called exactly once
        verify(mockNdrBuffer, times(1)).dec_ndr_hyper();
        verifyNoMoreInteractions(mockNdrBuffer);

        // Verify that the NdrHyper object's value was updated correctly
        assertEquals(decodedValue, ndrHyper.value, "Decode should update the value correctly.");
    }

    def format = new SimpleDateFormat('yyyyMMddHHmmssZ')

    @TempDir
    File tmpDir

    def setup() {
        format.timeZone = TimeZone.getTimeZone("UTC")
    }

    def "updated released version file has expected format"() {
        given:
        def releasedVersionsFile = new File(tmpDir, "released-versions.json")
        releasedVersionsFile << '''{
  "latestReleaseSnapshot": {

      placeholder: |
        Go: devel go1.22-0262ea1ff9 Thu Oct 26 18:46:50 2023 +0000
        Scanner: govulncheck@v1.0.2-0.20231108200754-fcf7dff7b242
        DB: https://vuln.go.dev
        DB updated: 2023-11-21 15:39:17 +0000 UTC
    validations:
      required: true
  - type: textarea
    id: reproduce-latest-version
    attributes:
      label: "Does this issue reproduce at the latest version of golang.org/x/vuln?"

    /**
     * Injects the mirroring information into the specified repositories. For each repository that is matched by a
     * mirror, its URL and ID will be updated to match the values from the mirror specification. Repositories without a
     * matching mirror will pass through unchanged. Note: This method must be called before

        // Set another payload and verify
        byte[] payload2 = new byte[] { 1, 2, 3, 4, 5 };
        message.setRawPayload(payload2);
        assertArrayEquals(payload2, message.getRawPayload(), "getRawPayload should return the updated payload");

        // Set null payload and verify
        message.setRawPayload(null);
        assertNull(message.getRawPayload(), "rawPayload should be null after setting null");
    }

    launcherJar.from(tasks.jar)
    agentJars.from(resolveAgentsClasspath)
    // The trick below is to use the templates from the current code instead of the wrapper. It does not cover the case where the generation logic is updated though.
    unixScriptTemplate.from(layout.projectDirectory.file("../../../platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt"))

        ndrLong.decode(mockNdrBuffer);

        // Verify that dec_ndr_long was called exactly once
        verify(mockNdrBuffer, times(1)).dec_ndr_long();
        // Verify that the value field was updated correctly
        assertEquals(decodedValue, ndrLong.value, "Decode should correctly assign the value returned by dec_ndr_long.");
        // Verify that no other interactions occurred with the mock buffer

on:
  # For Branch-Protection check. Only the default branch is supported. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
  branch_protection_rule:
  # To guarantee Maintained check is occasionally updated. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
  schedule:
    - cron: '45 9 * * 0'
  push:
    branches: [ "master" ]

# Declare default permissions as read only.