#!/usr/bin/env bash

# GitHub release metadata comes from mise-versions, never api.github.com:
# unauthenticated users get 60 API requests an hour, so normal usage must not
# spend them, not even when mise-versions says a tag doesn't exist.

unset GITHUB_TOKEN GH_TOKEN MISE_GITHUB_TOKEN GITHUB_API_TOKEN
export MISE_GITHUB_GH_CLI_TOKENS=false

no_github_api() {
  local output
  output="$(MISE_DEBUG=1 mise "$@" 2>&1)" || {
    echo "$output"
    fail "mise $* failed"
  }
  if [[ $output == *"GET https://api.github.com/"* ]]; then
    echo "$output"
    fail "mise $* asked api.github.com"
  fi
}

no_github_api ls-remote github:jdx/communique
# ripgrep tags have no `v`: the `v14.1.1` guess is a 404 from mise-versions,
# which must not send mise to GitHub.
no_github_api install github:BurntSushi/ripgrep@14.1.1
assert_contains "mise x github:BurntSushi/ripgrep@14.1.1 -- rg --version" "ripgrep 14.1.1"
# terraform's GitHub releases have no assets.
no_github_api latest aqua:hashicorp/terraform
# fnox's packslip declares a skill that lives in its repository: listed by
# mise-versions, fetched from raw.githubusercontent.com.
no_github_api use fnox@1.39.0
assert_contains "mise skills ls" "fnox"
# ant is `version_source: github_tag` with no registry entry: its versions
# are git tags.
no_github_api latest aqua:apache/ant
# Attestations come from mise-versions too. foundry's are filtered by
# predicate type (SPDX), which mise-versions leaves to the client.
no_github_api install aqua:goreleaser/goreleaser@2.14.1
no_github_api install aqua:foundry-rs/foundry@1.8.5
# kubectl's aqua package reads kubernetes/kubernetes, whose releases have no
# assets: `latest` comes from mise-versions' whole release list.
no_github_api latest aqua:kubernetes/kubectl
