#!/usr/bin/env bash
# Test workflow templates

set -euo pipefail

echo "Testing GitHub Actions workflow templates..."
TEMPLATES_DIR="../templates"
PASSED=0
FAILED=0

for workflow in $(find "$TEMPLATES_DIR" -name "*.yml"); do
    echo -n "Testing $workflow... "
    # Check for SHA pinning
    if grep -E "uses:.*@[a-f0-9]{40}" "$workflow" >/dev/null 2>&1 && \
       ! grep -E "uses:.*@v[0-9]|@main|@master" "$workflow" >/dev/null 2>&1; then
        echo "✓ PASS"
        ((PASSED++))
    else
        echo "✗ FAIL (not SHA-pinned)"
        ((FAILED++))
    fi
done

echo
echo "Results: $PASSED passed, $FAILED failed"
[[ $FAILED -eq 0 ]] && exit 0 || exit 1
