"""Verify 'legacy code' is excluded from the Docker build context.

Docker's .dockerignore semantics (as applied by BuildKit):
  * 'legacy code/'     -> directory named "legacy code" at the context root
  * '**/legacy code/'  -> directory named "legacy code" at ANY depth

This simulates a walk of the build context and asserts the snapshot never
appears in the files that would be sent to the daemon.
"""
import os

ROOT = os.getcwd()

rules = []
for raw in open('.dockerignore', encoding='utf-8'):
    line = raw.strip()
    if line and not line.startswith('#'):
        rules.append(line)

print('rules mentioning legacy:', [r for r in rules if 'legacy' in r])


def is_legacy_dir(rel):
    """True if *rel* is a directory named 'legacy code' at root or any depth."""
    return rel == 'legacy code' or rel.endswith('/legacy code')


excluded, included = [], []
for dirpath, dirnames, filenames in os.walk(ROOT):
    dirnames[:] = [d for d in dirnames if d != '.git']
    for d in list(dirnames):
        rel = os.path.relpath(os.path.join(dirpath, d), ROOT)
        if is_legacy_dir(rel):
            excluded.append(rel + '/  (pruned)')
            dirnames.remove(d)
            continue
    for f in filenames:
        rel = os.path.relpath(os.path.join(dirpath, f), ROOT)
        parts = rel.split('/')
        under_legacy = any(is_legacy_dir('/'.join(parts[:i]))
                           for i in range(1, len(parts) + 1))
        (excluded if under_legacy else included).append(rel)

print()
print('EXCLUDED (legacy snapshot):')
for e in sorted(excluded)[:5]:
    print('   -', e)
print(f'   ... {len(excluded)} total')
print()
leak = [i for i in included if 'legacy code' in i]
print(f'files reaching the build context: {len(included)}')
print('LEAKED:', leak if leak else 'none')
assert not leak, 'legacy snapshot would ship into the image!'
print()
print('VERIFIED: legacy snapshot is excluded from the Docker build context')