[tox]
env_list = py313,py314,py315,coverage,packaging,packaging-amd64,packaging-arm64,publish,module-python,module-python-http,module-apt,module-apt-http,module-yum,module-yum-http,module-apk,module-apk-http,module-java,module-java-http,module-certificates,module-php,module-php-http,module-npm,module-npm-http,module-rust,module-rust-http,module-go,module-go-http,module-ruby,module-ruby-http,module-nuget,module-nuget-http,config-url
isolated_build = true
requires =
    tox>=4
    tox-uv>=1

[testenv]
package = wheel
dependency_groups = test
change_dir = {env_tmp_dir}
set_env =
    COVERAGE_FILE = {env_dir}/coverage.db
commands =
    python3 -m pytest {tox_root}/tests --cov-config={tox_root}/pyproject.toml --cov-fail-under=90 {posargs}

[testenv:coverage]
package = skip
depends = py313,py314,py315
change_dir = {tox_root}
dependency_groups = test
set_env =
    COVERAGE_FILE = {env_dir}/coverage.db
commands =
    python3 -m coverage combine {toxworkdir}/py313/coverage.db {toxworkdir}/py314/coverage.db {toxworkdir}/py315/coverage.db
    python3 -m coverage xml -o .tox/coverage.xml --ignore --fail-under=0
    python3 -m coverage report -m --fail-under=94 --ignore --skip-covered

[testenv:packaging]
package = skip
change_dir = {tox_root}
allowlist_externals =
    docker
dependency_groups = dev
description =
    Generate the docker images for the different platform
depends =
    update
commands =
    python3 -m id_tools build docker --platform linux/amd64,linux/arm64

[testenv:packaging-amd64]
package = skip
change_dir = {tox_root}
allowlist_externals =
    docker
dependency_groups = dev
description =
    Generate the docker images for the different platform
depends =
    update
commands =
    python3 -m id_tools build docker --platform linux/amd64

[testenv:packaging-arm64]
package = skip
change_dir = {tox_root}
allowlist_externals =
    docker
dependency_groups = dev
description =
    Generate the docker images for the different platform
depends =
    update
commands =
    python3 -m id_tools build docker --platform linux/arm64

[testenv:publish]
package = skip
change_dir = {tox_root}
dependency_groups = dev
description =
    Build and publish the image to Docker Hub.
    The version is taken from the pyproject.toml file.
    Make sure that you have the rights to upload the image to Docker Hub.
commands =
    python3 -m uv sync --all-groups -U --active
    python3 -m id_tools build docker --platform linux/amd64,linux/arm64/v8 --push
    python3 -m id_tools publication sign-docker
    python3 -m uv build
    python3 -m uv publish
docker =
passenv =
    COSIGN_PASSWORD
    COSIGN_PRIVATE_KEY
    DOCKER_HUB_LOGIN
    DOCKER_HUB_TOKEN
    UV_PUBLISH_TOKEN

[docker:pypi-repo]
dockerfile = {tox_root}/tests/dockerfiles/repos/pypi-repo.Dockerfile
expose =
    PYPI_REPO_PORT=8443/tcp
    PYPI_REPO_HTTP_PORT=8080/tcp
healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/simple/idconfiguratortestpkg/ || exit 1
healthcheck_interval = 1
healthcheck_retries = 30
healthcheck_timeout = 2
healthcheck_start_period = 1

[testenv:module-python]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    pypi-repo
allowlist_externals =
    docker
set_env =
    PYPI_REPO_SCHEME = https
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Python.yaml.j2 {env_dir}/configs/Python.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg PYPI_REPO_SCHEME={env:PYPI_REPO_SCHEME} --build-arg PYPI_REPO_PORT={env:PYPI_REPO_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Python-alpine.Dockerfile -t id-configurator-python .
    docker rmi id-configurator-python
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg PYPI_REPO_SCHEME={env:PYPI_REPO_SCHEME} --build-arg PYPI_REPO_PORT={env:PYPI_REPO_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Python.Dockerfile -t id-configurator-python .
    docker rmi id-configurator-python
commands_post =
    docker buildx prune --all --force

[testenv:module-python-http]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    pypi-repo
allowlist_externals =
    docker
description =
    Same as module-python, but against a plain-HTTP index, to verify pip's
    trusted-host is configured correctly for a non-HTTPS repository.
set_env =
    PYPI_REPO_SCHEME = http
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Python.yaml.j2 {env_dir}/configs/Python.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg PYPI_REPO_SCHEME={env:PYPI_REPO_SCHEME} --build-arg PYPI_REPO_PORT={env:PYPI_REPO_HTTP_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Python-alpine.Dockerfile -t id-configurator-python-http .
    docker rmi id-configurator-python-http
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg PYPI_REPO_SCHEME={env:PYPI_REPO_SCHEME} --build-arg PYPI_REPO_PORT={env:PYPI_REPO_HTTP_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Python.Dockerfile -t id-configurator-python-http .
    docker rmi id-configurator-python-http
commands_post =
    docker buildx prune --all --force

[docker:apt-repo]
dockerfile = {tox_root}/tests/dockerfiles/repos/apt-repo.Dockerfile
expose =
    APT_REPO_PORT=8443/tcp
    APT_REPO_HTTP_PORT=8080/tcp
healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/Packages || exit 1
healthcheck_interval = 1
healthcheck_retries = 30
healthcheck_timeout = 2
healthcheck_start_period = 1

[testenv:module-apt]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    apt-repo
allowlist_externals =
    docker
set_env =
    APT_REPO_SCHEME = https
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Apt.yaml.j2 {env_dir}/configs/Apt.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apt.Dockerfile -t id-configurator-apt .
    docker rmi id-configurator-apt
commands_post =
    docker buildx prune --all --force

[testenv:module-apt-http]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    apt-repo
allowlist_externals =
    docker
description =
    Same as module-apt, but against a plain-HTTP source, since apt's trust
    model is the signed-by keyring, independent of transport scheme.
set_env =
    APT_REPO_SCHEME = http
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Apt.yaml.j2 {env_dir}/configs/Apt.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apt.Dockerfile -t id-configurator-apt-http .
    docker rmi id-configurator-apt-http
commands_post =
    docker buildx prune --all --force

[docker:yum-repo]
dockerfile = {tox_root}/tests/dockerfiles/repos/yum-repo.Dockerfile
expose =
    YUM_REPO_PORT=8443/tcp
    YUM_REPO_HTTP_PORT=8080/tcp
healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/repodata/repomd.xml || exit 1
healthcheck_interval = 1
healthcheck_retries = 30
healthcheck_timeout = 2
healthcheck_start_period = 1

[testenv:module-yum]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    yum-repo
allowlist_externals =
    docker
set_env =
    YUM_REPO_SCHEME = https
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Yum.yaml.j2 {env_dir}/configs/Yum.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Yum.Dockerfile -t id-configurator-yum .
    docker rmi id-configurator-yum
commands_post =
    docker buildx prune --all --force

[testenv:module-yum-http]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    yum-repo
allowlist_externals =
    docker
description =
    Same as module-yum, but against a plain-HTTP repository, since yum/dnf's
    trust model is the imported GPG key, independent of transport scheme.
set_env =
    YUM_REPO_SCHEME = http
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Yum.yaml.j2 {env_dir}/configs/Yum.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Yum.Dockerfile -t id-configurator-yum-http .
    docker rmi id-configurator-yum-http
commands_post =
    docker buildx prune --all --force

[docker:apk-repo]
dockerfile = {tox_root}/tests/dockerfiles/repos/apk-repo.Dockerfile
expose =
    APK_REPO_PORT=8443/tcp
    APK_REPO_HTTP_PORT=8080/tcp
healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/APKINDEX.tar.gz || exit 1
healthcheck_interval = 1
healthcheck_retries = 30
healthcheck_timeout = 2
healthcheck_start_period = 1

[testenv:module-apk]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    apk-repo
allowlist_externals =
    docker
description =
    Unlike the other module-* envs, this one is not pinned to --platform
    linux/amd64: apk embeds the client's own architecture in the repository
    URL it fetches, and the apk-repo fixture (built by tox-docker, which
    cannot be pinned to a platform) always publishes its index under the
    Docker host's native architecture. Leaving both builds on the host's
    native platform keeps them in agreement everywhere (including under
    QEMU emulation on non-amd64 hosts); CI runners are amd64, so this still
    matches the other envs there.
set_env =
    APK_REPO_SCHEME = https
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Apk.yaml.j2 {env_dir}/configs/Apk.yaml
    docker buildx build --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apk.Dockerfile -t id-configurator-apk .
    docker rmi id-configurator-apk
commands_post =
    docker buildx prune --all --force

[testenv:module-apk-http]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    apk-repo
allowlist_externals =
    docker
description =
    Same as module-apk, but against a plain-HTTP repository, since apk's
    trust model is the signed index, independent of transport scheme. See
    module-apk's own description for why this isn't pinned to --platform
    linux/amd64 either.
set_env =
    APK_REPO_SCHEME = http
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Apk.yaml.j2 {env_dir}/configs/Apk.yaml
    docker buildx build --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apk.Dockerfile -t id-configurator-apk-http .
    docker rmi id-configurator-apk-http
commands_post =
    docker buildx prune --all --force

[docker:java-repo]
dockerfile = {tox_root}/tests/dockerfiles/repos/java-repo.Dockerfile
expose =
    JAVA_REPO_PORT=8443/tcp
    JAVA_REPO_HTTP_PORT=8080/tcp
healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/org/interdiode/idconfiguratortestpkg/0.0.1/idconfiguratortestpkg-0.0.1.pom || exit 1
healthcheck_interval = 1
healthcheck_retries = 30
healthcheck_timeout = 2
healthcheck_start_period = 1

[testenv:module-java]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    java-repo
allowlist_externals =
    docker
set_env =
    JAVA_REPO_SCHEME = https
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Java.yaml.j2 {env_dir}/configs/Java.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg JAVA_REPO_SCHEME={env:JAVA_REPO_SCHEME} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Java.Dockerfile -t id-configurator-java .
    docker rmi id-configurator-java
commands_post =
    docker buildx prune --all --force

[testenv:module-java-http]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    java-repo
allowlist_externals =
    docker
description =
    Same as module-java, but against a plain-HTTP repository. Leiningen is
    skipped here (see Java.Dockerfile): it refuses any non-HTTPS repository
    unconditionally, with no configuration able to change that.
set_env =
    JAVA_REPO_SCHEME = http
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Java.yaml.j2 {env_dir}/configs/Java.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg JAVA_REPO_SCHEME={env:JAVA_REPO_SCHEME} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Java.Dockerfile -t id-configurator-java-http .
    docker rmi id-configurator-java-http
commands_post =
    docker buildx prune --all --force

[docker:certificate-repo]
dockerfile = {tox_root}/tests/dockerfiles/repos/certificate-repo.Dockerfile
expose =
    CERTIFICATE_REPO_PORT=8443/tcp
healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/marker.txt || exit 1
healthcheck_interval = 1
healthcheck_retries = 30
healthcheck_timeout = 2
healthcheck_start_period = 1

[testenv:module-certificates]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    certificate-repo
allowlist_externals =
    docker
description =
    Verifies that both wget and curl - two independently TLS-linked HTTP
    clients (GnuTLS and OpenSSL, respectively, on Debian) - trust an HTTPS
    server whose certificate chains to a root certificate installed by the
    `certificates` module alone, with no package-manager-specific config.
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Certificate.yaml.j2 {env_dir}/configs/Certificate.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg CERTIFICATE_REPO_PORT={env:CERTIFICATE_REPO_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Certificate.Dockerfile -t id-configurator-certificates .
    docker rmi id-configurator-certificates
commands_post =
    docker buildx prune --all --force

[docker:php-repo]
dockerfile = {tox_root}/tests/dockerfiles/repos/php-repo.Dockerfile
expose =
    PHP_REPO_PORT=8443/tcp
    PHP_REPO_HTTP_PORT=8080/tcp
healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/packages.json || exit 1
healthcheck_interval = 1
healthcheck_retries = 30
healthcheck_timeout = 2
healthcheck_start_period = 1

[testenv:module-php]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    php-repo
allowlist_externals =
    docker
set_env =
    PHP_REPO_SCHEME = https
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Php.yaml.j2 {env_dir}/configs/Php.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Php.Dockerfile -t id-configurator-php .
    docker rmi id-configurator-php
commands_post =
    docker buildx prune --all --force

[testenv:module-php-http]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    php-repo
allowlist_externals =
    docker
description =
    Same as module-php, but against a plain-HTTP repository, to verify
    secure-http is disabled (and packagist.org too) for a non-HTTPS source.
set_env =
    PHP_REPO_SCHEME = http
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Php.yaml.j2 {env_dir}/configs/Php.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Php.Dockerfile -t id-configurator-php-http .
    docker rmi id-configurator-php-http
commands_post =
    docker buildx prune --all --force

[docker:npm-repo]
dockerfile = {tox_root}/tests/dockerfiles/repos/npm-repo.Dockerfile
expose =
    NPM_REPO_PORT=8443/tcp
    NPM_REPO_HTTP_PORT=8080/tcp
healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/idconfiguratortestpkg || exit 1
healthcheck_interval = 1
healthcheck_retries = 30
healthcheck_timeout = 2
healthcheck_start_period = 1

[testenv:module-npm]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    npm-repo
allowlist_externals =
    docker
set_env =
    NPM_REPO_SCHEME = https
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Npm.yaml.j2 {env_dir}/configs/Npm.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Npm.Dockerfile -t id-configurator-npm .
    docker rmi id-configurator-npm
commands_post =
    docker buildx prune --all --force

[testenv:module-npm-http]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    npm-repo
allowlist_externals =
    docker
description =
    Same as module-npm, but against a plain-HTTP registry.
set_env =
    NPM_REPO_SCHEME = http
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Npm.yaml.j2 {env_dir}/configs/Npm.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Npm.Dockerfile -t id-configurator-npm-http .
    docker rmi id-configurator-npm-http
commands_post =
    docker buildx prune --all --force

[docker:cargo-repo]
dockerfile = {tox_root}/tests/dockerfiles/repos/cargo-repo.Dockerfile
expose =
    CARGO_REPO_PORT=8443/tcp
    CARGO_REPO_HTTP_PORT=8080/tcp
healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/config.json || exit 1
healthcheck_interval = 1
healthcheck_retries = 30
healthcheck_timeout = 2
healthcheck_start_period = 1

[testenv:module-rust]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    cargo-repo
allowlist_externals =
    docker
set_env =
    CARGO_REPO_SCHEME = https
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Rust.yaml.j2 {env_dir}/configs/Rust.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Rust.Dockerfile -t id-configurator-rust .
    docker rmi id-configurator-rust
commands_post =
    docker buildx prune --all --force

[testenv:module-rust-http]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    cargo-repo
allowlist_externals =
    docker
description =
    Same as module-rust, but against a plain-HTTP sparse registry.
set_env =
    CARGO_REPO_SCHEME = http
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Rust.yaml.j2 {env_dir}/configs/Rust.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Rust.Dockerfile -t id-configurator-rust-http .
    docker rmi id-configurator-rust-http
commands_post =
    docker buildx prune --all --force

[docker:go-repo]
dockerfile = {tox_root}/tests/dockerfiles/repos/go-repo.Dockerfile
expose =
    GO_REPO_PORT=8443/tcp
    GO_REPO_HTTP_PORT=8080/tcp
healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/example.invalid/idconfiguratortestpkg/@v/list || exit 1
healthcheck_interval = 1
healthcheck_retries = 30
healthcheck_timeout = 2
healthcheck_start_period = 1

[testenv:module-go]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    go-repo
allowlist_externals =
    docker
set_env =
    GO_REPO_SCHEME = https
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Go.yaml.j2 {env_dir}/configs/Go.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Go.Dockerfile -t id-configurator-go .
    docker rmi id-configurator-go
commands_post =
    docker buildx prune --all --force

[testenv:module-go-http]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    go-repo
allowlist_externals =
    docker
description =
    Same as module-go, but against a plain-HTTP module proxy, to verify
    GOINSECURE is configured correctly for a non-HTTPS GOPROXY.
set_env =
    GO_REPO_SCHEME = http
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Go.yaml.j2 {env_dir}/configs/Go.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Go.Dockerfile -t id-configurator-go-http .
    docker rmi id-configurator-go-http
commands_post =
    docker buildx prune --all --force

[docker:ruby-repo]
dockerfile = {tox_root}/tests/dockerfiles/repos/ruby-repo.Dockerfile
expose =
    RUBY_REPO_PORT=8443/tcp
    RUBY_REPO_HTTP_PORT=8080/tcp
healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/versions || exit 1
healthcheck_interval = 1
healthcheck_retries = 30
healthcheck_timeout = 2
healthcheck_start_period = 1

[testenv:module-ruby]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    ruby-repo
allowlist_externals =
    docker
set_env =
    RUBY_REPO_SCHEME = https
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Ruby.yaml.j2 {env_dir}/configs/Ruby.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Ruby.Dockerfile -t id-configurator-ruby .
    docker rmi id-configurator-ruby
commands_post =
    docker buildx prune --all --force

[testenv:module-ruby-http]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    ruby-repo
allowlist_externals =
    docker
description =
    Same as module-ruby, but against a plain-HTTP gem source.
set_env =
    RUBY_REPO_SCHEME = http
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/Ruby.yaml.j2 {env_dir}/configs/Ruby.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Ruby.Dockerfile -t id-configurator-ruby-http .
    docker rmi id-configurator-ruby-http
commands_post =
    docker buildx prune --all --force

[docker:nuget-repo]
dockerfile = {tox_root}/tests/dockerfiles/repos/nuget-repo.Dockerfile
expose =
    NUGET_REPO_PORT=8443/tcp
    NUGET_REPO_HTTP_PORT=8080/tcp
healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/index.json || exit 1
healthcheck_interval = 1
healthcheck_retries = 30
healthcheck_timeout = 2
healthcheck_start_period = 1

[testenv:module-nuget]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    nuget-repo
allowlist_externals =
    docker
set_env =
    NUGET_REPO_SCHEME = https
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/NuGet.yaml.j2 {env_dir}/configs/NuGet.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/NuGet.Dockerfile -t id-configurator-nuget .
    docker rmi id-configurator-nuget
commands_post =
    docker buildx prune --all --force

[testenv:module-nuget-http]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    nuget-repo
allowlist_externals =
    docker
description =
    Same as module-nuget, but against a plain-HTTP feed, to verify
    allowInsecureConnections is configured correctly for a non-HTTPS source.
set_env =
    NUGET_REPO_SCHEME = http
commands =
    python3 -m id_tools test render-config {tox_root}/tests/configs/NuGet.yaml.j2 {env_dir}/configs/NuGet.yaml
    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/NuGet.Dockerfile -t id-configurator-nuget-http .
    docker rmi id-configurator-nuget-http
commands_post =
    docker buildx prune --all --force

[docker:config-url-repo]
dockerfile = {tox_root}/tests/dockerfiles/repos/config-url-repo.Dockerfile
expose =
    CONFIG_REPO_PORT=8443/tcp
healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/config.yaml || exit 1
healthcheck_interval = 1
healthcheck_retries = 30
healthcheck_timeout = 2
healthcheck_start_period = 1

[testenv:config-url]
package = skip
labels = end-to-end
change_dir = {tox_root}
dependency_groups = dev
docker =
    config-url-repo
allowlist_externals =
    docker
    sh
description =
    Verifies `id-configurator apply --config-url ... --config-url-cacert-content
    ...`: the configuration itself is downloaded over HTTPS from the
    config-url-repo fixture (trusting only the given root CA content, not the
    system's trust store), rather than read from a local --config file.
commands =
    sh -c 'docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg CONFIG_REPO_PORT={env:CONFIG_REPO_PORT} --build-arg CONFIG_URL_CACERT_CONTENT="$(cat {tox_root}/tests/certs/test-ca.crt.pem)" -f {tox_root}/tests/dockerfiles/ConfigUrl.Dockerfile -t id-configurator-config-url .'
    docker rmi id-configurator-config-url
commands_post =
    docker buildx prune --all --force