*** Settings ***
Documentation     Integration tests for security scanning via nox
...               Validates that nox -s security_scan runs Bandit, Semgrep, and Vulture
...               with the correct configurations.
Resource          ${CURDIR}/common.resource
Suite Setup       Setup Test Environment
Suite Teardown    Cleanup Test Environment

*** Variables ***
${HELPER_SCRIPT}    robot/helper_security_scan.py

*** Test Cases ***
Bandit Config Exists In Pyproject
    [Documentation]    Verify bandit configuration section exists in pyproject.toml
    [Tags]    security    config
    ${content}=    Get File    ${WORKSPACE}/pyproject.toml
    Should Contain    ${content}    [tool.bandit]

Semgrep Config File Exists
    [Documentation]    Verify .semgrep.yml exists at project root
    [Tags]    security    config
    File Should Exist    ${WORKSPACE}/.semgrep.yml

Semgrep Config Contains Rules
    [Documentation]    Verify .semgrep.yml has at least one rule defined
    [Tags]    security    config
    ${content}=    Get File    ${WORKSPACE}/.semgrep.yml
    Should Contain    ${content}    rules:

Pre-commit Config Has Bandit Hook
    [Documentation]    Verify bandit hook is declared in pre-commit config
    [Tags]    security    precommit
    ${content}=    Get File    ${WORKSPACE}/.pre-commit-config.yaml
    Should Contain    ${content}    id: bandit

Pre-commit Config Has Semgrep Hook
    [Documentation]    Verify semgrep hook is declared in pre-commit config
    [Tags]    security    precommit
    ${content}=    Get File    ${WORKSPACE}/.pre-commit-config.yaml
    Should Contain    ${content}    id: semgrep-eval-exec

Nox Security Scan Session Exists
    [Documentation]    Verify security_scan is listed as a nox session
    [Tags]    security    nox
    ${result}=    Run Process    ${PYTHON}    ${HELPER_SCRIPT}    verify-session-exists    cwd=${WORKSPACE}
    Should Be Equal As Integers    ${result.rc}    0
    Should Contain    ${result.stdout}    security-scan-session-ok