#!/bin/bash
# Check if any image tags in the repo have multi-digit patch versions that would be truncated
git grep -E -o -h '(stackrox|scanner)-(build|test)-[0-9]+\.[0-9]+\.[0-9]+' | grep -E '[0-9]+\.[0-9]+\.[0-9]{2,}' | head -20

# First, let's examine the full script to understand context
head -20 scripts/check-image-version.sh

# Search for actual image tags/versions in the codebase to see what formats exist
git grep -E -o '(stackrox|scanner)-(build|test)-[0-9]+\.[0-9]+\.[0-9]' | head -30

# Also search for version patterns more broadly
git grep -E '[0-9]+\.[0-9]+\.[0-9]' -- '*.sh' '*.md' '*.yaml' '*.yml' | grep -E '(stackrox|scanner)' | head -20

cd /tmp && find . -name "app.go" | grep -E "sensor/upgrader" 2>/dev/null | head -20

git ls-files | grep -E "sensor/upgrader" | head -30

cat -n sensor/upgrader/app/app.go | head -50

cat -n sensor/upgrader/flags/flags.go 2>/dev/null || echo "File not found, searching for it..."

find . -path "*/sensor/upgrader/flags*" -type f

rg -l "sensor/upgrader/app" --type go | head -20

rg "from.*sensor.*upgrader" --type go | grep -i "dispatcher\|main\|shared" | head -20

git log --oneline --all -20 | grep -i "upgrade\|dispatch\|shared"

find . -name "main.go" | xargs rg -l "upgrader" 2>/dev/null | head -10

find . -path "*/sensor/upgrader*" -name "main.go" -o -path "*/sensor/upgrader*" -name "*dispatcher*" -o -path "*/sensor/upgrader*" -name "*shared*" | head -20

cat -n sensor/upgrader/main.go | head -50

cat -n central/main.go | grep -A 10 -B 10 "upgrader" | head -50

rg "upgrader/app" --type go -B 2 -A 2

cat -n central/main.go | sed -n '1100,1130p'

find . -path "*/app/app.go" | xargs rg -l "flag.String\|flag.Duration\|flag.Bool" | head -10

# Check other app packages for flag definitions
for f in $(find . -path "*/app/app.go" | head -10); do echo "=== $f ==="; rg "flag\.(String|Duration|Bool|Int)" "$f" 2>/dev/null | head -5; done

# Check if other app packages might register conflicting flag names
for f in compliance/cmd/compliance/app/app.go migrator/app/app.go sensor/admission-control/app/app.go sensor/kubernetes/app/app.go; do
  echo "=== $f ===";
  rg "flag\.(String|Duration|Bool|Int)" "$f" 2>/dev/null | grep -oP '"\K[^"]+(?=")' | sort | uniq;
done

# Check if flags package in upgrader registers flags at init time
rg "^var|^const" sensor/upgrader/flags/flags.go -A 1

# Verify that imports happen at the top level of central/main.go before main() execution
head -300 central/main.go | tail -100

# Check if central/main.go calls flag.Parse() at the top level
rg "flag.Parse\(\)" central/main.go

# Verify the dispatcher flow: does it parse flags before or after dispatching?
grep -n "flag.Parse\|switch.*binaryName" central/main.go

# Check if there are any other app packages that also register flags at package init
for pkg in compliance sensor/admission-control sensor/kubernetes config-controller migrator; do
  pkg_path=$(find . -path "*/$pkg/app" -type d 2>/dev/null | head -1)
  if [ -n "$pkg_path" ]; then
    echo "=== $pkg ===";
    rg "flag\." "$pkg_path" 2>/dev/null | head -10;
  fi
done

# Check if central/main.go has flag.Parse() anywhere
cat -n central/main.go | grep -B 5 -A 5 "Parse\|switch"

# More thorough check: look at the entire main function
sed -n '1105,1140p' central/main.go

# Check config-controller/app/app.go to see if it also has this pattern
cat -n config-controller/app/app.go | head -80

# Check if sensor/kubernetes/app or sensor/admission-control/app register flags at package init
for path in sensor/kubernetes/app sensor/admission-control/app; do
  if [ -f "$path/app.go" ]; then
    echo "=== $path/app.go ===";
    cat -n "$path/app.go" | head -40;
  fi
done

# Check central/main.go Main() function to see if it calls flag.Parse()
sed -n '1050,1105p' central/main.go

# Final verification: trace the execution when central/main.go is invoked as "sensor-upgrader"
# Does it parse flags before or after dispatch?
grep -n "Parse\|premain\|startup" central/main.go | head -20

# Double-check: what happens when central/main.go's Main() is called - does it ever call flag.Parse()?
grep -n "flag.Parse" central/main.go

# Check if there are any flag name collisions between upgrader flags and other registered flags
echo "=== Upgrader flags ===" && \
rg "flag\.(String|Duration|Bool|Int)\(" sensor/upgrader/app sensor/upgrader/flags 2>/dev/null | \
grep -oP '\(\s*"[^"]+' | grep -oP '"[^"]+' | sort && \
echo -e "\n=== Other app flags ===" && \
rg "flag\.(String|Duration|Bool|Int)Var?" config-controller/app 2>/dev/null | \
grep -oP '"[^"]+' | sort

# Verify: When imported into central/main.go, are upgrader flags accessible via flag.CommandLine?
rg "flag.CommandLine\|flag.Lookup" central/main.go sensor/upgrader

# Check if flag registration at package level happens during import
# Simulate what happens when central/main.go is compiled
python3 << 'EOF'
# When Go imports a package, all package-level var declarations with
# initializers are evaluated. flag.String() calls register to flag.CommandLine
# Let's verify this is the actual pattern:
import subprocess
result = subprocess.run(['rg', 'var\\s*\\(', 'sensor/upgrader/app/app.go', '-A', '5'], 
                       capture_output=True, text=True)
print("=== Package-level var block in upgrader/app ===")
print(result.stdout)

result = subprocess.run(['rg', 'var\\s*\\(', 'sensor/upgrader/flags/flags.go', '-A', '5'],
                       capture_output=True, text=True)
print("\n=== Package-level var block in upgrader/flags ===")
print(result.stdout)
EOF

# Verify: does central's main dispatcher ever access os.Args before Run() is called?
grep -n "os.Args\|flag\|Parse" central/main.go | head -20

# Key question: when central is invoked as "sensor-upgrader", what is os.Args[1:]?
# If user passes flags like "central -workflow=foo", flag.Parse() in sensorupgraderapp.Run()
# will parse them, and all registered flags (including config-controller's) are available
echo "=== Checking if there's any flag preprocessing before dispatch ===" && \
sed -n '1105,1110p' central/main.go

# Final verification: Does central's Main() function ever access upgrader flags?
# Or any other part of central code reference these flags?
rg "workflow|KubeConfigSource|KubeTimeout" --type go central/ 2>/dev/null | grep -v "upgrader" | head -10

# Check if there's any dynamic flag registration that could cause collisions
rg "flag\.(String|Duration|Bool|Int)" --type go | grep -v "test\|upgrader\|config-controller\|compliance" | head -20

# Verify the exact Go semantics: does importing a package execute package-level var initializers?
python3 << 'EOF'
print("In Go:")
print("1. When a package is imported, package-level var declarations are initialized")
print("2. flag.String() calls flag.String() which is equivalent to flag.CommandLine.String()")
print("3. flag.CommandLine is the default FlagSet for the entire process")
print("")
print("Therefore:")
print("- When central/main.go imports sensor/upgrader/app")
print("- sensor/upgrader/app's init code runs (package-level var block)")
print("- flag.String('workflow', ...) registers on the global flag.CommandLine")
print("- sensor/upgrader/flags is imported, also registering flags globally")
print("- These flags are now accessible process-wide, even when running central mode")
print("")
print("Risk assessment:")
print("- Current code: No collision (other packages don't register flags at init)")
print("- Future risk: HIGH (if any other imported package registers flags at init with same name)")
print("- Design issue: YES (violates single-responsibility, coupling imported packages)")
EOF