import os,json,urllib.request,base64,subprocess,pathlib
ROOT=pathlib.Path(__file__).parent
org=os.environ['AZURE_DEVOPS_TEST_ORG'].rstrip('/')
project=os.environ['AZURE_DEVOPS_TEST_PROJECT']
auth='Basic '+base64.b64encode((':'+os.environ['AZURE_DEVOPS_EXT_PAT']).encode()).decode()
def api(path,data=None,method=None):
 req=urllib.request.Request(org+'/'+path,headers={'Authorization':auth,'Content-Type':'application/json'},data=json.dumps(data).encode() if data is not None else None,method=method)
 try:
  with urllib.request.urlopen(req) as r:return json.load(r) if r.status!=204 else None
 except urllib.error.HTTPError as e:raise RuntimeError(str(e.code)+' '+e.read().decode())
if __name__=='__main__':
 repo=api(project+'/_apis/git/repositories?api-version=7.1')['value'][0]
 work=ROOT/'azure-repo';work.mkdir(exist_ok=True)
 def git(*a):return subprocess.check_output(['git',*a],cwd=work,text=True).strip()
 git('init','--initial-branch=proof31146-base')
 (work/'README.md').write_text('Azure build validation proof\n')
 (work/'azure-pipelines.yml').write_text('''trigger: none
pr: none
jobs:
- job: Validation
  pool: server
  timeoutInMinutes: 5
  steps:
  - task: Delay@1
    inputs:
      delayForMinutes: '1'
  - task: ManualValidation@0
    condition: ne(variables['proofOutcome'], 'success')
    timeoutInMinutes: 1
    inputs:
      notifyUsers: ''
      instructions: 'Synthetic build validation: reject on timeout'
      onTimeout: reject
''')
 git('add','.')
 git('-c','user.name=Scenario','-c','user.email=scenario@example.invalid','commit','-m','Synthetic validation fixture')
 url=org+'/'+project+'/_git/'+repo['name']
 git('remote','add','origin',url)
 helper='!f() { echo username=pat; echo "password=$AZURE_DEVOPS_EXT_PAT"; }; f'
 git('-c','credential.helper='+helper,'push','origin','proof31146-base')
 git('checkout','-b','proof31146-change')
 (work/'change.txt').write_text('Validate this change\n')
 git('add','.')
 git('-c','user.name=Scenario','-c','user.email=scenario@example.invalid','commit','-m','Change for validation')
 git('-c','credential.helper='+helper,'push','origin','proof31146-change')
 definition=api(project+'/_apis/build/definitions?api-version=7.1',{'name':'Proof 31146 build validation','type':'build','queue':{'pool':{'id':9},'id':9},'process':{'type':2,'yamlFilename':'azure-pipelines.yml'},'repository':{'id':repo['id'],'type':'TfsGit','name':repo['name'],'url':repo['url'],'defaultBranch':'refs/heads/proof31146-base'},'variables':{'proofOutcome':{'value':'fail','allowOverride':True}}})
 print('DEFINITION',definition['id'],flush=True)
 policy=api(project+'/_apis/policy/configurations?api-version=7.1',{'isEnabled':True,'isBlocking':True,'type':{'id':'0609b952-1397-4640-95ec-e00a01b2c241'},'settings':{'buildDefinitionId':definition['id'],'displayName':'Required build validation','manualQueueOnly':False,'queueOnSourceUpdateOnly':False,'validDuration':0,'scope':[{'repositoryId':repo['id'],'refName':'refs/heads/proof31146-base','matchKind':'Exact'}]}})
 pr=api(project+'/_apis/git/repositories/'+repo['id']+'/pullrequests?api-version=7.1',{'sourceRefName':'refs/heads/proof31146-change','targetRefName':'refs/heads/proof31146-base','title':'Azure build validation proof','description':'Synthetic data for build validation checks proof','isDraft':False})
 state={'repo':repo['id'],'url':url,'definition':definition['id'],'policy':policy['id'],'pr':pr['pullRequestId'],'project':project}
 (ROOT/'azure-state.json').write_text(json.dumps(state))
 print(json.dumps(state))