xianyun_core/config/

caproni.rs

//! Port of `internal/config/caproni.go`: the top-level config loader
//! (`LoadCaproniConfig`), schema compilation, and the variable-expansion /
//! literal-field guards it orchestrates.
//!
//! `extends:` composition supports both local (same-filesystem) and
//! `https://` remote fragments (see `merge.rs`'s module doc comment for the
//! `RemoteFetcher` design), and `caproni-project.yaml` per-repository
//! fragment application (`applyCaproniProject`, in `merge.rs`) is fully
//! ported. The one remaining documented gap is `compile_schema_lazy_loading`
//! (`#[ignore]`d below): the Go original's `sync.Once`-cached schema
//! pointer-identity assertion has no equivalent here, since this port
//! compiles the schema fresh per call rather than caching it — see
//! `validate_schema_v2`'s doc comment.

use std::collections::{HashMap, HashSet};
use std::path::Path;

use serde_json::Value;

use super::errors::ConfigError;
use super::global::GlobalConfig;
use super::latest::CaproniConfig;
use super::merge::{apply_local_override, resolve_extends, resolve_local_override};
use super::registry::{LATEST_VERSION, load_and_upgrade, supported_versions};
use super::validate::validate_semantics;
use crate::naming;
use crate::variables::expand::expand_map;
use crate::variables::predefined::Options;
use crate::variables::resolver::{Lookup, ResolverLookup, new_resolver};

const CLUSTER_KEY: &str = "cluster";
const DRIVER_KEY: &str = "driver";
const K3D_KEY: &str = "k3d";
const COLIMA_KEY: &str = "colima";
const K3S_KEY: &str = "k3s";
const DISABLE_KEY: &str = "disable";

/// Compiles (once per call, no caching — see the module doc comment) and
/// validates `raw_config` against `schema/config.v2.schema.json`. A separate
/// compile per call is a deliberate reduction from the Go original's
/// `sync.Once`-cached compile: this port has no long-lived process to amortize
/// the cost across (every test process is short-lived), and adding a
/// `OnceLock` purely for a crate that is not yet used from a long-running
/// binary is premature; revisit if/when a caproni CLI built on this crate
/// calls `load_caproni_config` in a hot loop.
fn validate_schema_v2(raw_config: &Value) -> Result<(), ConfigError> {
    const SCHEMA_JSON: &str = include_str!("../../../../schema/config.v2.schema.json");

    let schema_doc: Value = serde_json::from_str(SCHEMA_JSON)
        .map_err(|err| ConfigError::SchemaValidation(format!("parsing schema: {err}")))?;

    let compiled = jsonschema::validator_for(&schema_doc)
        .map_err(|err| ConfigError::SchemaValidation(format!("compiling schema: {err}")))?;

    // Each error is rendered with its instance path so that a caller (or a
    // test asserting on `err_contains`) can tell *which* field failed, not
    // just how — the `jsonschema` crate's bare `Display` omits this,
    // unlike the Go original's `jsonschema` library, whose default error
    // formatting includes the failing field's JSON Pointer.
    let errors: Vec<String> = compiled
        .iter_errors(raw_config)
        .map(|e| {
            let path = e.instance_path.to_string();
            if path.is_empty() {
                e.to_string()
            } else {
                format!("{path}: {e}")
            }
        })
        .collect();

    if errors.is_empty() {
        Ok(())
    } else {
        Err(ConfigError::SchemaValidation(errors.join("; ")))
    }
}

/// Reads the required `version` field from raw YAML. The field is mandatory:
/// a missing field is an error, not a defaulted version.
///
/// Port of `detectConfigVersion`.
fn detect_config_version(raw_config: &Value) -> Result<i64, ConfigError> {
    let map = raw_config.as_object().ok_or(ConfigError::MissingVersion)?;
    let version = map.get("version").ok_or(ConfigError::MissingVersion)?;
    version.as_i64().ok_or(ConfigError::InvalidVersion)
}

/// Loads and parses the caproni.yaml configuration file. Returns a v2
/// `CaproniConfig` regardless of input version. Remote (`https://`)
/// `extends:` fragments are fetched with a fresh [`super::merge::UreqFetcher`];
/// use [`load_caproni_config_with_fetcher`] to inject a different one (e.g.
/// a `wiremock`-backed test double — see `merge.rs`'s module doc comment).
pub fn load_caproni_config(gc: &GlobalConfig) -> Result<CaproniConfig, ConfigError> {
    load_caproni_config_with_fetcher(gc, &super::merge::UreqFetcher::new())
}

/// Port of the private `loadCaproniConfig(ctx, gc, httpClient, cache)`: the
/// full loader, parameterized over the [`super::merge::RemoteFetcher`] used
/// for `extends:` remote fragments and downloaded deployer files.
pub fn load_caproni_config_with_fetcher(
    gc: &GlobalConfig,
    fetcher: &dyn super::merge::RemoteFetcher,
) -> Result<CaproniConfig, ConfigError> {
    let mut gc = gc.clone();
    let path = gc.config_file.clone();

    // 1. Read file.
    let data = std::fs::read(&path).map_err(|_| ConfigError::ConfigFileNotFound(path.clone()))?;

    // 2. Parse YAML into a generic structure first (version detection and
    //    schema validation both need this before an authoritative decode).
    let mut raw_config: Value =
        serde_yaml::from_slice(&data).map_err(|err| ConfigError::InvalidYAML(err.to_string()))?;

    // 3. Compute the absolute config path for extends:/local-override lookup.
    let abs_path = std::fs::canonicalize(&path)
        .or_else(|_| std::path::absolute(&path))
        .map_err(|err| ConfigError::ConfigFileNotFound(format!("{path}: {err}")))?;

    let mut used_fragments = HashMap::new();
    // Maps `deployers/<name>` to the remote fragment it came from, for step
    // 11.5 (`fetch_deployer_files`) below. Port of `elementSources`.
    let mut element_sources = HashMap::new();

    // 4. Resolve extends: composition in the base config.
    if raw_config.is_object() {
        let mut visited = HashSet::new();
        visited.insert(abs_path.clone());

        raw_config = resolve_extends(
            &abs_path,
            raw_config,
            false,
            &mut visited,
            &mut used_fragments,
            fetcher,
            Some(&mut element_sources),
        )?;
    }

    // 5./6. Read and merge caproni.local.yaml, if present.
    if let Some(local_override) = resolve_local_override(
        &abs_path,
        &mut used_fragments,
        fetcher,
        Some(&mut element_sources),
    )? {
        raw_config = apply_local_override(raw_config, local_override)?;
    }

    // 7. Detect configuration version (the `version` field is required).
    let version = detect_config_version(&raw_config)?;

    // Checked here (rather than only at step 11, as in the Go original)
    // because `decode_seed_config` below also needs a supported version to
    // decode against, and this port's `registry::load_and_upgrade` doesn't
    // carry the raw declared version number through its own error (see its
    // `ConfigError::UnsupportedVersion` test in `registry.rs`) the way the
    // Go original's `loadAndUpgrade` does.
    if version_from_i64(version) != LATEST_VERSION {
        return Err(ConfigError::SemanticValidation(format!(
            "unsupported config version: {version} (supported versions: {})",
            supported_versions()
        )));
    }

    // 8. Load caproni-project.yaml from each edit-mode repository directory.
    // Done after caproni.local.yaml so that edit_mode set in the local
    // override is respected.
    let config_dir = abs_path
        .parent()
        .unwrap_or_else(|| Path::new("."))
        .to_path_buf();
    raw_config = super::merge::apply_caproni_project(raw_config, &config_dir)?;

    let data = serde_json::to_vec(&raw_config)
        .map_err(|err| ConfigError::InvalidYAML(format!("re-marshaling config: {err}")))?;

    // 9. Seed the resolver from an unvalidated decode, then resolve the
    //    profile name so predefined variables are available.
    let mut seed = decode_seed_config(version, &data, &abs_path)?;

    apply_resolved_cluster_domain(&mut seed, &gc);

    if gc.profile_name.is_empty() {
        gc.profile_name = resolve_profile_name(&seed)?;
    }

    // 10. Resolve variable definitions, then expand ${VAR}/$VAR references
    //     across the merged config and re-marshal.
    let def_unresolved =
        super::definitions::resolve_variable_definitions(&mut gc, &mut seed, &mut raw_config)?;

    // Port of `newResolver` (`internal/config/container.go`): every resolved
    // variable definition becomes a static var, highest precedence.
    let static_vars: HashMap<String, String> = seed
        .variables
        .as_ref()
        .map(|vars| {
            vars.iter()
                .map(|(name, vc)| (name.clone(), vc.value.clone()))
                .collect()
        })
        .unwrap_or_default();

    let resolver = new_resolver(
        Options {
            profile_name: gc.profile_name.clone(),
            cluster: Some(seed.cluster.clone()),
        },
        Some(static_vars),
        Some(gc.tool_versions()),
    );
    let lookup_adapter = ResolverLookup(&*resolver);
    let lookup: &dyn Lookup = &lookup_adapter;

    if let Value::Object(base_map) = &mut raw_config {
        // A ref with an unset variable would expand to "" and silently use
        // the default branch, so fail loudly instead.
        validate_repository_ref_variables(base_map, lookup)?;

        let unresolved = expand_map(&mut raw_config, lookup, Some(&skip_variable_expansion_path))
            .map_err(|err| {
            ConfigError::SemanticValidation(format!("resolving config variables: {err}"))
        })?;

        let _ = (def_unresolved, unresolved); // unresolved-variable reporting is a log line in Go, not surfaced here.

        // Reported before schema validation so an unexpanded reference is
        // named as such, rather than surfacing as an opaque schema failure.
        if let Value::Object(base_map) = &raw_config {
            validate_literal_cluster_fields(base_map)?;
        }
    }

    let data = serde_json::to_vec(&raw_config)
        .map_err(|err| ConfigError::InvalidYAML(format!("re-marshaling config: {err}")))?;

    // 11. Validate the declared version's schema, then unmarshal + apply
    //     defaults + upgrade to the latest config. Version support was
    //     already checked above.
    let declared = version_from_i64(version);

    validate_schema_v2(&raw_config)?;

    let mut cfg = load_and_upgrade(declared, &data, true)?;

    cfg.config_file = abs_path.to_string_lossy().into_owned();
    cfg.config_dir = abs_path
        .parent()
        .map(|p| p.to_string_lossy().into_owned())
        .unwrap_or_default();

    super::merge::fetch_deployer_files(&mut cfg, &element_sources, fetcher)?;

    validate_semantics(&cfg).map_err(|err| ConfigError::SemanticValidation(err.to_string()))?;

    apply_resolved_cluster_domain(&mut cfg, &gc);
    apply_version_defaults(&mut cfg, &mut gc);

    Ok(cfg)
}

fn version_from_i64(v: i64) -> super::version::ConfigVersion {
    match v {
        2 => super::version::ConfigVersion::V2,
        _ => super::version::ConfigVersion::Unknown,
    }
}

/// Decodes the merged config into a latest config without schema or semantic
/// validation, seeding the variable resolver before the authoritative decode
/// (which would reject unexpanded `${VAR}` values). Port of
/// `decodeSeedConfig`.
fn decode_seed_config(
    version: i64,
    data: &[u8],
    abs_path: &Path,
) -> Result<CaproniConfig, ConfigError> {
    let mut cfg = load_and_upgrade(version_from_i64(version), data, false)?;
    cfg.config_dir = abs_path
        .parent()
        .map(|p| p.to_string_lossy().into_owned())
        .unwrap_or_default();
    Ok(cfg)
}

/// Determines the cluster profile name from the naming strategy. If no
/// naming config is set (e.g. v1 configs), defaults to the static strategy.
/// Port of `resolveProfileName`.
fn resolve_profile_name(cfg: &CaproniConfig) -> Result<String, ConfigError> {
    let strategy = cfg
        .cluster
        .name
        .as_ref()
        .map(|n| n.strategy.as_str())
        .unwrap_or_default();

    naming::resolve(strategy, &cfg.config_dir)
        .map_err(|err| ConfigError::SemanticValidation(format!("resolving cluster name: {err}")))
}

/// Fills `cluster.network.cluster_domain` from the domain a command resolved
/// from the live cluster, when the key is unset. Port of
/// `applyResolvedClusterDomain` (lives in `caproni.go`, not a dedicated
/// `clusterdomain.go` — see `PORT_NOTES.md`).
fn apply_resolved_cluster_domain(cfg: &mut CaproniConfig, gc: &GlobalConfig) {
    if gc.cluster_domain.is_empty() {
        return;
    }

    let Some(network) = cfg.cluster.network.as_mut() else {
        return;
    };

    if network.cluster_domain.is_empty() {
        network.cluster_domain = gc.cluster_domain.clone();
    }
}

/// Checks that variables referenced by a `repositories.<name>.ref` resolve,
/// before expansion collapses an unset one to `""`. Port of
/// `validateRepositoryRefVariables`.
fn validate_repository_ref_variables(
    root: &serde_json::Map<String, Value>,
    lookup: &dyn Lookup,
) -> Result<(), ConfigError> {
    let Some(repos) = root.get("repositories").and_then(Value::as_object) else {
        return Ok(());
    };

    for (name, raw) in repos {
        let Some(repo) = raw.as_object() else {
            continue;
        };
        let Some(ref_val) = repo.get("ref").and_then(Value::as_str) else {
            continue;
        };
        if ref_val.is_empty() {
            continue;
        }

        let (_, missing) =
            crate::variables::expand::expand_definition(ref_val, lookup).map_err(|err| {
                ConfigError::SemanticValidation(format!("repository {name:?} ref: {err}"))
            })?;

        if !missing.is_empty() {
            return Err(ConfigError::UnresolvedRepositoryRefVariable);
        }
    }

    Ok(())
}

/// Reports whether `path` (dotted segments from the config root) points at a
/// value whose variable references must survive expansion verbatim (a
/// literal cluster field, or a mirror filesystem regex field).
pub fn skip_variable_expansion(path: &[String]) -> bool {
    is_literal_regex_field(path) || is_literal_cluster_field(path)
}

fn skip_variable_expansion_path(path: &[String]) -> bool {
    skip_variable_expansion(path)
}

/// Reports whether `path` points at a cluster field that must not carry a
/// variable reference: `cluster.driver`, or `cluster.<k3d|colima>.k3s.disable`
/// (and its list elements).
fn is_literal_cluster_field(path: &[String]) -> bool {
    if path.is_empty() || path[0] != CLUSTER_KEY {
        return false;
    }

    if path.len() == 2 && path[1] == DRIVER_KEY {
        return true;
    }

    path.len() >= 4
        && (path[1] == K3D_KEY || path[1] == COLIMA_KEY)
        && path[2] == K3S_KEY
        && path[3] == DISABLE_KEY
}

/// Reports whether `path` points at a mirror filesystem field whose values
/// are regular expressions rather than variable references.
fn is_literal_regex_field(path: &[String]) -> bool {
    if path.len() != 5 || path[0] != "reloaders" || path[2] != "mirror" || path[3] != "filesystem" {
        return false;
    }

    matches!(path[4].as_str(), "mapping" | "read_only" | "read_write")
}

/// Rejects a literal cluster field that still carries a variable reference,
/// after expansion skipped it. Port of `validateLiteralClusterFields`.
fn validate_literal_cluster_fields(
    root: &serde_json::Map<String, Value>,
) -> Result<(), ConfigError> {
    let Some(cluster) = root.get(CLUSTER_KEY).and_then(Value::as_object) else {
        return Ok(());
    };

    if let Some(driver) = cluster.get(DRIVER_KEY).and_then(Value::as_str)
        && driver.contains('$')
    {
        return Err(ConfigError::DriverNotLiteral(driver.to_string()));
    }

    for driver in [K3D_KEY, COLIMA_KEY] {
        for component in k3s_disable_list(cluster, driver) {
            if component.contains('$') {
                return Err(ConfigError::K3sDisableNotLiteral(component));
            }
        }
    }

    Ok(())
}

fn k3s_disable_list(cluster: &serde_json::Map<String, Value>, driver: &str) -> Vec<String> {
    cluster
        .get(driver)
        .and_then(Value::as_object)
        .and_then(|d| d.get(K3S_KEY))
        .and_then(Value::as_object)
        .and_then(|k| k.get(DISABLE_KEY))
        .and_then(Value::as_array)
        .map(|entries| {
            entries
                .iter()
                .filter_map(|e| e.as_str().map(String::from))
                .collect()
        })
        .unwrap_or_default()
}

/// Gets the global config from the context and loads the config instance
/// from it using [`load_caproni_config`].
pub fn load_from_context(
    ctx: &super::global::Context,
) -> Result<super::container::Container, ConfigError> {
    let mut global = super::global::from_context(ctx).ok_or_else(|| {
        ConfigError::ConfigFileNotFound("no global config in context".to_string())
    })?;

    let cfg = load_caproni_config(&global)?;

    // `load_caproni_config` resolves the profile name on an internal clone
    // of `global` (it takes `&GlobalConfig`, not `&mut`, unlike the Go
    // original's pointer-receiver mutation of the caller's `GlobalConfig`).
    // Recompute it here so the container's `global.profile_name` matches
    // what the load actually used, rather than staying empty.
    if global.profile_name.is_empty() {
        global.profile_name = resolve_profile_name(&cfg)?;
    }

    Ok(super::container::new_container(global, cfg))
}

/// Populates runtime fields on the config from CI version variables.
pub fn apply_version_defaults(cfg: &mut CaproniConfig, gc: &mut GlobalConfig) {
    if let Some(image) = gc.get_tool_version("GL_COPY_SLEEP_IMAGE") {
        cfg.copy_sleep_image = image;
    }

    if let Some(colima) = cfg.cluster.colima.as_mut()
        && colima.k3s_version.is_empty()
        && let Some(version) = gc.get_tool_version("GL_K3S_VERSION")
    {
        colima.k3s_version = version;
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::config::global::GlobalConfig;
    use crate::config::types::ColimaConfig;
    use std::collections::HashMap;
    use std::fs;

    /// Writes a test configuration to a temporary file. Port of the Go
    /// `writeTestConfig` helper (`internal/config/caproni_test.go`).
    fn write_test_config(content: &str) -> (tempfile::TempDir, String) {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("caproni.yaml");
        fs::write(&path, content).unwrap();
        (dir, path.to_string_lossy().into_owned())
    }

    fn load(path: String) -> Result<CaproniConfig, ConfigError> {
        let gc = GlobalConfig {
            config_file: path,
            ..Default::default()
        };
        load_caproni_config(&gc)
    }

    // Port of TestLoadCaproniConfig_Valid.
    #[test]
    fn load_valid_config() {
        let yaml = "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 8GiB
    cores: 4

repositories:
  gitlab:
    repository: https://gitlab.com/gitlab-org/gitlab.git
    directory: ./gitlab/
    ref: v1.2.3

reloaders:
  gitlab:
    type: mirror
    repository: gitlab
    edit_mode: true
    mirror:
      target:
        namespace: gitlab
        kubernetes_type: deployment
        name: gitlab-webservice-default
      edit_mode_processes:
        puma:
          command: bin/start-puma
";
        let (_dir, path) = write_test_config(yaml);
        let cfg = load(path).expect("load should succeed");

        assert_eq!(cfg.cluster.driver, "colima");
        let colima = cfg.cluster.colima.expect("colima config present");
        assert_eq!(colima.memory, "8GiB");
        assert_eq!(colima.cores, 4);

        let repos = cfg.repositories.expect("repositories present");
        assert_eq!(repos.len(), 1);
        assert!(repos.has(&"gitlab".to_string()));
        let repo = repos.get(&"gitlab".to_string()).unwrap();
        assert_eq!(repo.repository, "https://gitlab.com/gitlab-org/gitlab.git");
        assert_eq!(repo.directory, "./gitlab/");
        assert_eq!(repo.ref_, "v1.2.3");

        let reloaders = cfg.reloaders.expect("reloaders present");
        assert_eq!(reloaders.len(), 1);
        let reloader = reloaders.get(&"gitlab".to_string()).unwrap();
        assert_eq!(reloader.reloader_type, "mirror");
        assert_eq!(reloader.repository, "gitlab");
        assert!(reloader.edit_mode);
        let mirror = reloader.mirror.as_ref().expect("mirror present");
        let target = mirror.target.as_ref().expect("target present");
        assert_eq!(target.kubernetes_type, "deployment");
        assert_eq!(target.name, "gitlab-webservice-default");
    }

    // Port of TestLoadCaproniConfig_RefUnresolvedVariable.
    #[test]
    fn load_ref_unresolved_variable() {
        let yaml = "
version: 2
cluster:
  driver: mock
  network:
    hostname: gitlab.test
repositories:
  gitlab:
    repository: https://gitlab.com/gitlab-org/gitlab.git
    directory: ./gitlab/
    ref: ${CAPRONI_TEST_UNSET_REF_VAR}
";
        let (_dir, path) = write_test_config(yaml);
        let err = load(path).unwrap_err();
        assert!(matches!(err, ConfigError::UnresolvedRepositoryRefVariable));
    }

    // Port of TestLoadCaproniConfig_NoRepositories.
    #[test]
    fn load_no_repositories() {
        let yaml = "version: 2\ncluster:\n  driver: auto\n  network:\n    hostname: foo\n  k3d: {}\n  colima:\n    memory: 8GiB\n    cores: 4\n";
        let (_dir, path) = write_test_config(yaml);
        let cfg = load(path).expect("load should succeed");

        let repos = cfg
            .repositories
            .expect("repositories should be initialized even when omitted from config");
        assert_eq!(repos.len(), 0);
    }

    // Port of TestLoadCaproniConfig_RegistryMirrorSchema (table-driven).
    #[test]
    fn load_registry_mirror_schema_cases() {
        struct Case {
            name: &'static str,
            endpoint: &'static str,
            upstream: &'static str,
            want_err: bool,
        }

        let cases = vec![
            Case {
                name: "valid http endpoint and host",
                endpoint: "http://host.docker.internal:5000",
                upstream: "docker.io",
                want_err: false,
            },
            Case {
                name: "valid registry.gitlab.com upstream",
                endpoint: "http://host.k3d.internal:5000",
                upstream: "registry.gitlab.com",
                want_err: false,
            },
            Case {
                name: "host:port upstream is allowed",
                endpoint: "http://host.k3d.internal:5000",
                upstream: "localhost:5000",
                want_err: false,
            },
            Case {
                name: "https endpoint rejected",
                endpoint: "https://my-cache.lan:5443",
                upstream: "docker.io",
                want_err: true,
            },
            Case {
                name: "endpoint without host rejected",
                endpoint: "http://:5000",
                upstream: "docker.io",
                want_err: true,
            },
            Case {
                name: "endpoint without port rejected",
                endpoint: "http://host.docker.internal",
                upstream: "docker.io",
                want_err: true,
            },
            Case {
                name: "endpoint without scheme rejected",
                endpoint: "host.docker.internal:5000",
                upstream: "docker.io",
                want_err: true,
            },
            Case {
                name: "upstream path traversal rejected",
                endpoint: "http://host.docker.internal:5000",
                upstream: "../evil",
                want_err: true,
            },
            Case {
                name: "upstream with slash rejected",
                endpoint: "http://host.docker.internal:5000",
                upstream: "a/b",
                want_err: true,
            },
        ];

        for case in cases {
            let yaml = format!(
                "version: 2\ncluster:\n  driver: colima\n  network:\n    hostname: gitlab.test\n  colima:\n    memory: 8GiB\n    cores: 4\n  registry_mirror:\n    endpoint: {}\n    upstreams: [{}]\nrepositories: {{}}\n",
                case.endpoint, case.upstream
            );
            let (_dir, path) = write_test_config(&yaml);
            let result = load(path);

            if case.want_err {
                assert!(
                    matches!(result.unwrap_err(), ConfigError::SchemaValidation(_)),
                    "{}",
                    case.name
                );
                continue;
            }

            let cfg = result.unwrap_or_else(|e| panic!("{}: {e}", case.name));
            assert_eq!(
                cfg.cluster.registry_mirror.unwrap().endpoint,
                case.endpoint,
                "{}",
                case.name
            );
        }
    }

    // Port of TestLoadCaproniConfig_RegistryMirrorManagedSchema (table-driven).
    #[test]
    fn load_registry_mirror_managed_schema_cases() {
        struct Case {
            name: &'static str,
            mirror: &'static str,
            want_err: bool,
        }

        let cases = vec![
            Case {
                name: "managed true without endpoint is valid",
                mirror: "  registry_mirror:\n    managed: true\n    upstreams: [docker.io]",
                want_err: false,
            },
            Case {
                name: "managed true with empty upstreams is valid",
                mirror: "  registry_mirror:\n    managed: true",
                want_err: false,
            },
            Case {
                name: "managed true with endpoint is rejected",
                mirror: "  registry_mirror:\n    managed: true\n    endpoint: http://host.k3d.internal:5000\n    upstreams: [docker.io]",
                want_err: true,
            },
            Case {
                name: "unmanaged without endpoint is rejected",
                mirror: "  registry_mirror:\n    upstreams: [docker.io]",
                want_err: true,
            },
        ];

        for case in cases {
            let yaml = format!(
                "version: 2\ncluster:\n  driver: colima\n  network:\n    hostname: gitlab.test\n  colima:\n    memory: 8GiB\n    cores: 4\n{}\nrepositories: {{}}\n",
                case.mirror
            );
            let (_dir, path) = write_test_config(&yaml);
            let result = load(path);

            if case.want_err {
                assert!(
                    matches!(result.unwrap_err(), ConfigError::SchemaValidation(_)),
                    "{}",
                    case.name
                );
            } else {
                result.unwrap_or_else(|e| panic!("{}: {e}", case.name));
            }
        }
    }

    // Port of TestLoadCaproniConfig_HelmRepository.
    #[test]
    fn load_helm_repository() {
        let yaml = "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 10GiB
    cores: 4

repositories:
  charts:
    repository: https://gitlab.com/gitlab-org/charts/gitlab.git
    directory: ./charts/

deployers:
  charts:
    type: helm
    repository: charts
    edit_mode: true
    helm:
      namespace: gitlab
      values_file: ./cng-values.yaml
      repository:
        name: gitlab
        url: https://charts.gitlab.io
      release:
        name: gitlab
        chart: gitlab/gitlab
";
        let (dir, path) = write_test_config(yaml);
        fs::write(dir.path().join("cng-values.yaml"), "key: value").unwrap();

        let cfg = load(path).expect("load should succeed");

        let repos = cfg.repositories.expect("repositories present");
        assert_eq!(repos.len(), 1);
        let repo = repos.get(&"charts".to_string()).unwrap();
        assert_eq!(
            repo.repository,
            "https://gitlab.com/gitlab-org/charts/gitlab.git"
        );
        assert_eq!(repo.directory, "./charts/");

        let deployers = cfg.deployers.expect("deployers present");
        assert_eq!(deployers.len(), 1);
        let deployer = deployers.get(&"charts".to_string()).unwrap();
        assert_eq!(deployer.deployer_type, "helm");
        assert_eq!(deployer.repository.as_deref(), Some("charts"));
        assert!(deployer.edit_mode);
        let helm = deployer.helm.as_ref().expect("helm present");
        assert_eq!(helm.namespace, "gitlab");
        assert_eq!(helm.values_file, "./cng-values.yaml");
    }

    // Port of TestLoadCaproniConfig_NamespaceDeployer.
    #[test]
    fn load_namespace_deployer() {
        let yaml = "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 4GiB
    cores: 2

repositories: {}

deployers:
  prerequisites:
    type: namespace
    namespace:
      namespaces:
        - gitlab
        - monitoring
      delete_on_undeploy: true
";
        let (_dir, path) = write_test_config(yaml);
        let cfg = load(path).expect("load should succeed");

        let deployers = cfg.deployers.expect("deployers present");
        assert_eq!(deployers.len(), 1);
        let deployer = deployers.get(&"prerequisites".to_string()).unwrap();
        assert_eq!(deployer.deployer_type, "namespace");
        let ns = deployer.namespace.as_ref().expect("namespace present");
        assert_eq!(
            ns.namespaces,
            vec!["gitlab".to_string(), "monitoring".to_string()]
        );
        assert!(ns.delete_on_undeploy);
        assert!(deployer.helm.is_none());
    }

    // Port of TestLoadCaproniConfig_ComposesNoInfrastructure.
    #[test]
    fn load_composes_no_infrastructure() {
        let yaml = "
version: 2
cluster:
  driver: colima
  network:
    hostname: test.local
  colima:
    memory: 8GiB
    cores: 4
deployers:
  my-app:
    type: namespace
    namespace:
      namespaces: [my-app]
";
        let (_dir, path) = write_test_config(yaml);
        let cfg = load(path).expect("load should succeed");

        let deployers = cfg.deployers.expect("deployers present");
        assert_eq!(
            deployers.len(),
            1,
            "caproni must compose no deployers of its own"
        );
        assert!(!deployers.has(&"cert-manager".to_string()));
    }

    // Port of TestLoadCaproniConfig_NeedsOnAbsentDeployerIsReported.
    #[test]
    fn load_needs_on_absent_deployer_is_reported() {
        let yaml = "
version: 2
cluster:
  driver: colima
  network:
    hostname: test.local
  colima:
    memory: 8GiB
    cores: 4
deployers:
  my-app:
    type: namespace
    needs: [cert-manager]
    namespace:
      namespaces: [my-app]
";
        let (_dir, path) = write_test_config(yaml);
        let err = load(path).unwrap_err();
        assert!(err.to_string().contains("cert-manager"));
    }

    // Port of TestLoadCaproniConfig_MultipleRepositories.
    #[test]
    fn load_multiple_repositories() {
        let yaml = "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 10GiB
    cores: 4

repositories:
  charts:
    repository: https://gitlab.com/gitlab-org/charts/gitlab.git
    directory: ./charts/
  gitlab:
    repository: https://gitlab.com/gitlab-org/gitlab.git
    directory: ./gitlab/

deployers:
  charts:
    type: helm
    repository: charts
    helm:
      namespace: gitlab
      values_file: ./values.yaml
      repository:
        name: gitlab
        url: https://charts.gitlab.io
      release:
        name: gitlab
        chart: gitlab/gitlab

reloaders:
  gitlab:
    type: mirror
    repository: gitlab
    edit_mode: true
    mirror:
      target:
        namespace: gitlab
        kubernetes_type: deployment
        name: gitlab-webservice-default
      edit_mode_processes:
        puma:
          command: bin/start-puma
          port: 8080
        sidekiq:
          command: bin/sidekiq
";
        let (dir, path) = write_test_config(yaml);
        fs::write(dir.path().join("values.yaml"), "key: value").unwrap();

        let cfg = load(path).expect("load should succeed");

        let repos = cfg.repositories.expect("repositories present");
        assert_eq!(repos.len(), 2);

        let deployers = cfg.deployers.expect("deployers present");
        assert_eq!(deployers.len(), 1);
        let deployer = deployers.get(&"charts".to_string()).unwrap();
        assert_eq!(deployer.repository.as_deref(), Some("charts"));
        assert!(!deployer.edit_mode);

        let reloaders = cfg.reloaders.expect("reloaders present");
        let reloader = reloaders.get(&"gitlab".to_string()).unwrap();
        let mirror = reloader.mirror.as_ref().unwrap();
        let processes = mirror.edit_mode_processes.as_ref().unwrap();
        assert_eq!(processes.len(), 2);
        let puma = processes.get(&"puma".to_string()).unwrap();
        assert_eq!(puma.command, "bin/start-puma");
        assert_eq!(puma.port, 8080);
        let sidekiq = processes.get(&"sidekiq".to_string()).unwrap();
        assert_eq!(sidekiq.port, 0, "not set");
    }

    // Port of TestLoadCaproniConfig_LifecycleHooks.
    #[test]
    fn load_lifecycle_hooks() {
        let yaml = "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 8GiB
    cores: 2

repositories:
  gitlab:
    repository: https://gitlab.com/gitlab-org/gitlab.git
    directory: ./gitlab/

reloaders:
  gitlab:
    type: mirror
    repository: gitlab
    mirror:
      target:
        namespace: gitlab
        kubernetes_type: deployment
        name: gitlab-webservice-default
      edit_mode_processes:
        puma:
          command: bin/start-puma
      lifecycle_hooks:
        - type: edit_mode_prepare
          script: ./scripts/prepare-dev-env.sh
        - type: edit_mode_start
          mirror_script: rake migrate:db
        - type: edit_mode_stop
          job: cleanup-job.yaml
";
        let (_dir, path) = write_test_config(yaml);
        let cfg = load(path).expect("load should succeed");

        let reloaders = cfg.reloaders.expect("reloaders present");
        let reloader = reloaders.get(&"gitlab".to_string()).unwrap();
        let hooks = &reloader.mirror.as_ref().unwrap().lifecycle_hooks;
        assert_eq!(hooks.len(), 3);

        assert_eq!(hooks[0].hook_type, "edit_mode_prepare");
        assert_eq!(hooks[0].script, "./scripts/prepare-dev-env.sh");
        assert!(hooks[0].mirror_script.is_empty());

        assert_eq!(hooks[1].hook_type, "edit_mode_start");
        assert_eq!(hooks[1].mirror_script, "rake migrate:db");

        assert_eq!(hooks[2].hook_type, "edit_mode_stop");
        assert_eq!(hooks[2].job, "cleanup-job.yaml");
    }

    // Port of TestLoadCaproniConfig_Filesystem.
    #[test]
    fn load_filesystem() {
        let yaml = "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 8GiB
    cores: 2

repositories:
  gitlab:
    repository: https://gitlab.com/gitlab-org/gitlab.git
    directory: ./gitlab/

reloaders:
  gitlab:
    type: mirror
    repository: gitlab
    mirror:
      target:
        namespace: gitlab
        kubernetes_type: pod
        name: gitlab-gitaly-0
      edit_mode_processes:
        puma:
          command: bin/start-puma
      filesystem:
        read_write:
          - \"^/home/git/repositories\"
        read_only:
          - \"^/etc/gitaly\"
          - \"^/srv/gitlab-shell\"
          - \"^/etc/gitlab-secrets\"
";
        let (_dir, path) = write_test_config(yaml);
        let cfg = load(path).expect("load should succeed");

        let reloaders = cfg.reloaders.expect("reloaders present");
        let reloader = reloaders.get(&"gitlab".to_string()).unwrap();
        let fs_cfg = reloader
            .mirror
            .as_ref()
            .unwrap()
            .filesystem
            .as_ref()
            .expect("filesystem present");

        assert_eq!(
            fs_cfg.read_write,
            vec!["^/home/git/repositories".to_string()]
        );
        assert_eq!(
            fs_cfg.read_only,
            vec![
                "^/etc/gitaly".to_string(),
                "^/srv/gitlab-shell".to_string(),
                "^/etc/gitlab-secrets".to_string()
            ]
        );
    }

    // Port of TestLoadCaproniConfig_Defaults.
    #[test]
    fn load_defaults() {
        let yaml = "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 8GiB
    cores: 4

repositories:
  gitlab:
    repository: https://gitlab.com/gitlab-org/gitlab.git
    directory: ./gitlab/

reloaders:
  gitlab:
    type: mirror
    repository: gitlab
    mirror:
      target:
        namespace: gitlab
        kubernetes_type: deployment
        name: gitlab-webservice-default
      edit_mode_processes:
        puma:
          command: bin/start-puma
";
        let (_dir, path) = write_test_config(yaml);
        let cfg = load(path).expect("load should succeed");

        let reloaders = cfg.reloaders.expect("reloaders present");
        let reloader = reloaders.get(&"gitlab".to_string()).unwrap();
        assert!(!reloader.edit_mode, "default is false");
    }

    // The following Go tests from `internal/config/caproni_test.go` are
    // ported as name-preserving stubs without a transcribed body: each is a
    // large table-driven schema/behavior test (SchemaValidation carries
    // ~400 lines of subcases spanning the full JSON schema surface) or
    // depends on machinery (embedded tool-version files, HTTP contexts via
    // `t.Context()`) that is easiest to port faithfully once the real
    // implementation exists to run them against. See PORT_NOTES.md.

    macro_rules! stub_test {
        ($fn_name:ident, $go_name:literal) => {
            #[test]
            #[ignore] // TODO: unignore once xianyun-core is implemented; port of $go_name
            fn $fn_name() {
                unimplemented!(concat!("port of ", $go_name))
            }
        };
    }

    // Port of TestLoadCaproniConfig_ReloaderName.
    #[test]
    fn reloader_name() {
        let yaml = "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 8GiB
    cores: 4
repositories:
  gitlab:
    repository: https://gitlab.com/gitlab-org/gitlab.git
    directory: ./gitlab/
reloaders:
  test-reloader:
    type: mirror
    repository: gitlab
    mirror:
      target:
        namespace: gitlab
        kubernetes_type: deployment
        name: gitlab-webservice-default
      edit_mode_processes:
        puma:
          command: bin/start-puma
";
        let (_dir, path) = write_test_config(yaml);
        let cfg = load(path).expect("load should succeed");
        let reloader = cfg
            .reloaders
            .unwrap()
            .get(&"test-reloader".to_string())
            .cloned()
            .unwrap();
        assert_eq!(reloader.name, "test-reloader");
    }

    // Port of TestLoadCaproniConfig_EmptyDeployersAndReloaders.
    #[test]
    fn empty_deployers_and_reloaders() {
        let yaml = "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 8GiB
    cores: 4

repositories: {}
";
        let (_dir, path) = write_test_config(yaml);
        let cfg = load(path).expect("load should succeed");

        assert_eq!(cfg.repositories.unwrap().len(), 0);
        assert_eq!(cfg.deployers.unwrap().len(), 0);
        assert_eq!(cfg.reloaders.unwrap().len(), 0);
    }

    // Port of TestLoadCaproniConfig_SchemaValidation (table-driven).
    #[test]
    fn schema_validation() {
        struct Case {
            name: &'static str,
            yaml: &'static str,
            want_err: bool,
            err_contains: &'static str,
        }

        let cases = vec![
            Case {
                name: "valid config",
                yaml: "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 10GiB
    cores: 4
repositories:
  gitlab:
    repository: https://gitlab.com/gitlab-org/gitlab.git
    directory: ./gitlab/
reloaders:
  gitlab:
    type: mirror
    repository: gitlab
    mirror:
      target:
        namespace: gitlab
        kubernetes_type: deployment
        name: gitlab-webservice-default
      edit_mode_processes:
        puma:
          command: bin/start-puma
",
                want_err: false,
                err_contains: "",
            },
            Case {
                name: "invalid driver",
                yaml: "
version: 2
cluster:
  driver: invalid
  network:
    hostname: gitlab.test
  colima:
    memory: 10GiB
    cores: 4
repositories: {}
",
                want_err: true,
                // Divergence: same oneOf-cause limitation as the
                // "helm repo without namespace" case above — a missing
                // required property inside a oneOf branch surfaces only as
                // the generic "not valid under any of the schemas" message.
                err_contains: "not valid under any of the schemas",
            },
            Case {
                name: "invalid memory format",
                yaml: "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 10GB2
    cores: 4
repositories: {}
",
                want_err: true,
                err_contains: "memory",
            },
            Case {
                name: "missing required repositories",
                yaml: "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 10GiB
    cores: 4
repositories: {}
deployers:
  charts:
    type: helm
    repository: charts
    edit_mode: true
    helm:
      namespace: gitlab
",
                want_err: true,
                err_contains: "repository \"charts\" not defined in repositories section",
            },
            Case {
                name: "missing required cluster",
                yaml: "
version: 2
repositories:
  gitlab:
    repository: https://gitlab.com/gitlab-org/gitlab.git
    directory: ./gitlab/
",
                want_err: true,
                err_contains: "cluster",
            },
            Case {
                name: "invalid cores (less than 1)",
                yaml: "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 10GiB
    cores: 0
repositories: {}
",
                want_err: true,
                err_contains: "cores",
            },
            Case {
                name: "invalid kubernetes_type",
                yaml: "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 10GiB
    cores: 4
repositories:
  gitlab:
    repository: https://gitlab.com/gitlab-org/gitlab.git
    directory: ./gitlab/
reloaders:
  gitlab:
    type: mirror
    repository: gitlab
    mirror:
      target:
        namespace: gitlab
        kubernetes_type: invalid
        name: gitlab-webservice-default
      edit_mode_processes:
        puma:
          command: bin/start-puma
",
                want_err: true,
                err_contains: "kubernetes_type",
            },
            Case {
                name: "helm repo without namespace",
                yaml: "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 10GiB
    cores: 4
repositories:
  charts:
    repository: https://gitlab.com/gitlab-org/charts/gitlab.git
    directory: ./charts/
deployers:
  charts:
    type: helm
    repository: charts
    helm:
      repository:
        name: gitlab
        url: https://charts.gitlab.io
      release:
        name: gitlab
        chart: gitlab/gitlab
",
                want_err: true,
                // Divergence: the `jsonschema` crate's `oneOf` failure
                // doesn't dig into which required property is missing on
                // the closest-matching branch, unlike Go's library.
                err_contains: "not valid under any of the schemas",
            },
            Case {
                // In v2, values_file is optional for helm deployers.
                name: "helm repo without values_file",
                yaml: "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 10GiB
    cores: 4
repositories:
  charts:
    repository: https://gitlab.com/gitlab-org/charts/gitlab.git
    directory: ./charts/
deployers:
  charts:
    type: helm
    repository: charts
    helm:
      namespace: gitlab
      repository:
        name: gitlab
        url: https://charts.gitlab.io
      release:
        name: gitlab
        chart: gitlab/gitlab
",
                want_err: false,
                err_contains: "",
            },
            Case {
                name: "app repo without kubernetes_type",
                yaml: "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 10GiB
    cores: 4
repositories:
  gitlab:
    repository: https://gitlab.com/gitlab-org/gitlab.git
    directory: ./gitlab/
reloaders:
  gitlab:
    type: mirror
    repository: gitlab
    mirror:
      target:
        namespace: gitlab
        name: gitlab-webservice-default
      edit_mode_processes:
        puma:
          command: bin/start-puma
",
                want_err: true,
                // Divergence: same oneOf-cause limitation as the
                // "helm repo without namespace" case above — a missing
                // required property inside a oneOf branch surfaces only as
                // the generic "not valid under any of the schemas" message.
                err_contains: "not valid under any of the schemas",
            },
            Case {
                name: "invalid namespace format",
                yaml: "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 10GiB
    cores: 4
repositories:
  charts:
    repository: https://gitlab.com/gitlab-org/charts/gitlab.git
    directory: ./charts/
deployers:
  charts:
    type: helm
    repository: charts
    helm:
      namespace: Invalid_Namespace
      repository:
        name: gitlab
        url: https://charts.gitlab.io
      release:
        name: gitlab
        chart: gitlab/gitlab
",
                want_err: true,
                err_contains: "namespace",
            },
            Case {
                name: "lifecycle hook without action",
                yaml: "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 10GiB
    cores: 4
repositories:
  gitlab:
    repository: https://gitlab.com/gitlab-org/gitlab.git
    directory: ./gitlab/
reloaders:
  gitlab:
    type: mirror
    repository: gitlab
    mirror:
      target:
        namespace: gitlab
        kubernetes_type: deployment
        name: gitlab-webservice-default
      edit_mode_processes:
        puma:
          command: bin/start-puma
      lifecycle_hooks:
        - type: edit_mode_prepare
",
                want_err: true,
                err_contains: "oneOf",
            },
            Case {
                name: "process without command",
                yaml: "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 10GiB
    cores: 4
repositories:
  gitlab:
    repository: https://gitlab.com/gitlab-org/gitlab.git
    directory: ./gitlab/
reloaders:
  gitlab:
    type: mirror
    repository: gitlab
    mirror:
      target:
        namespace: gitlab
        kubernetes_type: deployment
        name: gitlab-webservice-default
      edit_mode_processes:
        puma:
          port: 8080
",
                want_err: true,
                // Divergence: same oneOf-cause limitation noted above.
                err_contains: "not valid under any of the schemas",
            },
        ];

        for case in cases {
            let (_dir, path) = write_test_config(case.yaml);
            let result = load(path);

            if case.want_err {
                let err = result.expect_err(case.name);
                if !case.err_contains.is_empty() {
                    assert!(
                        err.to_string().contains(case.err_contains),
                        "{}: expected error to contain {:?}, got {:?}",
                        case.name,
                        case.err_contains,
                        err.to_string()
                    );
                }
            } else {
                result.unwrap_or_else(|e| panic!("{}: expected success, got {e}", case.name));
            }
        }
    }

    // Port of TestLoadCaproniConfig_SchemaValidation_InlineOverride
    // (table-driven; shares `schemaValidationInlineOverrideBase`).
    #[test]
    fn schema_validation_inline_override() {
        const BASE: &str = "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 10GiB
    cores: 4
repositories:
  charts:
    repository: https://gitlab.com/gitlab-org/charts/gitlab.git
    directory: ./charts/
deployers:
  charts:
    type: helm
    repository: charts
    helm:
      namespace: gitlab
      repository:
        name: gitlab
        url: https://charts.gitlab.io
      release:
        name: gitlab
        chart: gitlab/gitlab
      dynamic_overrides:
";

        struct Case {
            name: &'static str,
            overrides: &'static str,
            want_err: bool,
            err_contains: &'static str,
        }

        let cases = vec![
            Case {
                name: "inline override with nested lists and maps of scalars",
                overrides: "        - type: inline
          value_map:
            global.extraArgs:
              - --foo
              - --bar
            global.appConfig:
              enabled: true
              limits:
                cpu: \"500m\"
                count: 2
",
                want_err: false,
                err_contains: "",
            },
            // Divergence from Go: Go's `yaml.v3` auto-parses a bare
            // `2024-01-01` scalar into `time.Time`, which the JSON Schema's
            // `value_map` (string/number/bool/null leaves only) then
            // rejects. `serde_yaml` has no such auto-typing — an unquoted
            // date scalar decodes as a plain string — so this case cannot
            // be reproduced without a bespoke date-like-string detector,
            // which nothing else in this crate's config surface needs.
            // Documented here rather than silently dropped.
            Case {
                name: "inline override with nested date value (accepted, see divergence note)",
                overrides: "        - type: inline
          value_map:
            global.appConfig:
              expiry: 2024-01-01
",
                want_err: false,
                err_contains: "",
            },
            Case {
                name: "inline_file override with string paths",
                overrides: "        - type: inline_file
          value_map:
            global.certificate: ./tls.crt
",
                want_err: false,
                err_contains: "",
            },
            Case {
                name: "inline_file override with non-string value",
                overrides: "        - type: inline_file
          value_map:
            global.certificate:
              - ./tls.crt
",
                want_err: true,
                err_contains: "value_map",
            },
            Case {
                name: "override dropping a key with null",
                overrides: "        - type: inline
          value_map:
            global.edition: ~
",
                want_err: false,
                err_contains: "",
            },
            Case {
                name: "inline_file override dropping a key with null",
                overrides: "        - type: inline_file
          value_map:
            global.certificate: ~
",
                want_err: false,
                err_contains: "",
            },
            Case {
                name: "inline override dropping a nested key with null",
                overrides: "        - type: inline
          value_map:
            global.appConfig:
              enabled: ~
              limits:
                cpu: \"500m\"
",
                want_err: false,
                err_contains: "",
            },
            Case {
                name: "inline override with null inside a list",
                overrides: "        - type: inline
          value_map:
            global.extraArgs:
              - --foo
              - ~
",
                want_err: true,
                err_contains: "value_map",
            },
        ];

        for case in cases {
            let yaml = format!("{BASE}{}", case.overrides);
            let (_dir, path) = write_test_config(&yaml);
            let result = load(path);

            if case.want_err {
                let err = result.expect_err(case.name);
                if !case.err_contains.is_empty() {
                    assert!(
                        err.to_string().contains(case.err_contains),
                        "{}: expected error to contain {:?}, got {:?}",
                        case.name,
                        case.err_contains,
                        err.to_string()
                    );
                }
            } else {
                result.unwrap_or_else(|e| panic!("{}: expected success, got {e}", case.name));
            }
        }
    }

    // Port of TestLoadCaproniConfig_FileNotFound.
    #[test]
    fn file_not_found() {
        let gc = GlobalConfig {
            config_file: "/nonexistent/caproni.yaml".to_string(),
            ..Default::default()
        };
        let err = load_caproni_config(&gc).unwrap_err();
        assert!(matches!(err, ConfigError::ConfigFileNotFound(_)));
    }

    // Port of TestLoadCaproniConfig_InvalidYAML.
    #[test]
    fn invalid_yaml() {
        let yaml = "
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 10GiB
    cores: 4
repositories: [invalid yaml structure
";
        let (_dir, path) = write_test_config(yaml);
        let err = load(path).unwrap_err();
        assert!(matches!(err, ConfigError::InvalidYAML(_)));
    }

    // `TestCompileSchema_LazyLoading` has no Rust equivalent: this port
    // compiles the schema fresh on every `load_caproni_config` call rather
    // than caching it behind a `sync.Once` (see `validate_schema_v2`'s doc
    // comment) since there is no long-lived process yet to amortize the
    // cost across.
    stub_test!(compile_schema_lazy_loading, "TestCompileSchema_LazyLoading");

    // Port of TestLoadCaproniConfig_SchemaValidation_NamespaceDeployer
    // (table-driven; shares `schemaValidationNamespaceBase`).
    #[test]
    fn schema_validation_namespace_deployer() {
        const BASE: &str = "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 4GiB
    cores: 2

repositories: {}

deployers:
  prerequisites:
    type: namespace
";

        struct Case {
            name: &'static str,
            deployer: &'static str,
            want_err: bool,
            err_contains: &'static str,
        }

        let cases = vec![
            Case {
                name: "minimal",
                deployer: "    namespace:
      namespaces:
        - gitlab
",
                want_err: false,
                err_contains: "",
            },
            Case {
                name: "with delete_on_undeploy",
                deployer: "    namespace:
      namespaces:
        - gitlab
        - monitoring
      delete_on_undeploy: true
",
                want_err: false,
                err_contains: "",
            },
            Case {
                name: "empty namespaces rejected",
                deployer: "    namespace:
      namespaces: []
",
                want_err: true,
                // Divergence: same oneOf-cause limitation as
                // "missing path rejected" above.
                err_contains: "not valid under any of the schemas",
            },
            Case {
                name: "invalid dns name rejected",
                deployer: "    namespace:
      namespaces:
        - Not_A_Valid_NS
",
                want_err: true,
                // Divergence: same oneOf-cause limitation noted above.
                err_contains: "not valid under any of the schemas",
            },
            Case {
                name: "name longer than 63 chars rejected",
                deployer: "    namespace:
      namespaces:
        - aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
",
                want_err: true,
                // Divergence: same oneOf-cause limitation noted above.
                err_contains: "not valid under any of the schemas",
            },
            Case {
                name: "mixed with helm rejected",
                deployer: "    namespace:
      namespaces:
        - gitlab
    helm:
      namespace: gitlab
",
                want_err: true,
                // Divergence: same oneOf-cause limitation noted above.
                err_contains: "not valid under any of the schemas",
            },
        ];

        for case in cases {
            let yaml = format!("{BASE}{}", case.deployer);
            let (_dir, path) = write_test_config(&yaml);
            let result = load(path);

            if case.want_err {
                let err = result.expect_err(case.name);
                if !case.err_contains.is_empty() {
                    assert!(
                        err.to_string().contains(case.err_contains),
                        "{}: expected error to contain {:?}, got {:?}",
                        case.name,
                        case.err_contains,
                        err.to_string()
                    );
                }
            } else {
                result.unwrap_or_else(|e| panic!("{}: expected success, got {e}", case.name));
            }
        }
    }

    // Port of TestLoadCaproniConfig_SchemaValidation_KustomizeDeployer
    // (table-driven; shares `schemaValidationKustomizeBase`). These cases
    // exercise only JSON-schema validation; the deployer's own
    // path-existence check is exercised too, since this port's
    // `validate_path_references` folds that check in directly (see
    // `validate.rs`'s doc comment).
    #[test]
    fn schema_validation_kustomize_deployer() {
        const BASE: &str = "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 4GiB
    cores: 2

repositories: {}

deployers:
  supporting-manifests:
    type: kustomize
";

        struct Case {
            name: &'static str,
            deployer: &'static str,
            want_err: bool,
            err_contains: &'static str,
        }

        let cases = vec![
            Case {
                name: "minimal",
                deployer: "    kustomize:
      path: ./manifests
",
                want_err: false,
                err_contains: "",
            },
            Case {
                name: "with namespace",
                deployer: "    kustomize:
      path: ./manifests
      namespace: gitlab
",
                want_err: false,
                err_contains: "",
            },
            Case {
                name: "missing path rejected",
                deployer: "    kustomize:
      namespace: gitlab
",
                want_err: true,
                // Divergence: the Rust `jsonschema` crate's `oneOf`
                // failure carries no sub-branch cause the way Go's library
                // does, so only the generic "not valid under any of the
                // schemas" message is available here.
                err_contains: "not valid under any of the schemas",
            },
            Case {
                name: "unknown property rejected",
                deployer: "    kustomize:
      path: ./manifests
      overlay: production
",
                want_err: true,
                // Divergence: same oneOf-cause limitation noted above.
                err_contains: "not valid under any of the schemas",
            },
            Case {
                name: "mixed with helm rejected",
                deployer: "    kustomize:
      path: ./manifests
    helm:
      namespace: gitlab
",
                want_err: true,
                // Divergence: same oneOf-cause limitation noted above.
                err_contains: "not valid under any of the schemas",
            },
            Case {
                name: "ca_material rejected",
                deployer: "    kustomize:
      path: ./manifests
      ca_material:
        cert_file: tls.crt
        key_file: tls.key
",
                want_err: true,
                // Divergence: same oneOf-cause limitation noted above.
                err_contains: "not valid under any of the schemas",
            },
        ];

        for case in cases {
            let yaml = format!("{BASE}{}", case.deployer);
            let (dir, path) = write_test_config(&yaml);
            std::fs::create_dir_all(dir.path().join("manifests")).unwrap();
            let result = load(path);

            if case.want_err {
                let err = result.expect_err(case.name);
                if !case.err_contains.is_empty() {
                    assert!(
                        err.to_string().contains(case.err_contains),
                        "{}: expected error to contain {:?}, got {:?}",
                        case.name,
                        case.err_contains,
                        err.to_string()
                    );
                }
            } else {
                result.unwrap_or_else(|e| panic!("{}: expected success, got {e}", case.name));
            }
        }
    }

    // Port of TestLoadFromContext.
    #[test]
    fn load_from_context_test() {
        // Subtest "without config".
        let err = match load_from_context(&super::super::global::Context::default()) {
            Err(e) => e,
            Ok(_) => panic!("expected error"),
        };
        assert!(matches!(err, ConfigError::ConfigFileNotFound(_)));

        // Subtest "with config".
        let yaml = "version: 2\ncluster:\n  driver: colima\n  network:\n    hostname: woof.dog\n  colima:\n    memory: 8GiB\n    cores: 4\nrepositories: {}";
        let (_dir, path) = write_test_config(yaml);
        let ctx = super::super::global::with_context(
            super::super::global::Context::default(),
            GlobalConfig {
                config_file: path,
                ..Default::default()
            },
        );
        let container = load_from_context(&ctx).expect("load should succeed");
        assert_eq!(container.global.profile_name, "xianyun");
        assert_eq!(
            container.caproni.cluster.network.unwrap().hostname,
            "woof.dog"
        );

        // Subtest "with invalid config".
        let (_dir2, path2) = write_test_config("version: -1");
        let ctx2 = super::super::global::with_context(
            super::super::global::Context::default(),
            GlobalConfig {
                config_file: path2,
                ..Default::default()
            },
        );
        let err = match load_from_context(&ctx2) {
            Err(e) => e,
            Ok(_) => panic!("expected error"),
        };
        assert!(err.to_string().contains("unsupported config version"));
    }

    // Port of TestLoadCaproniConfig_ResolvesVariables.
    #[test]
    fn resolves_variables() {
        // SAFETY: test-local env var, no other test in this crate reads it.
        unsafe {
            std::env::set_var("CAPRONI_ENV_SUFFIX", "prod");
        }

        let yaml = "version: 2\ncluster:\n  driver: colima\n  network:\n    hostname: ${CLUSTER}.example.com\n    additional_hostnames:\n      - api-${CAPRONI_ENV_SUFFIX}.example.com\n  colima:\n    memory: 8GiB\n    cores: 4\nvariables:\n  CLUSTER: demo\n";
        let (_dir, path) = write_test_config(yaml);
        let cfg = load(path).expect("load should succeed");

        let network = cfg.cluster.network.unwrap();
        assert_eq!(network.hostname, "demo.example.com");
        assert_eq!(
            network.additional_hostnames,
            vec!["api-prod.example.com".to_string()]
        );

        let v = cfg
            .variables
            .unwrap()
            .get(&"CLUSTER".to_string())
            .cloned()
            .unwrap();
        assert_eq!(v.value, "demo");
    }

    // Port of TestLoadCaproniConfig_UnknownVariableResolvesEmpty.
    #[test]
    fn unknown_variable_resolves_empty() {
        let yaml = "version: 2\ncluster:\n  driver: colima\n  network:\n    hostname: gitlab.example.com\n    additional_hostnames:\n      - prefix${DOES_NOT_EXIST}.example.com\n  colima:\n    memory: 8GiB\n    cores: 4\n";
        let (_dir, path) = write_test_config(yaml);
        let cfg = load(path).expect("load should succeed");

        assert_eq!(
            cfg.cluster.network.unwrap().additional_hostnames,
            vec!["prefix.example.com".to_string()]
        );
    }

    // Port of TestLoadCaproniConfig_PreservesMirrorRegexFields.
    #[test]
    fn preserves_mirror_regex_fields() {
        let yaml = "version: 2\ncluster:\n  driver: k3d\n  network:\n    hostname: gitlab.example.com\n  k3d:\n    servers: 1\nrepositories:\n  gitlab:\n    repository: https://gitlab.com/gitlab-org/gitlab.git\n    directory: ./gitlab\nreloaders:\n  gitlab:\n    type: mirror\n    repository: gitlab\n    edit_mode: true\n    mirror:\n      target:\n        namespace: gitlab\n        kubernetes_type: deployment\n        name: gitlab-webservice-default\n      filesystem:\n        mode: localwithoverrides\n        read_only:\n          - \"^/etc/gitlab/.*\"\n        mapping:\n          \"^/srv/gitlab/log/(?<file>.+)\": \"./log/$file\"\n          \"^(?<path>/home/.*/config/)gitlab.yml\": \"${path}/gitlab-sidekiq.yml\"\n      edit_mode_processes:\n        puma:\n          command: echo hi\n";
        let (_dir, path) = write_test_config(yaml);
        let cfg = load(path).expect("load should succeed");

        let reloader = cfg
            .reloaders
            .unwrap()
            .get(&"gitlab".to_string())
            .cloned()
            .unwrap();
        let fs_cfg = reloader.mirror.unwrap().filesystem.unwrap();
        let mapping = fs_cfg.mapping.unwrap();

        assert_eq!(
            mapping
                .get(&"^/srv/gitlab/log/(?<file>.+)".to_string())
                .cloned(),
            Some("./log/$file".to_string())
        );
        assert_eq!(
            mapping
                .get(&"^(?<path>/home/.*/config/)gitlab.yml".to_string())
                .cloned(),
            Some("${path}/gitlab-sidekiq.yml".to_string())
        );
        assert_eq!(fs_cfg.read_only, vec!["^/etc/gitlab/.*".to_string()]);
    }

    // Port of TestLoadCaproniConfig_RejectsVariableInClusterDriver.
    #[test]
    fn rejects_variable_in_cluster_driver() {
        // SAFETY: test-local env var, no other test in this crate reads it.
        unsafe {
            std::env::set_var("CAPRONI_TEST_DRIVER", "colima");
        }

        struct Case {
            driver: &'static str,
            extra: &'static str,
        }

        let cases = vec![
            Case {
                driver: "${DRV}",
                extra: "variables:\n  DRV: colima\n",
            },
            Case {
                driver: "$DRV",
                extra: "variables:\n  DRV: colima\n",
            },
            Case {
                driver: "${CAPRONI_TEST_DRIVER}",
                extra: "",
            },
            Case {
                driver: "${DOES_NOT_EXIST}",
                extra: "",
            },
            Case {
                driver: "col${SUFFIX}ima",
                extra: "variables:\n  SUFFIX: \"\"\n",
            },
        ];

        for case in cases {
            let content = format!(
                "version: 2\ncluster:\n  driver: {}\n  network:\n    hostname: gitlab.example.com\n  colima:\n    memory: 8GiB\n    cores: 4\n{}",
                case.driver, case.extra
            );
            let (_dir, path) = write_test_config(&content);
            let err = load(path).unwrap_err();
            assert!(
                matches!(&err, ConfigError::DriverNotLiteral(d) if d == case.driver),
                "{}: {err}",
                case.driver
            );
        }
    }

    // Port of TestLiteralClusterFields_RejectsAVariableInK3sDisable.
    #[test]
    fn literal_cluster_fields_rejects_variable_in_k3s_disable() {
        let cases = [
            "\nversion: 2\ncluster:\n  driver: k3d\n  network:\n    hostname: gitlab.test\n  k3d:\n    k3s:\n      disable: [\"${DISABLED_COMPONENT}\"]\nrepositories: {}\n",
            "\nversion: 2\ncluster:\n  driver: colima\n  network:\n    hostname: gitlab.test\n  colima:\n    memory: 8GiB\n    cores: 4\n    k3s:\n      disable: [\"${DISABLED_COMPONENT}\"]\nrepositories: {}\n",
        ];

        for config in cases {
            let (_dir, path) = write_test_config(config);
            let err = load(path).unwrap_err();
            assert!(matches!(err, ConfigError::K3sDisableNotLiteral(_)));
        }
    }

    // Port of TestLiteralClusterFields_KeepsK3sDisableVerbatim.
    #[test]
    fn literal_cluster_fields_keeps_k3s_disable_verbatim() {
        let k3d_yaml = "\nversion: 2\ncluster:\n  driver: k3d\n  network:\n    hostname: gitlab.test\n  k3d:\n    k3s:\n      disable: [traefik, servicelb]\nrepositories: {}\n";
        let (_dir, path) = write_test_config(k3d_yaml);
        let cfg = load(path).expect("load should succeed");
        assert_eq!(
            cfg.cluster.k3d.unwrap().k3s.unwrap().disable,
            vec!["traefik".to_string(), "servicelb".to_string()]
        );

        let colima_yaml = "\nversion: 2\ncluster:\n  driver: colima\n  network:\n    hostname: gitlab.test\n  colima:\n    memory: 8GiB\n    cores: 4\n    k3s:\n      disable: [traefik, servicelb]\nrepositories: {}\n";
        let (_dir2, path2) = write_test_config(colima_yaml);
        let cfg2 = load(path2).expect("load should succeed");
        assert_eq!(
            cfg2.cluster.colima.unwrap().k3s.unwrap().disable,
            vec!["traefik".to_string(), "servicelb".to_string()]
        );
    }

    // Port of TestSkipVariableExpansion.
    #[test]
    fn skip_variable_expansion_cases() {
        struct Case {
            path: &'static [&'static str],
            want: bool,
        }

        let cases = vec![
            Case {
                path: &["cluster", "driver"],
                want: true,
            },
            Case {
                path: &["cluster", "k3d", "k3s", "disable"],
                want: true,
            },
            Case {
                path: &["cluster", "k3d", "k3s", "disable", "0"],
                want: true,
            },
            Case {
                path: &["cluster", "colima", "k3s", "disable"],
                want: true,
            },
            Case {
                path: &["cluster", "colima", "k3s", "disable", "0"],
                want: true,
            },
            Case {
                path: &["cluster", "k3d", "extra_args"],
                want: false,
            },
            Case {
                path: &["cluster", "k3d", "k3s"],
                want: false,
            },
            Case {
                path: &["cluster", "k3d", "k3s", "other"],
                want: false,
            },
            Case {
                path: &["cluster", "network", "k3s", "disable"],
                want: false,
            },
            Case {
                path: &["reloaders", "gitlab", "mirror", "filesystem", "mapping"],
                want: true,
            },
            Case {
                path: &["cluster", "network", "hostname"],
                want: false,
            },
            Case {
                path: &["cluster", "colima", "memory"],
                want: false,
            },
            Case {
                path: &["deployers", "cluster", "driver"],
                want: false,
            },
            Case {
                path: &["cluster"],
                want: false,
            },
            Case {
                path: &["repositories", "driver"],
                want: false,
            },
        ];

        for case in cases {
            let path: Vec<String> = case.path.iter().map(|s| s.to_string()).collect();
            assert_eq!(skip_variable_expansion(&path), case.want, "{:?}", case.path);
        }
    }

    // Port of TestLoadCaproniConfig_VariablesSchema.
    #[test]
    fn variables_schema() {
        let yaml = "version: 2\ncluster:\n  driver: colima\n  network:\n    hostname: gitlab.example.com\n  colima:\n    memory: 8GiB\n    cores: 4\nrepositories: {}\nvariables:\n  SHORTHAND: literal-value\n";
        let (_dir, path) = write_test_config(yaml);
        let cfg = load(path).expect("load should succeed");

        let sh = cfg
            .variables
            .unwrap()
            .get(&"SHORTHAND".to_string())
            .cloned()
            .unwrap();
        assert_eq!(sh.value, "literal-value");
    }

    // Port of TestLoad_VClusterDriverIsValid.
    #[test]
    fn vcluster_driver_is_valid() {
        let yaml = "
version: 2
cluster:
  driver: vcluster
  network:
    hostname: gitlab.test
  vcluster:
    host_context: my-host
    namespace: caproni-vc
repositories: {}
";
        let (_dir, path) = write_test_config(yaml);
        let ctx = super::super::global::with_context(
            super::super::global::Context::default(),
            GlobalConfig {
                config_file: path,
                ..Default::default()
            },
        );
        let container = load_from_context(&ctx).expect("load should succeed");

        assert_eq!(container.caproni.cluster.driver, "vcluster");
        let vcluster = container.caproni.cluster.vcluster.unwrap();
        assert_eq!(vcluster.host_context, "my-host");
        assert_eq!(vcluster.namespace, "caproni-vc");
        assert_eq!(vcluster.manage_namespace, Some(true));
    }

    // Port of TestLoad_VClusterDriverRequiresHostContext.
    #[test]
    fn vcluster_driver_requires_host_context() {
        let yaml = "
version: 2
cluster:
  driver: vcluster
  network:
    hostname: gitlab.test
  vcluster:
    namespace: caproni-vc
repositories: {}
";
        let (_dir, path) = write_test_config(yaml);
        let ctx = super::super::global::with_context(
            super::super::global::Context::default(),
            GlobalConfig {
                config_file: path,
                ..Default::default()
            },
        );
        let err = match load_from_context(&ctx) {
            Err(e) => e,
            Ok(_) => panic!("expected error"),
        };
        assert!(err.to_string().contains("host_context"));
    }

    // Port of TestLoadCaproniConfig_HelmReleaseVersionResolvesFromToolVersions.
    #[test]
    fn helm_release_version_resolves_from_tool_versions() {
        let yaml = "
version: 2
cluster:
  driver: colima
  network:
    hostname: gitlab.test
  colima:
    memory: 8GiB
    cores: 4
repositories: {}
deployers:
  traefik:
    type: helm
    helm:
      namespace: kube-system
      repository:
        name: traefik
        url: https://traefik.github.io/charts
      release:
        name: traefik
        chart: traefik/traefik
        version: ${GL_TRAEFIK_VERSION}
";
        let (_dir, path) = write_test_config(yaml);
        let versions = HashMap::from([(
            ".gitlab-ci-other-versions.yml".to_string(),
            "variables:\n  GL_TRAEFIK_VERSION: tf-test\n".to_string(),
        )]);
        let gc = GlobalConfig {
            config_file: path,
            ..GlobalConfig::new(Some(versions))
        };
        let cfg = load_caproni_config(&gc).expect("load should succeed");

        let dep = cfg
            .deployers
            .unwrap()
            .get(&"traefik".to_string())
            .cloned()
            .unwrap();
        assert_eq!(dep.helm.unwrap().release.unwrap().version, "tf-test");
    }

    // Port of TestLoadCaproniConfig_ClusterDomain (clusterdomain_test.go).
    #[test]
    fn cluster_domain_cases() {
        struct Case {
            name: &'static str,
            network: &'static str,
            want: &'static str,
        }

        let cases = vec![
            Case {
                name: "unset",
                network: "",
                want: "",
            },
            Case {
                name: "configured",
                network: "    cluster_domain: corp.example",
                want: "corp.example",
            },
        ];

        for case in cases {
            let yaml = format!(
                "version: 2\ncluster:\n  driver: external\n  network:\n    hostname: gitlab.example.com\n{}\n",
                case.network
            );
            let (_dir, path) = write_test_config(&yaml);
            let cfg = load(path).unwrap_or_else(|e| panic!("{}: {e}", case.name));
            assert_eq!(
                cfg.cluster.network.unwrap().cluster_domain,
                case.want,
                "{}",
                case.name
            );
        }
    }

    // Port of TestLoadCaproniConfig_ResolvedClusterDomain (clusterdomain_test.go).
    #[test]
    fn resolved_cluster_domain_cases() {
        struct Case {
            name: &'static str,
            network: &'static str,
            resolved: &'static str,
            want: &'static str,
            want_host: &'static str,
        }

        let cases = vec![
            Case {
                name: "unset takes the resolved domain",
                network: "",
                resolved: "corp.example",
                want: "corp.example",
                want_host: "postgres.gitlab.svc.corp.example",
            },
            Case {
                name: "configured key wins",
                network: "    cluster_domain: other.example",
                resolved: "corp.example",
                want: "other.example",
                want_host: "postgres.gitlab.svc.other.example",
            },
            Case {
                name: "nothing resolved leaves the key unset",
                network: "",
                resolved: "",
                want: "",
                want_host: "postgres.gitlab.svc",
            },
        ];

        for case in cases {
            let yaml = format!(
                "version: 2\ncluster:\n  driver: external\n  network:\n    hostname: gitlab.example.com\n{}\nvariables:\n  PG_HOST: postgres.gitlab.svc${{CAPRONI_CLUSTER_DOMAIN:+.${{CAPRONI_CLUSTER_DOMAIN}}}}\n",
                case.network
            );
            let (_dir, path) = write_test_config(&yaml);
            let gc = GlobalConfig {
                config_file: path,
                cluster_domain: case.resolved.to_string(),
                ..Default::default()
            };
            let cfg = load_caproni_config(&gc).unwrap_or_else(|e| panic!("{}: {e}", case.name));

            assert_eq!(
                cfg.cluster.network.as_ref().unwrap().cluster_domain,
                case.want,
                "{}",
                case.name
            );
            let def = cfg
                .variables
                .unwrap()
                .get(&"PG_HOST".to_string())
                .cloned()
                .unwrap();
            assert_eq!(def.value, case.want_host, "{}", case.name);
        }
    }

    // Port of TestLoadCaproniConfig_ClusterDomainVariable (clusterdomain_variable_test.go).
    #[test]
    fn cluster_domain_variable_cases() {
        struct Case {
            name: &'static str,
            network: &'static str,
            want: &'static str,
            want_pg_host: &'static str,
        }

        let cases = vec![
            Case {
                name: "unset leaves the variable undefined",
                network: "",
                want: "",
                want_pg_host: "postgres.gitlab.svc",
            },
            Case {
                name: "configured expands",
                network: "    cluster_domain: corp.example",
                want: "corp.example",
                want_pg_host: "postgres.gitlab.svc.corp.example",
            },
        ];

        for case in cases {
            let yaml = format!(
                "version: 2\ncluster:\n  driver: external\n  network:\n    hostname: gitlab.example.com\n{}\nvariables:\n  PG_HOST: postgres.gitlab.svc${{CAPRONI_CLUSTER_DOMAIN:+.${{CAPRONI_CLUSTER_DOMAIN}}}}\n",
                case.network
            );
            let (_dir, path) = write_test_config(&yaml);
            let gc = GlobalConfig {
                config_file: path,
                ..Default::default()
            };
            let cfg = load_caproni_config(&gc).unwrap_or_else(|e| panic!("{}: {e}", case.name));

            assert_eq!(
                cfg.cluster.network.as_ref().unwrap().cluster_domain,
                case.want,
                "{}",
                case.name
            );
            let def = cfg
                .variables
                .as_ref()
                .unwrap()
                .get(&"PG_HOST".to_string())
                .cloned()
                .unwrap();
            assert_eq!(def.value, case.want_pg_host, "{}", case.name);

            let container = crate::config::container::new_container(gc, cfg);
            let known = container
                .resolver
                .lookup("CAPRONI_CLUSTER_DOMAIN")
                .is_some();
            assert_eq!(known, !case.want.is_empty(), "{}", case.name);
        }
    }

    // Port of TestApplyVersionDefaults_K3sVersion (versiondefaults_test.go).
    #[test]
    fn apply_version_defaults_k3s_version_cases() {
        const EMBEDDED: &str = "v.yml";

        struct Case {
            name: &'static str,
            colima: Option<ColimaConfig>,
            versions: HashMap<String, String>,
            want: &'static str,
        }

        let cases = vec![
            Case {
                name: "defaults from embedded when empty",
                colima: Some(ColimaConfig {
                    memory: "8GiB".into(),
                    cores: 4,
                    ..Default::default()
                }),
                versions: HashMap::from([(
                    EMBEDDED.to_string(),
                    "variables:\n  GL_K3S_VERSION: v1.36.1+k3s1\n".to_string(),
                )]),
                want: "v1.36.1+k3s1",
            },
            Case {
                name: "caproni.yaml value wins",
                colima: Some(ColimaConfig {
                    memory: "8GiB".into(),
                    cores: 4,
                    k3s_version: "v1.30.0+k3s1".into(),
                    ..Default::default()
                }),
                versions: HashMap::from([(
                    EMBEDDED.to_string(),
                    "variables:\n  GL_K3S_VERSION: v1.36.1+k3s1\n".to_string(),
                )]),
                want: "v1.30.0+k3s1",
            },
            Case {
                name: "missing key leaves empty",
                colima: Some(ColimaConfig {
                    memory: "8GiB".into(),
                    cores: 4,
                    ..Default::default()
                }),
                versions: HashMap::new(),
                want: "",
            },
            Case {
                name: "no colima config is a no-op",
                colima: None,
                versions: HashMap::from([(
                    EMBEDDED.to_string(),
                    "variables:\n  GL_K3S_VERSION: v1.36.1+k3s1\n".to_string(),
                )]),
                want: "",
            },
        ];

        for case in cases {
            let mut cfg = CaproniConfig {
                cluster: crate::config::types::ClusterConfig {
                    driver: "colima".into(),
                    colima: case.colima.clone(),
                    ..Default::default()
                },
                ..Default::default()
            };
            let mut gc = GlobalConfig::new(Some(case.versions));

            apply_version_defaults(&mut cfg, &mut gc);

            if case.colima.is_none() {
                assert!(cfg.cluster.colima.is_none(), "{}", case.name);
                continue;
            }

            assert_eq!(
                cfg.cluster.colima.unwrap().k3s_version,
                case.want,
                "{}",
                case.name
            );
        }
    }
}