git

type Auth struct {
	// Token is an HTTPS personal-access / deploy token. It is sent as the basic-auth password
	// with a provider-specific username ("x-access-token" for GitHub, "oauth2" for GitLab,
	// "git" for Gitea and generic hosts).
	Token string
	// SSHPrivateKeyPEM is an unencrypted OpenSSH/PEM private key (ed25519 from
	// GenerateDeployKey) used for ssh:// and scp-like URLs.
	SSHPrivateKeyPEM []byte
	// SSHKnownHosts holds known_hosts lines pinning the server host key(s). When set, an
	// unknown or changed host key aborts the clone.
	SSHKnownHosts string
	// AllowUnknownHosts accepts any host key when SSHKnownHosts is empty, logging the accepted
	// fingerprint at WARN level. Dev mode only; production must pin known hosts.
	AllowUnknownHosts bool
}

type Checkout struct {
	// Dir is the repository root (the dest passed to Clone).
	Dir string
	// ContextDir is Dir/BaseDir (cleaned), verified to lie inside Dir after resolving symlinks.
	ContextDir string
	// HasDockerfile reports whether Source.Dockerfile exists under ContextDir. When false the
	// build package auto-generates one.
	HasDockerfile bool
	// DockerfilePath is the absolute Dockerfile path when HasDockerfile is true.
	DockerfilePath string
	CommitSHA      string
	CommitMessage  string
	Author         string
	// Bytes is the size of the working tree (regular files, .git excluded).
	Bytes int64
}

type Source struct {
	// URL is the repository URL (https://, ssh://, scp-like git@host:path).
	URL string
	// Branch is the short branch name; empty clones the remote HEAD.
	Branch string
	// BaseDir is the monorepo build-context path relative to the repository root ("" or "."
	// for the root).
	BaseDir string
	// Dockerfile is the Dockerfile path relative to BaseDir; empty means "Dockerfile".
	Dockerfile string
	// Auth holds the credentials, if any.
	Auth Auth
	// Provider selects the HTTPS token username (ProviderGitHub, …).
	Provider string
	// AllowLocal permits file:// URLs and absolute paths. Tests and demos only.
	AllowLocal bool
}