config

type AppConfig struct {
	AppID      int64  `yaml:"app_id,omitempty"`
	PrivateKey string `yaml:"private_key,omitempty"`
	Org        string `yaml:"org"`

	DryWarnings struct {
		WarnUnmanagedTeams        bool `yaml:"warn_unmanaged_teams"`
		WarnMembersWithoutAnyTeam bool `yaml:"warn_members_without_any_team"`
		WarnUnmanagedRepos        bool `yaml:"warn_unmanaged_repos"`
		WarnUnmanagedCustomRoles  bool `yaml:"warn_unmanaged_custom_roles"`
		WarnUnmanagedRulesets     bool `yaml:"warn_unmanaged_rulesets"`
		WarnUnmanagedOwners       bool `yaml:"warn_unmanaged_owners"`
		WarnExcessCollaborators   bool `yaml:"warn_excess_collaborators"`
	} `yaml:"dry_warnings"`
	RemoveMembersWithoutTeam   bool `yaml:"remove_members_without_team"`
	DeleteUnconfiguredTeams    bool `yaml:"delete_unconfigured_teams"`
	DeleteUnmanagedRepos       bool `yaml:"delete_unmanaged_repos"`
	DeleteUnmanagedCustomRoles bool `yaml:"delete_unmanaged_custom_roles"`
	DeleteUnmanagedRulesets    bool `yaml:"delete_unmanaged_rulesets"`
	DeleteStaleCodeowners      bool `yaml:"delete_stale_codeowners"`
	CreateRepo                 bool `yaml:"create_repo"`

	// DemoteUnconfiguredOwners drops an organization owner that org.yaml does
	// not list back to plain member. Off by default, and inert unless
	// org.owners names at least one login: an empty list means "gomgr does not
	// manage owners here", never "this organization should have none". The
	// authenticated user is never demoted by their own run, because an
	// organization whose last owner demotes themselves cannot be repaired
	// through the API that did it.
	//
	// A demoted owner becomes an ordinary member, which puts them in reach of
	// RemoveMembersWithoutTeam on the same run if they belong to no team.
	DemoteUnconfiguredOwners bool `yaml:"demote_unconfigured_owners"`

	// RemoveExcessCollaborators revokes a direct repository grant that gives
	// someone more access than their team membership and the organization's
	// default repository permission already do.
	//
	// This is the one thing that closes the door the GitHub UI opens: a
	// repository's "add collaborator" button grants access that no YAML file
	// mentions, and no other part of gomgr looks at it. Revoking a direct
	// grant leaves team-derived access untouched, so someone who should have
	// push through a team keeps push; only the grant stapled on beside it goes.
	//
	// Off by default. With DryWarnings.WarnExcessCollaborators set instead,
	// the same grants are reported and left alone.
	RemoveExcessCollaborators bool `yaml:"remove_excess_collaborators"`

	// ArchiveUnmanagedRepos archives a repository no team names, instead of
	// leaving it alone.
	//
	// This is the reversible sibling of DeleteUnmanagedRepos, and the one to
	// reach for first. An archived repository can be un-archived by anyone with
	// admin on it; a deleted one is ninety days of GitHub support at best and
	// gone at worst. A configuration that has drifted — a repository created
	// last week that nobody has declared yet — costs an un-archive rather than
	// a restore request.
	//
	// If both this and DeleteUnmanagedRepos are set, this one wins and the
	// deletion is reported as skipped. Being wrong in the recoverable direction
	// is the point of having it.
	ArchiveUnmanagedRepos bool `yaml:"archive_unmanaged_repos"`

	// IgnoreArchived skips archived repositories when planning team permission
	// grants. GitHub refuses to change permissions on an archived repository,
	// so a configuration that still names one plans a grant that fails on every
	// run. Off by default, because silently skipping a repository is also a way
	// to not notice that it was archived out from under the config.
	IgnoreArchived bool `yaml:"ignore_archived"`

	// ReconcileVisibility allows gomgr to change the visibility of a repository
	// that already exists, and only one that explicitly declares a visibility.
	//
	// Off by default, and deliberately a second key rather than something an
	// org-wide default can trigger. Making a private repository public is the
	// most damaging thing this tool can do — a deleted repository can be
	// restored for ninety days, a disclosed one cannot be undisclosed — so it
	// takes a deliberate edit in two files, and can never happen to thirty-four
	// repositories because one line changed.
	ReconcileVisibility bool `yaml:"reconcile_visibility"`

	// SignOff is the identity used for the Signed-off-by trailer appended to
	// every commit gomgr writes, in "Name <email>" form. Set it when the org
	// enforces DCO — a ruleset with a commit_message_pattern rule requiring
	// "Signed-off-by:" rejects gomgr's file-sync pushes otherwise, because
	// those commits go straight to the default branch and never pass through
	// a pull request where a DCO check could run.
	//
	// Empty (the default) appends nothing, preserving prior behavior for orgs
	// that do not require sign-off.
	SignOff string `yaml:"sign_off,omitempty"`

	// FileChanges controls how gomgr lands the files it writes.
	FileChanges FileChangeConfig `yaml:"file_changes,omitempty"`

	// Files declares templated files that should exist in every managed
	// repository. Each entry's Content is rendered through text/template with
	// {Org, Repo} context. Only (optional) limits which repos an entry applies
	// to via path.Match-style globs.
	Files []FileSpec `yaml:"files,omitempty"`

	// Legacy convenience flags. These are still honored but are materialized
	// into Files entries at load time. Prefer Files for new configurations.
	AddRenovateConfig bool   `yaml:"add_renovate_config,omitempty"`
	RenovateConfig    string `yaml:"renovate_config,omitempty"`
	AddDefaultReadme  bool   `yaml:"add_default_readme,omitempty"`
}

type BypassActorConfig struct {
	Type    string `yaml:"type"`
	Team    string `yaml:"team,omitempty"`
	App     string `yaml:"app,omitempty"`
	ActorID int64  `yaml:"actor_id,omitempty"`
	Mode    string `yaml:"mode,omitempty"` // always|pull_request (default always)
}

type CodeScanningRule struct {
	Tools []CodeScanningTool `yaml:"tools"`
}

type CodeScanningTool struct {
	Tool                    string `yaml:"tool"`
	AlertsThreshold         string `yaml:"alerts_threshold,omitempty"`          // none|errors|errors_and_warnings|all
	SecurityAlertsThreshold string `yaml:"security_alerts_threshold,omitempty"` // none|critical|high_or_higher|medium_or_higher|all
}

type ConfigError struct {
	Where string
	Msg   string
}

type CustomRoleConfig struct {
	Name        string   `yaml:"name"`
	Description string   `yaml:"description,omitempty"`
	BaseRole    string   `yaml:"base_role"` // read, triage, write, maintain, admin
	Permissions []string `yaml:"permissions,omitempty"`
}

type FileChangeConfig struct {
	// Strategy is auto (default), direct, or pull_request.
	Strategy string `yaml:"strategy,omitempty"`
	// Branch is the head branch gomgr opens its pull requests from. One branch
	// is reused per repository, so a repeated sync updates the open pull
	// request rather than opening another.
	Branch string `yaml:"branch,omitempty"`
}

type FileExtensionRestrictionRule struct {
	RestrictedFileExtensions []string `yaml:"restricted_file_extensions"`
}

type FilePathRestrictionRule struct {
	RestrictedFilePaths []string `yaml:"restricted_file_paths"`
}

type FileSpec struct {
	Path      string   `yaml:"path"`
	Content   string   `yaml:"content"`
	Message   string   `yaml:"message,omitempty"`
	Branch    string   `yaml:"branch,omitempty"`
	Only      []string `yaml:"only,omitempty"`
	Reconcile bool     `yaml:"reconcile,omitempty"`
}

type MergeQueueRule struct {
	MergeMethod                  string `yaml:"merge_method,omitempty"`      // merge|squash|rebase
	GroupingStrategy             string `yaml:"grouping_strategy,omitempty"` // allgreen|headgreen
	CheckResponseTimeoutMinutes  int    `yaml:"check_response_timeout_minutes,omitempty"`
	MaxEntriesToBuild            int    `yaml:"max_entries_to_build,omitempty"`
	MaxEntriesToMerge            int    `yaml:"max_entries_to_merge,omitempty"`
	MinEntriesToMerge            int    `yaml:"min_entries_to_merge,omitempty"`
	MinEntriesToMergeWaitMinutes int    `yaml:"min_entries_to_merge_wait_minutes,omitempty"`
}

type OrgConfig struct {
	Owners      []string           `yaml:"owners"`
	CustomRoles []CustomRoleConfig `yaml:"custom_roles,omitempty"`

	// RepoDefaults are the repository settings every managed repository gets
	// unless its own entry in teams/*.yaml overrides them. Visibility is not
	// among them on purpose: see AppConfig.ReconcileVisibility.
	RepoDefaults RepoSettingsConfig `yaml:"repo_defaults,omitempty"`

	// Rulesets declares organization-wide rulesets — the guard rails that
	// apply across repositories, narrowed by their repository_name conditions.
	// Repository-specific rulesets live on the repository entry in teams/*.yaml
	// and stack on top of these; GitHub evaluates every ruleset that matches and
	// enforces the strictest outcome.
	Rulesets []RulesetConfig `yaml:"rulesets,omitempty"`
}

type OrgDir struct {
	// Dir is the path to the directory holding app.yaml.
	Dir string
	// Org is the `org:` key from that app.yaml, lowercased. Empty when the
	// file parses but names no organization.
	Org string
}

type PatternRule struct {
	Name     string `yaml:"name,omitempty"`
	Operator string `yaml:"operator"` // starts_with|ends_with|contains|regex
	Pattern  string `yaml:"pattern"`
	Negate   *bool  `yaml:"negate,omitempty"`
}

type PullRequestRule struct {
	RequiredApprovingReviewCount   int      `yaml:"required_approving_review_count,omitempty"`
	DismissStaleReviewsOnPush      bool     `yaml:"dismiss_stale_reviews_on_push,omitempty"`
	RequireCodeOwnerReview         bool     `yaml:"require_code_owner_review,omitempty"`
	RequireLastPushApproval        bool     `yaml:"require_last_push_approval,omitempty"`
	RequiredReviewThreadResolution bool     `yaml:"required_review_thread_resolution,omitempty"`
	AllowedMergeMethods            []string `yaml:"allowed_merge_methods,omitempty"` // merge|squash|rebase
}

type RefNameCondition struct {
	Include []string `yaml:"include,omitempty"`
	Exclude []string `yaml:"exclude,omitempty"`
}

type RepoConfig struct {
	Permission string `yaml:"permission,omitempty"` // pull|triage|push|maintain|admin

	// Archived declares whether this repository should be archived. It is a
	// pointer because omitting it and setting it to false are different
	// instructions: an absent key leaves GitHub's state alone, so a repository
	// somebody archived by hand stays archived until a configuration says
	// otherwise in as many words. Un-archiving never happens by omission.
	Archived   *bool              `yaml:"archived,omitempty"`
	Topics     []string           `yaml:"topics,omitempty"`
	Pinned     bool               `yaml:"pinned,omitempty"`
	Rulesets   []RulesetConfig    `yaml:"rulesets,omitempty"`
	Settings   RepoSettingsConfig `yaml:"settings,omitempty"`
	Visibility string             `yaml:"visibility,omitempty"` // public|private|internal

	// Files are this repository's own templated files. An entry here replaces
	// the app.files entry with the same path for this repository alone, so an
	// exception is stated by naming the repository rather than by relying on
	// where it sits in a list.
	Files []FileSpec `yaml:"files,omitempty"`
}

type RepoSettingsConfig struct {
	AllowAutoMerge      *bool `yaml:"allow_auto_merge,omitempty"`
	AllowSquashMerge    *bool `yaml:"allow_squash_merge,omitempty"`
	AllowMergeCommit    *bool `yaml:"allow_merge_commit,omitempty"`
	AllowRebaseMerge    *bool `yaml:"allow_rebase_merge,omitempty"`
	DeleteBranchOnMerge *bool `yaml:"delete_branch_on_merge,omitempty"`
	AllowUpdateBranch   *bool `yaml:"allow_update_branch,omitempty"`

	// Security analyses. GitHub keeps these in a nested security_and_analysis
	// object and reports each as a status string rather than a flag, but they
	// behave like every other setting here: stating one asks for it, omitting
	// one leaves GitHub's state alone.
	//
	// Secret scanning and push protection are free on public repositories and
	// need GitHub Advanced Security on private ones, so a private repository
	// in an organization without it will be refused by the API.
	//
	// Deliberately absent: advanced_security and code_security. Those turn
	// GHAS itself on, which is a billing decision rather than a hygiene one,
	// and gomgr does not spend money on your behalf. secret_scanning_ai_
	// detection and secret_scanning_non_provider_patterns are absent because
	// go-github does not model them yet.
	SecretScanning               *bool `yaml:"secret_scanning,omitempty"`
	SecretScanningPushProtection *bool `yaml:"secret_scanning_push_protection,omitempty"`
	SecretScanningValidityChecks *bool `yaml:"secret_scanning_validity_checks,omitempty"`
	DependabotSecurityUpdates    *bool `yaml:"dependabot_security_updates,omitempty"`
}

type ReposFile struct {
	Repos map[string]any `yaml:"repos"`
}

type RepositoryNameCondition struct {
	Include   []string `yaml:"include,omitempty"`
	Exclude   []string `yaml:"exclude,omitempty"`
	Protected *bool    `yaml:"protected,omitempty"`
}

type RequiredDeploymentsRule struct {
	Environments []string `yaml:"environments"`
}

type RequiredStatusChecksRule struct {
	Checks               []StatusCheck `yaml:"checks"`
	Strict               bool          `yaml:"strict,omitempty"`
	DoNotEnforceOnCreate *bool         `yaml:"do_not_enforce_on_create,omitempty"`
}

type Root struct {
	App  AppConfig    `yaml:"app"`
	Org  OrgConfig    `yaml:"org"`
	Team []TeamConfig `yaml:"teams"`

	// Repos are repository definitions from repos.yaml: everything about a
	// repository that is not some team's permission on it. Values take the same
	// shape as an advanced entry under a team's `repositories:`, minus
	// `permission`, which belongs to the (team, repo) pair rather than to the
	// repository.
	//
	// A repository may be defined here or in a team file, but not in both — see
	// ReposFile.
	Repos map[string]any
}

type RuleWorkflow struct {
	Path         string `yaml:"path"`
	Repository   string `yaml:"repository,omitempty"` // repo name in this org; resolved to an ID
	RepositoryID *int64 `yaml:"repository_id,omitempty"`
	Ref          string `yaml:"ref,omitempty"`
	SHA          string `yaml:"sha,omitempty"`
}

type RulesetConditions struct {
	RefName        *RefNameCondition        `yaml:"ref_name,omitempty"`
	RepositoryName *RepositoryNameCondition `yaml:"repository_name,omitempty"`
}

type RulesetConfig struct {
	Name         string              `yaml:"name"`
	Preset       string              `yaml:"preset,omitempty"`
	Target       string              `yaml:"target,omitempty"`      // branch|tag|push (default branch)
	Enforcement  string              `yaml:"enforcement,omitempty"` // active|evaluate|disabled (default active)
	Conditions   *RulesetConditions  `yaml:"conditions,omitempty"`
	BypassActors []BypassActorConfig `yaml:"bypass_actors,omitempty"`
	Rules        RulesetRules        `yaml:"rules,omitempty"`
}

type RulesetRules struct {
	// Branch and tag rules.
	Creation                 *bool                     `yaml:"creation,omitempty"`
	Update                   *UpdateRule               `yaml:"update,omitempty"`
	Deletion                 *bool                     `yaml:"deletion,omitempty"`
	RequiredLinearHistory    *bool                     `yaml:"required_linear_history,omitempty"`
	RequiredSignatures       *bool                     `yaml:"required_signatures,omitempty"`
	NonFastForward           *bool                     `yaml:"non_fast_forward,omitempty"`
	PullRequest              *PullRequestRule          `yaml:"pull_request,omitempty"`
	RequiredStatusChecks     *RequiredStatusChecksRule `yaml:"required_status_checks,omitempty"`
	RequiredDeployments      *RequiredDeploymentsRule  `yaml:"required_deployments,omitempty"`
	MergeQueue               *MergeQueueRule           `yaml:"merge_queue,omitempty"`
	CommitMessagePattern     *PatternRule              `yaml:"commit_message_pattern,omitempty"`
	CommitAuthorEmailPattern *PatternRule              `yaml:"commit_author_email_pattern,omitempty"`
	CommitterEmailPattern    *PatternRule              `yaml:"committer_email_pattern,omitempty"`
	BranchNamePattern        *PatternRule              `yaml:"branch_name_pattern,omitempty"`
	TagNamePattern           *PatternRule              `yaml:"tag_name_pattern,omitempty"`
	Workflows                *WorkflowsRule            `yaml:"workflows,omitempty"`
	CodeScanning             *CodeScanningRule         `yaml:"code_scanning,omitempty"`

	// Push rules. These require GitHub Enterprise Cloud on private repositories.
	FileExtensionRestriction *FileExtensionRestrictionRule `yaml:"file_extension_restriction,omitempty"`
	FilePathRestriction      *FilePathRestrictionRule      `yaml:"file_path_restriction,omitempty"`
	MaxFilePathLength        *int                          `yaml:"max_file_path_length,omitempty"`
	MaxFileSize              *int64                        `yaml:"max_file_size,omitempty"`
}

type RulesetScope string

type StatusCheck struct {
	Context       string `yaml:"context"`
	IntegrationID *int64 `yaml:"integration_id,omitempty"`
}

type TeamConfig struct {
	Name        string `yaml:"name"`
	Slug        string `yaml:"slug,omitempty"`
	Description string `yaml:"description,omitempty"`
	Privacy     string `yaml:"privacy,omitempty"` // closed, secret

	// Parents nests this team under another. GitHub allows exactly one parent,
	// so at most one entry is accepted; the field stays a list because it
	// always was one, and a config that wrote `parents: []` should keep
	// loading. The entry may be a team name or a slug — it is resolved to a
	// slug against the other teams in the config.
	//
	// Nesting grants access rather than membership: a child team inherits the
	// repository permissions of every team above it, while the members of the
	// two teams stay separate rosters. gomgr sets the relationship and lets
	// GitHub apply the inheritance; it does not write the parent's grants onto
	// the child.
	//
	// Neither a parent nor a child may be `secret` — GitHub rejects the
	// combination — which loader validation reports rather than discovering at
	// apply time.
	Parents []string `yaml:"parents,omitempty"`

	// NotificationSetting is "notifications_enabled" or
	// "notifications_disabled". Empty leaves GitHub's setting alone, which for
	// a team gomgr creates means enabled — so an org that wants its teams quiet
	// has to say so on every team, and a config that drops this field turns
	// notifications back on for everyone in it.
	NotificationSetting string `yaml:"notification_setting,omitempty"`

	Maintainers []string `yaml:"maintainers,omitempty"`
	Members     []string `yaml:"members,omitempty"`

	// repo => permission (pull|triage|push|maintain|admin) or RepoConfig for advanced settings
	// For backward compatibility, supports both:
	//   repositories:
	//     infra: maintain               # simple string permission
	//     api:                          # or advanced RepoConfig
	//       permission: push
	//       topics: [backend, api]
	//       pinned: true
	Repositories map[string]any `yaml:"repositories,omitempty"`
}

type UpdateRule struct {
	AllowsFetchAndMerge bool `yaml:"allows_fetch_and_merge,omitempty"`
}

type WorkflowsRule struct {
	Workflows            []RuleWorkflow `yaml:"workflows"`
	DoNotEnforceOnCreate *bool          `yaml:"do_not_enforce_on_create,omitempty"`
}