config

type AppConfig struct {
	AppID      int64  `yaml:"app_id,omitempty"`
	PrivateKey string `yaml:"private_key,omitempty"`
	Org        string `yaml:"org"`

	DryWarnings struct {
		WarnUnmanagedTeams        bool `yaml:"warn_unmanaged_teams"`
		WarnMembersWithoutAnyTeam bool `yaml:"warn_members_without_any_team"`
		WarnUnmanagedRepos        bool `yaml:"warn_unmanaged_repos"`
		WarnUnmanagedCustomRoles  bool `yaml:"warn_unmanaged_custom_roles"`
		WarnUnmanagedRulesets     bool `yaml:"warn_unmanaged_rulesets"`
	} `yaml:"dry_warnings"`
	RemoveMembersWithoutTeam   bool `yaml:"remove_members_without_team"`
	DeleteUnconfiguredTeams    bool `yaml:"delete_unconfigured_teams"`
	DeleteUnmanagedRepos       bool `yaml:"delete_unmanaged_repos"`
	DeleteUnmanagedCustomRoles bool `yaml:"delete_unmanaged_custom_roles"`
	DeleteUnmanagedRulesets    bool `yaml:"delete_unmanaged_rulesets"`
	DeleteStaleCodeowners      bool `yaml:"delete_stale_codeowners"`
	CreateRepo                 bool `yaml:"create_repo"`

	// SignOff is the identity used for the Signed-off-by trailer appended to
	// every commit gomgr writes, in "Name <email>" form. Set it when the org
	// enforces DCO — a ruleset with a commit_message_pattern rule requiring
	// "Signed-off-by:" rejects gomgr's file-sync pushes otherwise, because
	// those commits go straight to the default branch and never pass through
	// a pull request where a DCO check could run.
	//
	// Empty (the default) appends nothing, preserving prior behavior for orgs
	// that do not require sign-off.
	SignOff string `yaml:"sign_off,omitempty"`

	// Files declares templated files that should exist in every managed
	// repository. Each entry's Content is rendered through text/template with
	// {Org, Repo} context. Only (optional) limits which repos an entry applies
	// to via path.Match-style globs.
	Files []FileSpec `yaml:"files,omitempty"`

	// Legacy convenience flags. These are still honored but are materialized
	// into Files entries at load time. Prefer Files for new configurations.
	AddRenovateConfig bool   `yaml:"add_renovate_config,omitempty"`
	RenovateConfig    string `yaml:"renovate_config,omitempty"`
	AddDefaultReadme  bool   `yaml:"add_default_readme,omitempty"`
}

type BypassActorConfig struct {
	Type    string `yaml:"type"`
	Team    string `yaml:"team,omitempty"`
	App     string `yaml:"app,omitempty"`
	ActorID int64  `yaml:"actor_id,omitempty"`
	Mode    string `yaml:"mode,omitempty"` // always|pull_request (default always)
}

type CodeScanningRule struct {
	Tools []CodeScanningTool `yaml:"tools"`
}

type CodeScanningTool struct {
	Tool                    string `yaml:"tool"`
	AlertsThreshold         string `yaml:"alerts_threshold,omitempty"`          // none|errors|errors_and_warnings|all
	SecurityAlertsThreshold string `yaml:"security_alerts_threshold,omitempty"` // none|critical|high_or_higher|medium_or_higher|all
}

type CustomRoleConfig struct {
	Name        string   `yaml:"name"`
	Description string   `yaml:"description,omitempty"`
	BaseRole    string   `yaml:"base_role"` // read, triage, write, maintain, admin
	Permissions []string `yaml:"permissions,omitempty"`
}

type FileExtensionRestrictionRule struct {
	RestrictedFileExtensions []string `yaml:"restricted_file_extensions"`
}

type FilePathRestrictionRule struct {
	RestrictedFilePaths []string `yaml:"restricted_file_paths"`
}

type FileSpec struct {
	Path      string   `yaml:"path"`
	Content   string   `yaml:"content"`
	Message   string   `yaml:"message,omitempty"`
	Branch    string   `yaml:"branch,omitempty"`
	Only      []string `yaml:"only,omitempty"`
	Reconcile bool     `yaml:"reconcile,omitempty"`
}

type MergeQueueRule struct {
	MergeMethod                  string `yaml:"merge_method,omitempty"`      // merge|squash|rebase
	GroupingStrategy             string `yaml:"grouping_strategy,omitempty"` // allgreen|headgreen
	CheckResponseTimeoutMinutes  int    `yaml:"check_response_timeout_minutes,omitempty"`
	MaxEntriesToBuild            int    `yaml:"max_entries_to_build,omitempty"`
	MaxEntriesToMerge            int    `yaml:"max_entries_to_merge,omitempty"`
	MinEntriesToMerge            int    `yaml:"min_entries_to_merge,omitempty"`
	MinEntriesToMergeWaitMinutes int    `yaml:"min_entries_to_merge_wait_minutes,omitempty"`
}

type OrgConfig struct {
	Owners      []string           `yaml:"owners"`
	CustomRoles []CustomRoleConfig `yaml:"custom_roles,omitempty"`

	// Rulesets declares organization-wide rulesets — the guard rails that
	// apply across repositories, narrowed by their repository_name conditions.
	// Repository-specific rulesets live on the repository entry in teams/*.yaml
	// and stack on top of these; GitHub evaluates every ruleset that matches and
	// enforces the strictest outcome.
	Rulesets []RulesetConfig `yaml:"rulesets,omitempty"`
}

type PatternRule struct {
	Name     string `yaml:"name,omitempty"`
	Operator string `yaml:"operator"` // starts_with|ends_with|contains|regex
	Pattern  string `yaml:"pattern"`
	Negate   *bool  `yaml:"negate,omitempty"`
}

type PullRequestRule struct {
	RequiredApprovingReviewCount   int      `yaml:"required_approving_review_count,omitempty"`
	DismissStaleReviewsOnPush      bool     `yaml:"dismiss_stale_reviews_on_push,omitempty"`
	RequireCodeOwnerReview         bool     `yaml:"require_code_owner_review,omitempty"`
	RequireLastPushApproval        bool     `yaml:"require_last_push_approval,omitempty"`
	RequiredReviewThreadResolution bool     `yaml:"required_review_thread_resolution,omitempty"`
	AllowedMergeMethods            []string `yaml:"allowed_merge_methods,omitempty"` // merge|squash|rebase
}

type RefNameCondition struct {
	Include []string `yaml:"include,omitempty"`
	Exclude []string `yaml:"exclude,omitempty"`
}

type RepoConfig struct {
	Permission string          `yaml:"permission,omitempty"` // pull|triage|push|maintain|admin
	Topics     []string        `yaml:"topics,omitempty"`
	Pinned     bool            `yaml:"pinned,omitempty"`
	Rulesets   []RulesetConfig `yaml:"rulesets,omitempty"`
}

type RepositoryNameCondition struct {
	Include   []string `yaml:"include,omitempty"`
	Exclude   []string `yaml:"exclude,omitempty"`
	Protected *bool    `yaml:"protected,omitempty"`
}

type RequiredDeploymentsRule struct {
	Environments []string `yaml:"environments"`
}

type RequiredStatusChecksRule struct {
	Checks               []StatusCheck `yaml:"checks"`
	Strict               bool          `yaml:"strict,omitempty"`
	DoNotEnforceOnCreate *bool         `yaml:"do_not_enforce_on_create,omitempty"`
}

type Root struct {
	App  AppConfig    `yaml:"app"`
	Org  OrgConfig    `yaml:"org"`
	Team []TeamConfig `yaml:"teams"`
}

type RuleWorkflow struct {
	Path         string `yaml:"path"`
	Repository   string `yaml:"repository,omitempty"` // repo name in this org; resolved to an ID
	RepositoryID *int64 `yaml:"repository_id,omitempty"`
	Ref          string `yaml:"ref,omitempty"`
	SHA          string `yaml:"sha,omitempty"`
}

type RulesetConditions struct {
	RefName        *RefNameCondition        `yaml:"ref_name,omitempty"`
	RepositoryName *RepositoryNameCondition `yaml:"repository_name,omitempty"`
}

type RulesetConfig struct {
	Name         string              `yaml:"name"`
	Preset       string              `yaml:"preset,omitempty"`
	Target       string              `yaml:"target,omitempty"`      // branch|tag|push (default branch)
	Enforcement  string              `yaml:"enforcement,omitempty"` // active|evaluate|disabled (default active)
	Conditions   *RulesetConditions  `yaml:"conditions,omitempty"`
	BypassActors []BypassActorConfig `yaml:"bypass_actors,omitempty"`
	Rules        RulesetRules        `yaml:"rules,omitempty"`
}

type RulesetRules struct {
	// Branch and tag rules.
	Creation                 *bool                     `yaml:"creation,omitempty"`
	Update                   *UpdateRule               `yaml:"update,omitempty"`
	Deletion                 *bool                     `yaml:"deletion,omitempty"`
	RequiredLinearHistory    *bool                     `yaml:"required_linear_history,omitempty"`
	RequiredSignatures       *bool                     `yaml:"required_signatures,omitempty"`
	NonFastForward           *bool                     `yaml:"non_fast_forward,omitempty"`
	PullRequest              *PullRequestRule          `yaml:"pull_request,omitempty"`
	RequiredStatusChecks     *RequiredStatusChecksRule `yaml:"required_status_checks,omitempty"`
	RequiredDeployments      *RequiredDeploymentsRule  `yaml:"required_deployments,omitempty"`
	MergeQueue               *MergeQueueRule           `yaml:"merge_queue,omitempty"`
	CommitMessagePattern     *PatternRule              `yaml:"commit_message_pattern,omitempty"`
	CommitAuthorEmailPattern *PatternRule              `yaml:"commit_author_email_pattern,omitempty"`
	CommitterEmailPattern    *PatternRule              `yaml:"committer_email_pattern,omitempty"`
	BranchNamePattern        *PatternRule              `yaml:"branch_name_pattern,omitempty"`
	TagNamePattern           *PatternRule              `yaml:"tag_name_pattern,omitempty"`
	Workflows                *WorkflowsRule            `yaml:"workflows,omitempty"`
	CodeScanning             *CodeScanningRule         `yaml:"code_scanning,omitempty"`

	// Push rules. These require GitHub Enterprise Cloud on private repositories.
	FileExtensionRestriction *FileExtensionRestrictionRule `yaml:"file_extension_restriction,omitempty"`
	FilePathRestriction      *FilePathRestrictionRule      `yaml:"file_path_restriction,omitempty"`
	MaxFilePathLength        *int                          `yaml:"max_file_path_length,omitempty"`
	MaxFileSize              *int64                        `yaml:"max_file_size,omitempty"`
}

type RulesetScope string

type StatusCheck struct {
	Context       string `yaml:"context"`
	IntegrationID *int64 `yaml:"integration_id,omitempty"`
}

type TeamConfig struct {
	Name        string   `yaml:"name"`
	Slug        string   `yaml:"slug,omitempty"`
	Description string   `yaml:"description,omitempty"`
	Privacy     string   `yaml:"privacy,omitempty"` // closed, secret
	Parents     []string `yaml:"parents,omitempty"`

	Maintainers []string `yaml:"maintainers,omitempty"`
	Members     []string `yaml:"members,omitempty"`

	// repo => permission (pull|triage|push|maintain|admin) or RepoConfig for advanced settings
	// For backward compatibility, supports both:
	//   repositories:
	//     infra: maintain               # simple string permission
	//     api:                          # or advanced RepoConfig
	//       permission: push
	//       topics: [backend, api]
	//       pinned: true
	Repositories map[string]any `yaml:"repositories,omitempty"`
}

type UpdateRule struct {
	AllowsFetchAndMerge bool `yaml:"allows_fetch_and_merge,omitempty"`
}

type WorkflowsRule struct {
	Workflows            []RuleWorkflow `yaml:"workflows"`
	DoNotEnforceOnCreate *bool          `yaml:"do_not_enforce_on_create,omitempty"`
}