builder

type Artifact struct {
	Name     string
	Kind     string // binary | image | bundle | other
	Paths    []string
	Metadata map[string]any
}

type Builder interface {
	// Name returns the unique identifier used in ci.build.targets[].type.
	Name() string
	// Validate checks the Config without executing anything.
	Validate(cfg Config) error
	// Build executes the build and populates out with produced artifacts.
	Build(ctx context.Context, cfg Config, out *Outputs) error
	// SecurityLint inspects the config for supply-chain issues and returns
	// zero or more findings. It must not execute any build steps.
	SecurityLint(cfg Config) []Finding
}

type Config struct {
	TargetName string
	Path       string
	Fields     map[string]any
	Env        map[string]string
	Security   *SecurityConfig
}

type Finding struct {
	Severity string // info | warn | critical
	Message  string
	File     string
	Line     int
}

type Outputs struct {
	Artifacts []Artifact
}

type SecurityConfig struct {
	Hardened   bool
	SBOM       bool
	Provenance string
	NonRoot    bool
}