cigen

type BuildSpec struct {
	// Docker is true when a Dockerfile was detected.
	Docker bool `json:"docker"`
	// Image is the image name to build (if derivable).
	Image string `json:"image,omitempty"`
}

type CIPlan struct {
	// Project is the name of the project (derived from config or directory).
	Project string `json:"project"`
	// WfctlVersion is the wfctl version to pin in generated CI files.
	WfctlVersion string `json:"wfctl_version"`
	// DefaultBranch is the branch that triggers apply jobs.
	DefaultBranch string `json:"default_branch"`
	// Runner is the runner label used for GitHub Actions jobs.
	Runner string `json:"runner"`
	// PluginInstall is true when wfctl plugin install should be run before deploy.
	PluginInstall bool `json:"plugin_install"`
	// Build describes the build phase, or nil when no build is needed.
	Build *BuildSpec `json:"build,omitempty"`
	// Secrets is the union of all secret references needed by CI.
	Secrets []SecretRef `json:"secrets"`
	// Phases is the ordered list of deploy phases.
	Phases []DeployPhase `json:"phases"`
	// Migrations describes database migration config, or nil when none.
	Migrations *MigrationsSpec `json:"migrations,omitempty"`
	// Smoke describes the smoke test, or nil when no smoke test can be derived.
	Smoke *SmokeSpec `json:"smoke,omitempty"`
	// PlanGuard is true when a protected resource requires a plan-before-apply gate.
	PlanGuard bool `json:"plan_guard"`
	// Triggers describes which GitHub events trigger CI jobs.
	Triggers TriggerSpec `json:"triggers"`
	// Warnings is a list of non-fatal advisory messages surfaced to the operator.
	Warnings []string `json:"warnings"`
}

type DeployPhase struct {
	// Name is the human-readable phase name (e.g. "prereq", "deploy").
	Name string `json:"name"`
	// ConfigPath is the workflow config file for this phase.
	ConfigPath string `json:"config_path"`
	// Include is an optional list of module names to include in this phase.
	Include []string `json:"include,omitempty"`
	// Secrets is the set of secrets this phase's apply job needs. Populated
	// only when Scoped is true; otherwise the renderer uses CIPlan.Secrets.
	Secrets []SecretRef `json:"secrets,omitempty"`
	// Scoped is true when per-phase secret derivation ran against a real,
	// loaded config for this phase. The renderer branches its env: source on
	// this flag — NOT on len(Secrets) — so a genuinely zero-secret scoped
	// phase emits no union, while an unscoped phase falls back to the union.
	Scoped bool `json:"scoped,omitempty"`
}

type MigrationsSpec struct {
	// DBEnv is the environment variable name that holds the database URL.
	DBEnv string `json:"db_env"`
	// Source is the migrations source directory.
	Source string `json:"source,omitempty"`
	// Env is the deploy environment name passed to `wfctl migrations up --env`.
	// Empty when no environment is configured; the --env flag is then omitted.
	Env string `json:"env,omitempty"`
}

type Options struct {
	// WfctlVersion is the version string to embed in the plan (e.g. "v0.66.0" or "latest").
	WfctlVersion string
	// DefaultBranch overrides the default branch (defaults to "main").
	DefaultBranch string
	// Runner overrides the GitHub Actions runner label (defaults to "ubuntu-latest").
	Runner string
	// PhaseConfig is an optional second config path that becomes a prereq DeployPhase
	// inserted before the main phase.
	PhaseConfig string
	// Project overrides the project name derived from the config file.
	Project string
	// ConfigPathAlias, when set, is used verbatim as the primary phase's
	// DeployPhase.ConfigPath instead of the real (possibly temporary or
	// absolute) filesystem path Analyze was handed. Callers that read the
	// config from a non-repo location — e.g. the MCP server, which writes
	// yaml_content to an os.CreateTemp file — MUST set this to a stable,
	// repo-relative logical name (e.g. "deploy.yaml" or the project name)
	// so generated CI steps and path filters reference a real checkout path
	// rather than a deleted /tmp file.
	ConfigPathAlias string
	// PhaseConfigAlias is the ConfigPathAlias equivalent for the prereq phase.
	// When set, it is used verbatim as the prereq DeployPhase.ConfigPath
	// instead of the relativized PhaseConfig filesystem path.
	PhaseConfigAlias string
}

type SecretRef struct {
	// Name is the secret name as it appears in the CI platform's secret store.
	Name string `json:"name"`
}

type SmokeSpec struct {
	// URL is the full URL to curl for a 2xx response.
	URL string `json:"url"`
	// Path is the HTTP path component (e.g. "/healthz").
	Path string `json:"path"`
}

type TriggerSpec struct {
	// PR triggers plan/lint jobs on pull requests.
	PR bool `json:"pr"`
	// PushMain triggers apply jobs on push to the default branch.
	PushMain bool `json:"push_main"`
	// Dispatch allows manual workflow_dispatch triggers.
	Dispatch bool `json:"dispatch"`
}

type ValidationFinding struct {
	Path    string `json:"path"`
	Code    string `json:"code"`
	Message string `json:"message"`
}