freshness

type Dependency struct {
	Name      string // e.g. "golang", "github.com/spf13/cobra", "react"
	Current   string // currently pinned version string
	Latest    string // latest available (filled by resolver)
	Ecosystem string // one of the Ecosystem* constants below
	File      string // relative path from repo root
	Line      int    // line number of the pinned version
	Indirect  bool   // e.g. go.mod // indirect
	SourceURL string // registry/API URL that was queried
	Binding   string // editable anchor used by source-specific updaters (e.g. ENV var name)

	// Vulnerability info populated by the OSV correlation pass.
	Vulnerabilities []VulnInfo // known CVEs affecting the current version

	// Advisory is an optional informational message set by the resolver
	// when a non-versioned or pre-release tag has stable releases available.
	Advisory string

	// Fields populated by the config/rule engine after resolution.
	// Used by future update commands for MR grouping and automerge.
	Group     string // assigned group name from package rules
	Automerge bool   // whether this dep's MR should automerge
}

type DigestEntry struct {
	Digest  string `yaml:"digest"`
	Checked string `yaml:"checked"`
}

type DigestLock struct {
	Digests map[string]DigestEntry `yaml:"digests"`
}

type DockerFreshnessInfo struct {
	Stages      []stageInfo
	EnvVars     map[string]envVar
	PinnedTools []pinnedTool
	ApkPackages []packageRef
	AptPackages []packageRef
	PipPackages []packageRef
}

type FreshnessConfig struct {
	Sources       SourceConfig   `json:"sources"`
	Severity      SeverityConfig `json:"severity"`
	Vulnerability VulnConfig     `json:"vulnerability"`
	Registries    RegistryConfig `json:"registries"`
	Ignore        []string       `json:"ignore"`
	PackageRules  []PackageRule  `json:"package_rules"`
	Groups        []Group        `json:"groups"`
	Timeout       int            `json:"timeout"`   // HTTP timeout in seconds (default 10)
	CacheTTLSecs  int            `json:"cache_ttl"` // cache TTL in seconds (default 300; 0 = cache forever; <0 = never cache)
}

type Group struct {
	Name                string `json:"name"`
	CommitMessagePrefix string `json:"commit_message_prefix"`
	Automerge           *bool  `json:"automerge"`      // group-level automerge default
	SeparateMajor       bool   `json:"separate_major"` // split major bumps into own MR
}

type PackageRule struct {
	// Pattern matching — all specified fields must match (AND logic).
	MatchPackages      []string `json:"match_packages"`      // glob patterns on dependency name
	MatchEcosystems    []string `json:"match_ecosystems"`    // ecosystem constants (docker-image, gomod, etc.)
	MatchUpdateTypes   []string `json:"match_update_types"`  // "major", "minor", "patch"
	MatchVulnerability *bool    `json:"match_vulnerability"` // true = only match deps with known CVEs

	// Overrides applied when matched.
	Enabled  *bool           `json:"enabled"`  // false = skip this dependency entirely
	Severity *SeverityConfig `json:"severity"` // override severity/tolerance for matched deps
	Group    string          `json:"group"`    // assign to a named group (for future MR batching)

	// Future update-mode fields (wired later, config-shape reserved now).
	Automerge *bool `json:"automerge"` // auto-merge MR if CI passes
}

type RegistryConfig struct {
	Docker *RegistryEndpoint `json:"docker"`
	Go     *RegistryEndpoint `json:"go"`
	Npm    *RegistryEndpoint `json:"npm"`
	PyPI   *RegistryEndpoint `json:"pypi"`
	Crates *RegistryEndpoint `json:"crates"`
	Alpine *RegistryEndpoint `json:"alpine"`
	Debian *RegistryEndpoint `json:"debian"`
	Ubuntu *RegistryEndpoint `json:"ubuntu"`
	GitHub *RegistryEndpoint `json:"github"` // GitHub API for tool version checks
}

type RegistryEndpoint struct {
	URL     string `json:"url"`      // base URL (e.g. "https://jcr.pcfae.com/v2")
	AuthEnv string `json:"auth_env"` // env var name holding auth token (Bearer)
}

type SeverityConfig struct {
	Major int `json:"major"` // 0=info, 1=warning, 2=critical (default: 2)
	Minor int `json:"minor"` // default: 1
	Patch int `json:"patch"` // default: 0

	MajorTolerance int `json:"major_tolerance"` // default: 0
	MinorTolerance int `json:"minor_tolerance"` // default: 0
	PatchTolerance int `json:"patch_tolerance"` // default: 1
}

type SourceConfig struct {
	DockerImages   *bool `json:"docker_images"`
	GitHubReleases *bool `json:"github_releases"`
	GoModules      *bool `json:"go_modules"`
	RustCrates     *bool `json:"rust_crates"`
	NpmPackages    *bool `json:"npm_packages"`
	AlpineAPK      *bool `json:"alpine_apk"`
	DebianAPT      *bool `json:"debian_apt"`
	PipPackages    *bool `json:"pip_packages"`
}

type VersionDelta struct {
	Major int
	Minor int
	Patch int
}

type VulnConfig struct {
	Enabled          *bool  `json:"enabled"`           // default true
	MinSeverity      string `json:"min_severity"`      // "low", "moderate", "high", "critical" (default: "moderate")
	SeverityOverride *bool  `json:"severity_override"` // CVE-affected deps escalate to critical (default: true)
}

type VulnInfo struct {
	ID       string // e.g. "GHSA-xxxx-yyyy-zzzz", "CVE-2024-12345"
	Summary  string // short description
	Severity string // "LOW", "MODERATE", "HIGH", "CRITICAL" (from OSV/CVSS)
	FixedIn  string // version that fixes the vulnerability (if known)
	Source   string // provenance: "osv" (default), "trivy", "grype", "trivy+grype"
}