sources

type ActionsOptions struct {
	Workflows []string // filter to specific workflow file names
}

type DateRangeOptions struct {
	Since time.Time // only scan items created on or after this time (zero = no lower bound)
	Until time.Time // only scan items created before this time (zero = no upper bound)
}

type File struct {
	// Content provides a reader to the file's content
	Content io.Reader
	// Path is the resolved real path of the file
	Path string
	// Symlink represents a symlink to the file if that's how it was discovered
	Symlink string
	// Buffer is used for reading the content in chunks
	Buffer []byte
	// ShouldSkip is a callback that decides whether to skip a file based on its
	// attributes (e.g. path). If nil, no skipping is performed.
	ShouldSkip SkipFunc
	// MaxArchiveDepth limits how deep the sources will explore nested archives
	MaxArchiveDepth int
	// contains filtered or unexported fields
}

type Files struct {
	ShouldSkip      SkipFunc
	FollowSymlinks  bool
	MaxFileSize     int
	Path            string
	Sema            *semgroup.Group
	MaxArchiveDepth int
}

type Fragment struct {
	// Raw is the raw content of the fragment
	Raw string

	Bytes []byte

	// Indicates if this fragment is inherited from a finding
	InheritedFromFinding bool

	// StartLine is the line number this fragment starts on
	StartLine int

	// Attributes holds all source-specific metadata
	Attributes map[string]string
}

type FragmentsFunc func(fragment Fragment, err error) error

type Git struct {
	Cmd             *GitCmd
	ShouldSkip      SkipFunc
	Platform        scm.Platform
	RemoteURL       string
	Sema            *semgroup.Group
	MaxArchiveDepth int
}

type GitCmd struct {
	// contains filtered or unexported fields
}

type GitHub struct {
	// Auth
	Token string

	// Filtering
	ExcludeRepos []string // glob patterns matched against "owner/repo"

	// Include and Exclude specify resource types by name (e.g. "repos", "prs").
	// Validate applies these when Resources is empty.
	Include []string
	Exclude []string

	// Resources controls which resource types to scan.
	// Populated automatically by Validate from Include/Exclude when empty,
	// or set directly by callers who want programmatic control.
	Resources GitHubResourceSet

	// Scan config (passed through to Git/ParallelGit per repo)
	ShouldSkip      SkipFunc
	Sema            *semgroup.Group
	MaxArchiveDepth int
	Workers         int // git workers per repo (0 = single process)
	LogOpts         string

	// GitHub API
	BaseURL       string // GitHub Enterprise base URL; empty = github.com
	Actions       ActionsOptions
	DateRangeOpts DateRangeOptions

	// Target URL (required).
	URL string
	// contains filtered or unexported fields
}

type GitHubResourceSet map[GitHubResourceType]bool

type GitHubResourceType string

type GitLab struct {
	// Auth
	Token string

	// Target URL (required). A gitlab.com or self-hosted instance URL pointing
	// at a project, group, user, or specific resource (issue, MR, snippet,
	// release, pipeline, job).
	URL string

	// BaseURL is the site base for self-hosted instances (e.g.
	// "https://gitlab.example.com/" or "https://corp.com/gitlab/"). Leave
	// empty to infer "<scheme>://<host>/" from URL.
	BaseURL string

	// Filtering
	ExcludeRepos []string // glob patterns matched against "group/sub/project"
	Include      []string
	Exclude      []string
	Resources    GitLabResourceSet

	// Group enumeration knobs
	AllGroups        bool
	IncludeSubgroups bool

	// Scan config (passed through to Git/ParallelGit per project)
	ShouldSkip      SkipFunc
	Sema            *semgroup.Group
	MaxArchiveDepth int
	Workers         int
	LogOpts         string

	// Date-range filtering for API-backed resources
	DateRangeOpts DateRangeOptions
	// contains filtered or unexported fields
}

type GitLabResourceSet map[GitLabResourceType]bool

type GitLabResourceType string

type HuggingFace struct {
	Token string
	URL   string

	Include      []string
	Exclude      []string
	ExcludeRepos []string // glob patterns matched against "owner/name"
	Resources    HuggingFaceResourceSet

	ShouldSkip      SkipFunc
	Sema            *semgroup.Group
	MaxArchiveDepth int
	Workers         int
	LogOpts         string

	MaxBucketObjectSize int64
	// contains filtered or unexported fields
}

type HuggingFaceRepoKind string

type HuggingFaceResourceSet map[HuggingFaceResourceType]bool

type HuggingFaceResourceType string

type ParallelGit struct {
	RepoPath        string
	ShouldSkip      SkipFunc
	Platform        scm.Platform
	RemoteURL       string
	Sema            *semgroup.Group
	MaxArchiveDepth int
	LogOpts         string
	Workers         int // 0 means auto (min(NumCPU, 4))
}

type ParsedGitHubURL struct {
	Owner    string // repo owner, org name, user name, or gist user
	Repo     string // repo name (empty for owner-level or gists)
	Resource string // "owner", "repo", "issue", "pr", "actions_run", "release", "discussion", "gist"
	ID       string // number, run ID, tag name, or gist ID (empty for owner/repo targets)
	Host     string // host (for GHE detection)
}

type ParsedGitLabURL struct {
	Scheme string // http or https
	Host   string // hostname[:port]
	Path   string // project/group/user path (everything before "/-/")
	Kind   string // "namespace", "project", "group", "user", "issue", "mr", "snippet", "release", "pipeline", "job"
	ID     string // resource ID (number, tag, snippet id)
}

type ParsedHuggingFaceURL struct {
	Scheme string
	Host   string
	Kind   string // "owner" or "repo"
	Owner  string
	Name   string
	Type   HuggingFaceRepoKind
	Prefix string
}

type S3 struct {
	// URL is the target bucket (and optional prefix). Required. Supported forms:
	//
	//   s3://bucket/prefix
	//   https://bucket.s3.amazonaws.com/prefix
	//   https://bucket.s3.<region>.amazonaws.com/prefix
	//   https://s3.<region>.amazonaws.com/bucket/prefix
	//   https://<bucket>.<account>.r2.cloudflarestorage.com/prefix
	//   https://<endpoint>[:port]/bucket/prefix      (MinIO, generic S3-compat)
	URL string

	// Region overrides whatever the URL implies. Required when the URL is a
	// path-style endpoint with no inferable region (e.g. MinIO at a custom host).
	Region string

	// Credentials. Explicit fields win over environment variables. If both are
	// empty and Anonymous is false, the source fails Validate.
	AccessKey    string
	SecretKey    string
	SessionToken string
	Anonymous    bool

	// Scan config
	MaxObjectSize   int64
	Workers         int
	ShouldSkip      SkipFunc
	MaxArchiveDepth int
	// contains filtered or unexported fields
}

type ScanTarget struct {
	Path    string
	Symlink string
}

type SkipFunc func(attrs map[string]string) bool

type Source interface {
	// Fragments provides a filepath.WalkDir like interface for scanning the
	// fragments in the source
	Fragments(ctx context.Context, yield FragmentsFunc) error
}

type Stdin struct {
	Content         io.Reader
	Attributes      map[string]string
	ShouldSkip      SkipFunc
	MaxArchiveDepth int
}