scanner

type ActionRef struct {
	// contains filtered or unexported fields
}

type ActionVersionPinningRuleOptions struct {
	IgnoreSameOwner bool `yaml:"ignore_same_owner"`
}

type ActionsSettingsFacts struct {
	Permissions                *github.ActionsPermissionsRepository
	AccessFinding              *Finding
	DefaultWorkflowPermissions *github.DefaultWorkflowPermissionRepository
	ForkPRContributorApproval  *github.ContributorApprovalPermissions
}

type Config struct {
	Rules        ConfigRules       `yaml:"rules"`
	RuleOptions  ConfigRuleOptions `yaml:"rule_options"`
	Overrides    []RuleOverride    `yaml:"overrides"`
	Suppressions []RuleSuppression `yaml:"suppressions"`
}

type ConfigRuleOptions struct {
	ActionVersionPinning    ActionVersionPinningRuleOptions    `yaml:"workflows/action-version-pinning"`
	UpdateToolConfiguration UpdateToolConfigurationRuleOptions `yaml:"updates/update-tool-configuration"`
}

type ConfigRules struct {
	Include []string `yaml:"include"`
	Exclude []string `yaml:"exclude"`
}

type DebugLogger func(repo, msg string)

type DependabotConfig struct {
	Version int                `yaml:"version"`
	Updates []DependabotUpdate `yaml:"updates"`
}

type DependabotCooldown struct {
	DefaultDays int `yaml:"default-days"`
}

type DependabotFacts struct {
	Path         string
	Content      string
	Config       *DependabotConfig
	Missing      bool
	Invalid      error
	HasWorkflows bool
	// Unknown is set when presence could not be determined (an indeterminate
	// fetch error, not a clean 404). It is mutually exclusive with Missing:
	// when Unknown, rules must not treat the tool as absent.
	Unknown bool
}

type DependabotUpdate struct {
	PackageEcosystem string `yaml:"package-ecosystem"`
	Directory        string `yaml:"directory"`
	Schedule         struct {
		Interval string `yaml:"interval"`
	} `yaml:"schedule"`
	Cooldown              *DependabotCooldown `yaml:"cooldown"`
	OpenPullRequestsLimit int                 `yaml:"open-pull-requests-limit"`
}

type FactWarning struct {
	Area   string
	Detail string
}

type Finding struct {
	ID          string `json:"id"`
	Rule        string `json:"rule,omitempty"`
	Category    string `json:"category,omitempty"`
	Severity    string `json:"severity"`
	Success     bool   `json:"success"`
	Title       string `json:"title"`
	Description string `json:"description"`
	Location    string `json:"location,omitempty"`
	File        string `json:"file,omitempty"`
	Line        int    `json:"line,omitempty"`
	Remediation string `json:"remediation"`
	FixURL      string `json:"fix_url,omitempty"`
	DocURL      string `json:"doc_url,omitempty"`
}

type RenovateConfig struct {
	Extends         []string              `json:"extends"`
	EnabledManagers []string              `json:"enabledManagers"`
	PinDigests      bool                  `json:"pinDigests"`
	MinReleaseAge   string                `json:"minimumReleaseAge"`
	PackageRules    []RenovatePackageRule `json:"packageRules"`
}

type RenovateFacts struct {
	Path         string
	Content      string
	Config       *RenovateConfig
	Missing      bool
	Invalid      error
	HasWorkflows bool
	// Unknown is set when presence could not be determined (an indeterminate
	// fetch error, not a clean 404). It is mutually exclusive with Missing:
	// when Unknown, rules must not treat the tool as absent.
	Unknown bool
}

type RenovatePackageRule struct {
	MatchManagers []string `json:"matchManagers"`
	MatchDepTypes []string `json:"matchDepTypes"`
	PinDigests    bool     `json:"pinDigests"`
	MinReleaseAge string   `json:"minimumReleaseAge"`
}

type RuleInfo struct {
	Name        string   `json:"name"`
	Aliases     []string `json:"aliases,omitempty"`
	Title       string   `json:"title"`
	Category    string   `json:"category"`
	Severity    string   `json:"severity"`
	Description string   `json:"description"`
	// DocFile is the slug of this rule's page under docs/rules/ (without the
	// .md extension). It is the single source of truth that binds a rule to its
	// in-repo documentation; DocURL() turns it into a link for reports.
	DocFile string `json:"doc_file,omitempty"`
}

type RuleOverride struct {
	Rule     string `yaml:"rule"`
	Severity string `yaml:"severity"`
}

type RuleSuppression struct {
	Rule      string `yaml:"rule"`
	FindingID string `yaml:"finding_id"`
	Path      string `yaml:"path"`
	Reason    string `yaml:"reason"`
}

type ScanFacts struct {
	Repository                              *github.Repository
	RepositoryOwner                         string
	DefaultBranch                           string
	Workflows                               []WorkflowFact
	ActionsSettings                         ActionsSettingsFacts
	Dependabot                              DependabotFacts
	Renovate                                RenovateFacts
	ActionVersionPinningIgnoreSameOwner     bool
	UpdateToolConfigurationRequireWorkflows bool

	// Incomplete lists facts that could not be determined because a GitHub
	// request failed for a reason other than a clean 404 (timeout, rate limit,
	// 5xx, …). A non-empty slice means the scan is partial.
	Incomplete []FactWarning
}

type ScanOptions struct {
	RuleNames      []string
	Categories     []string
	Severities     []string
	IncludeSuccess bool
	Config         *Config
	DebugLog       DebugLogger
}

type ScanResult struct {
	RepoFullName string    `json:"repo_full_name"`
	RepoURL      string    `json:"repo_url"`
	Findings     []Finding `json:"findings"`
	ScannedAt    string    `json:"scanned_at"`
	Error        string    `json:"error,omitempty"`
	// Incomplete lists checks that could not be completed (e.g. a timeout or
	// rate limit while fetching a config). A non-empty slice means the findings
	// are partial — the scan must not be read as a clean bill of health. Each
	// entry is "<area>: <cause>".
	Incomplete []string `json:"incomplete,omitempty"`
}

type Scanner struct {
	// contains filtered or unexported fields
}

type UpdateToolConfigurationRuleOptions struct {
	RequireWorkflows bool `yaml:"require_workflows"`
}

type WorkflowFact struct {
	Path     string
	Content  string
	Workflow *WorkflowFile
	Valid    bool
}

type WorkflowFile struct {
	Name        string                 `yaml:"name"`
	On          interface{}            `yaml:"on"` // Can be string, []string, or map
	Permissions interface{}            `yaml:"permissions"`
	Jobs        map[string]WorkflowJob `yaml:"jobs"`
}

type WorkflowJob struct {
	Name        string            `yaml:"name"`
	Permissions interface{}       `yaml:"permissions"`
	Steps       []WorkflowStep    `yaml:"steps"`
	RunsOn      interface{}       `yaml:"runs-on"`
	Uses        string            `yaml:"uses"` // For reusable workflows
	Env         map[string]string `yaml:"env"`
}

type WorkflowStep struct {
	Name string                 `yaml:"name"`
	Uses string                 `yaml:"uses"`
	Run  string                 `yaml:"run"`
	With map[string]interface{} `yaml:"with"`
	Env  map[string]string      `yaml:"env"`
}