v1

type Attestation struct {
	InitializedAt *timestamppb.Timestamp           `protobuf:"bytes,1,opt,name=initialized_at,json=initializedAt,proto3" json:"initialized_at,omitempty"`
	FinishedAt    *timestamppb.Timestamp           `protobuf:"bytes,2,opt,name=finished_at,json=finishedAt,proto3" json:"finished_at,omitempty"`
	Workflow      *WorkflowMetadata                `protobuf:"bytes,3,opt,name=workflow,proto3" json:"workflow,omitempty"`
	Materials     map[string]*Attestation_Material `` /* 145-byte string literal not displayed */
	// Annotations for the attestation
	Annotations map[string]string `` /* 149-byte string literal not displayed */
	// List of env variables
	EnvVars    map[string]string                   `` /* 156-byte string literal not displayed */
	RunnerUrl  string                              `protobuf:"bytes,7,opt,name=runner_url,json=runnerUrl,proto3" json:"runner_url,omitempty"`
	RunnerType v1.CraftingSchema_Runner_RunnerType `` /* 150-byte string literal not displayed */
	// Head Commit of the environment where the attestation was executed (optional)
	Head *Commit `protobuf:"bytes,9,opt,name=head,proto3" json:"head,omitempty"`
	// Policies that materials in this attestation were validated against
	PolicyEvaluations []*PolicyEvaluation `protobuf:"bytes,10,rep,name=policy_evaluations,json=policyEvaluations,proto3" json:"policy_evaluations,omitempty"`
	// fail the attestation if policy evaluation fails
	BlockOnPolicyViolation bool `` /* 133-byte string literal not displayed */
	// bypass policy check
	BypassPolicyCheck bool `protobuf:"varint,14,opt,name=bypass_policy_check,json=bypassPolicyCheck,proto3" json:"bypass_policy_check,omitempty"`
	// Signing options
	SigningOptions *Attestation_SigningOptions `protobuf:"bytes,15,opt,name=signing_options,json=signingOptions,proto3" json:"signing_options,omitempty"`
	// Runner environment in which the attestation was crafted
	RunnerEnvironment *RunnerEnvironment `protobuf:"bytes,16,opt,name=runner_environment,json=runnerEnvironment,proto3" json:"runner_environment,omitempty"`
	// Authentication information used during attestation
	Auth *Attestation_Auth `protobuf:"bytes,17,opt,name=auth,proto3" json:"auth,omitempty"`
	// array of hostnames that are allowed to be used in the policies
	PoliciesAllowedHostnames []string `` /* 136-byte string literal not displayed */
	// CAS backend information used during attestation
	CasBackend *Attestation_CASBackend `protobuf:"bytes,19,opt,name=cas_backend,json=casBackend,proto3" json:"cas_backend,omitempty"`
	// skip storing the environment variables automatically discovered by the CI runner.
	// The contract's env_allow_list is not affected by this flag.
	SkipRunnerEnvVars bool `protobuf:"varint,20,opt,name=skip_runner_env_vars,json=skipRunnerEnvVars,proto3" json:"skip_runner_env_vars,omitempty"`
	// contains filtered or unexported fields
}

type Attestation_Auth struct {
	Type Attestation_Auth_AuthType `protobuf:"varint,1,opt,name=type,proto3,enum=attestation.v1.Attestation_Auth_AuthType" json:"type,omitempty"`
	// Identifier of the authentication (user ID, token ID, etc.)
	Id string `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
	// contains filtered or unexported fields
}

type Attestation_Auth_AuthType int32

type Attestation_CASBackend struct {

	// UUID of the CAS backend
	CasBackendId string `protobuf:"bytes,1,opt,name=cas_backend_id,json=casBackendId,proto3" json:"cas_backend_id,omitempty"`
	// Name of the CAS backend
	CasBackendName string `protobuf:"bytes,2,opt,name=cas_backend_name,json=casBackendName,proto3" json:"cas_backend_name,omitempty"`
	// Whether this is a fallback backend
	Fallback bool `protobuf:"varint,3,opt,name=fallback,proto3" json:"fallback,omitempty"`
	// contains filtered or unexported fields
}

type Attestation_Material struct {
	Id string `protobuf:"bytes,12,opt,name=id,proto3" json:"id,omitempty"`
	// Types that are valid to be assigned to M:
	//
	//	*Attestation_Material_String_
	//	*Attestation_Material_ContainerImage_
	//	*Attestation_Material_Artifact_
	//	*Attestation_Material_SbomArtifact
	M            isAttestation_Material_M                `protobuf_oneof:"m"`
	AddedAt      *timestamppb.Timestamp                  `protobuf:"bytes,5,opt,name=added_at,json=addedAt,proto3" json:"added_at,omitempty"`
	MaterialType v1.CraftingSchema_Material_MaterialType `` /* 160-byte string literal not displayed */
	// Whether the material has been uploaded to the CAS
	UploadedToCas bool `protobuf:"varint,7,opt,name=uploaded_to_cas,json=uploadedToCas,proto3" json:"uploaded_to_cas,omitempty"`
	// If the material content has been injected inline in the attestation
	// leveraging a form of inline CAS
	InlineCas bool `protobuf:"varint,8,opt,name=inline_cas,json=inlineCas,proto3" json:"inline_cas,omitempty"`
	// Annotations for the material
	Annotations map[string]string `` /* 149-byte string literal not displayed */
	Output      bool              `protobuf:"varint,10,opt,name=output,proto3" json:"output,omitempty"`
	Required    bool              `protobuf:"varint,11,opt,name=required,proto3" json:"required,omitempty"`
	// contains filtered or unexported fields
}

type Attestation_Material_Artifact struct {

	// NOT USED, kept for compatibility with servers that still perform server-side validation“
	// TODO: remove after some time
	//
	// Deprecated: Marked as deprecated in attestation/v1/crafting_state.proto.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// filename, use for record purposes
	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	// the digest is enough to retrieve the artifact since it's stored in a CAS
	// which also has annotated the fileName
	Digest    string `protobuf:"bytes,3,opt,name=digest,proto3" json:"digest,omitempty"`
	IsSubject bool   `protobuf:"varint,4,opt,name=is_subject,json=isSubject,proto3" json:"is_subject,omitempty"`
	// Inline content of the artifact.
	// This is optional and is used for small artifacts that can be stored inline in the attestation
	Content []byte `protobuf:"bytes,5,opt,name=content,proto3" json:"content,omitempty"`
	// contains filtered or unexported fields
}

type Attestation_Material_Artifact_ struct {
	Artifact *Attestation_Material_Artifact `protobuf:"bytes,3,opt,name=artifact,proto3,oneof"`
}

type Attestation_Material_ContainerImage struct {

	// NOT USED, kept for compatibility with servers that still perform server-side validation“
	// TODO: remove after some time
	//
	// Deprecated: Marked as deprecated in attestation/v1/crafting_state.proto.
	Id        string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	Name      string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	Digest    string `protobuf:"bytes,3,opt,name=digest,proto3" json:"digest,omitempty"`
	IsSubject bool   `protobuf:"varint,4,opt,name=is_subject,json=isSubject,proto3" json:"is_subject,omitempty"`
	// provided tag
	Tag string `protobuf:"bytes,5,opt,name=tag,proto3" json:"tag,omitempty"`
	// Digest of the found signature for the image
	SignatureDigest string `protobuf:"bytes,6,opt,name=signature_digest,json=signatureDigest,proto3" json:"signature_digest,omitempty"`
	// The provider in charge of the signature
	SignatureProvider string `protobuf:"bytes,7,opt,name=signature_provider,json=signatureProvider,proto3" json:"signature_provider,omitempty"`
	// Base64 encoded signature payload, aka the OCI Signature Manifest
	Signature string `protobuf:"bytes,8,opt,name=signature,proto3" json:"signature,omitempty"`
	// Indicates if the image has the latest tag. The image being checked
	// might not explicitly have the latest tag, but it could also be tagged
	// with the latest tag.
	HasLatestTag *wrapperspb.BoolValue `protobuf:"bytes,9,opt,name=has_latest_tag,json=hasLatestTag,proto3" json:"has_latest_tag,omitempty"`
	// contains filtered or unexported fields
}

type Attestation_Material_ContainerImage_ struct {
	ContainerImage *Attestation_Material_ContainerImage `protobuf:"bytes,2,opt,name=container_image,json=containerImage,proto3,oneof"`
}

type Attestation_Material_KeyVal struct {

	// NOT USED, kept for compatibility with servers that still perform server-side validation“
	// TODO: remove after some time
	//
	// Deprecated: Marked as deprecated in attestation/v1/crafting_state.proto.
	Id     string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	Value  string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
	Digest string `protobuf:"bytes,3,opt,name=digest,proto3" json:"digest,omitempty"`
	// contains filtered or unexported fields
}

type Attestation_Material_SBOMArtifact struct {

	// The actual SBOM artifact
	Artifact *Attestation_Material_Artifact `protobuf:"bytes,1,opt,name=artifact,proto3" json:"artifact,omitempty"`
	// The Main component if any the SBOM is related to
	MainComponent *Attestation_Material_SBOMArtifact_MainComponent `protobuf:"bytes,2,opt,name=main_component,json=mainComponent,proto3" json:"main_component,omitempty"`
	// contains filtered or unexported fields
}

type Attestation_Material_SBOMArtifact_MainComponent struct {

	// The name of the main component
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// The version of the main component
	Version string `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"`
	// The kind of the main component
	Kind string `protobuf:"bytes,3,opt,name=kind,proto3" json:"kind,omitempty"`
	// contains filtered or unexported fields
}

type Attestation_Material_SbomArtifact struct {
	SbomArtifact *Attestation_Material_SBOMArtifact `protobuf:"bytes,4,opt,name=sbom_artifact,json=sbomArtifact,proto3,oneof"`
}

type Attestation_Material_String_ struct {
	String_ *Attestation_Material_KeyVal `protobuf:"bytes,1,opt,name=string,proto3,oneof"`
}

type Attestation_SigningOptions struct {

	// TSA URL
	TimestampAuthorityUrl string `` /* 126-byte string literal not displayed */
	// Signing CA to be used for signing
	SigningCa string `protobuf:"bytes,2,opt,name=signing_ca,json=signingCa,proto3" json:"signing_ca,omitempty"`
	// contains filtered or unexported fields
}

type Commit struct {
	Hash string `protobuf:"bytes,1,opt,name=hash,proto3" json:"hash,omitempty"`
	// Commit authors might not include email i.e "Flux <>"
	AuthorEmail string                 `protobuf:"bytes,2,opt,name=author_email,json=authorEmail,proto3" json:"author_email,omitempty"`
	AuthorName  string                 `protobuf:"bytes,3,opt,name=author_name,json=authorName,proto3" json:"author_name,omitempty"`
	Message     string                 `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"`
	Date        *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=date,proto3" json:"date,omitempty"`
	Remotes     []*Commit_Remote       `protobuf:"bytes,6,rep,name=remotes,proto3" json:"remotes,omitempty"`
	Signature   string                 `protobuf:"bytes,7,opt,name=signature,proto3" json:"signature,omitempty"`
	// Platform verification information (GitHub/GitLab signature verification)
	PlatformVerification *Commit_CommitVerification `` /* 127-byte string literal not displayed */
	// contains filtered or unexported fields
}

type Commit_CommitVerification struct {

	// Whether verification was attempted
	Attempted bool `protobuf:"varint,1,opt,name=attempted,proto3" json:"attempted,omitempty"`
	// Verification status
	Status Commit_CommitVerification_VerificationStatus `` /* 131-byte string literal not displayed */
	// Human-readable reason for the status
	Reason string `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"`
	// Platform that performed the verification (e.g., "github", "gitlab")
	Platform string `protobuf:"bytes,4,opt,name=platform,proto3" json:"platform,omitempty"`
	// Optional: The signing key ID if verified
	KeyId string `protobuf:"bytes,5,opt,name=key_id,json=keyId,proto3" json:"key_id,omitempty"`
	// Optional: The signature algorithm used
	SignatureAlgorithm string `protobuf:"bytes,6,opt,name=signature_algorithm,json=signatureAlgorithm,proto3" json:"signature_algorithm,omitempty"`
	// contains filtered or unexported fields
}

type Commit_CommitVerification_VerificationStatus int32

type Commit_Remote struct {
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	Url  string `protobuf:"bytes,2,opt,name=url,proto3" json:"url,omitempty"`
	// contains filtered or unexported fields
}

type CraftingState struct {

	// Types that are valid to be assigned to Schema:
	//
	//	*CraftingState_InputSchema
	//	*CraftingState_SchemaV2
	Schema      isCraftingState_Schema `protobuf_oneof:"schema"`
	Attestation *Attestation           `protobuf:"bytes,2,opt,name=attestation,proto3" json:"attestation,omitempty"`
	DryRun      bool                   `protobuf:"varint,3,opt,name=dry_run,json=dryRun,proto3" json:"dry_run,omitempty"`
	// External URL of the platform UI, if available
	UiDashboardUrl string `protobuf:"bytes,5,opt,name=ui_dashboard_url,json=uiDashboardUrl,proto3" json:"ui_dashboard_url,omitempty"`
	// contains filtered or unexported fields
}

type CraftingState_InputSchema struct {
	InputSchema *v1.CraftingSchema `protobuf:"bytes,1,opt,name=input_schema,json=inputSchema,proto3,oneof"`
}

type CraftingState_SchemaV2 struct {
	SchemaV2 *v1.CraftingSchemaV2 `protobuf:"bytes,4,opt,name=schema_v2,json=schemaV2,proto3,oneof"`
}

type NormalizedMaterialOutput struct {
	Name, Digest string
	IsOutput     bool
	Content      []byte
}

type PolicyAssessment struct {

	// Platform assessment UUID.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Platform AssessmentStatus enum name, e.g. "ASSESSMENT_STATUS_NOT_AFFECTED".
	Status string `protobuf:"bytes,2,opt,name=status,proto3" json:"status,omitempty"`
	// Platform AssessmentScope enum name, e.g. "ASSESSMENT_SCOPE_PROJECT".
	Scope string `protobuf:"bytes,3,opt,name=scope,proto3" json:"scope,omitempty"`
	// contains filtered or unexported fields
}

type PolicyAssessmentResult struct {

	// Precedence-resolved status across `assessments`. Values use the
	// platform's AssessmentStatus enum names, e.g.
	// "ASSESSMENT_STATUS_NOT_AFFECTED".
	EffectiveStatus string `protobuf:"bytes,1,opt,name=effective_status,json=effectiveStatus,proto3" json:"effective_status,omitempty"`
	// Assessments matching the finding's identity tuple.
	Assessments []*PolicyAssessment `protobuf:"bytes,2,rep,name=assessments,proto3" json:"assessments,omitempty"`
	// contains filtered or unexported fields
}

type PolicyEvaluation struct {

	// The policy name from the policy spec
	Name         string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	MaterialName string `protobuf:"bytes,2,opt,name=material_name,json=materialName,proto3" json:"material_name,omitempty"`
	// the body of the policy. This field will be empty if there is a FQDN reference to the policy
	//
	// Deprecated: Marked as deprecated in attestation/v1/crafting_state.proto.
	Body string `protobuf:"bytes,3,opt,name=body,proto3" json:"body,omitempty"`
	// Base64 representation of run scripts. It might be empty if there is a FQDN reference to the policy
	Sources []string `protobuf:"bytes,12,rep,name=sources,proto3" json:"sources,omitempty"`
	// fully qualified reference to the policy
	// i.e
	// http://my-domain.com/foo.yaml
	// file://foo.yaml
	// chainloop://my-provider.com/foo@sha256:1234
	// NOTE: embedded policies will not have a reference
	// Deprecated: use policy_reference instead
	//
	// Deprecated: Marked as deprecated in attestation/v1/crafting_state.proto.
	ReferenceDigest string `protobuf:"bytes,10,opt,name=reference_digest,json=referenceDigest,proto3" json:"reference_digest,omitempty"`
	// Deprecated: Marked as deprecated in attestation/v1/crafting_state.proto.
	ReferenceName string            `protobuf:"bytes,11,opt,name=reference_name,json=referenceName,proto3" json:"reference_name,omitempty"`
	Description   string            `protobuf:"bytes,5,opt,name=description,proto3" json:"description,omitempty"`
	Annotations   map[string]string `` /* 149-byte string literal not displayed */
	// The policy violations, if any
	Violations []*PolicyEvaluation_Violation `protobuf:"bytes,4,rep,name=violations,proto3" json:"violations,omitempty"`
	// arguments, as they come from the policy attachment
	With map[string]string `` /* 135-byte string literal not displayed */
	// material type, if any, of the evaluated policy
	Type v1.CraftingSchema_Material_MaterialType `protobuf:"varint,8,opt,name=type,proto3,enum=workflowcontract.v1.CraftingSchema_Material_MaterialType" json:"type,omitempty"`
	// whether this evaluation was skipped or not (because of an invalid input, for example)
	Skipped bool `protobuf:"varint,13,opt,name=skipped,proto3" json:"skipped,omitempty"`
	// Evaluation messages, intended to communicate evaluation errors (invalid input)
	SkipReasons []string `protobuf:"bytes,14,rep,name=skip_reasons,json=skipReasons,proto3" json:"skip_reasons,omitempty"`
	// Group this evaluated policy belongs to, if any
	PolicyReference *PolicyEvaluation_Reference `protobuf:"bytes,15,opt,name=policy_reference,json=policyReference,proto3" json:"policy_reference,omitempty"`
	GroupReference  *PolicyEvaluation_Reference `protobuf:"bytes,16,opt,name=group_reference,json=groupReference,proto3" json:"group_reference,omitempty"`
	// List of requirements this policy contributes to satisfy
	Requirements []string `protobuf:"bytes,17,rep,name=requirements,proto3" json:"requirements,omitempty"`
	// Raw inputs and outputs from the policy engine, preserved for debugging.
	RawResults []*PolicyEvaluation_RawResult `protobuf:"bytes,18,rep,name=raw_results,json=rawResults,proto3" json:"raw_results,omitempty"`
	// Whether the policy evaluation result should block the attestation (inherited from the policy attachment)
	Gate bool `protobuf:"varint,19,opt,name=gate,proto3" json:"gate,omitempty"`
	// Names of policy inputs whose values were supplied or overridden at runtime
	// (e.g. via --policy-input-from-file) rather than coming solely from the
	// contract. The effective merged values live in `with`; this only records
	// which input names were touched at runtime. Empty means no runtime override.
	RuntimeInputOverrides []string `` /* 127-byte string literal not displayed */
	// contains filtered or unexported fields
}

type PolicyEvaluationBundle struct {
	Evaluations []*PolicyEvaluation `protobuf:"bytes,1,rep,name=evaluations,proto3" json:"evaluations,omitempty"`
	// contains filtered or unexported fields
}

type PolicyEvaluation_RawResult struct {

	// Input data provided to the policy engine
	Input []byte `protobuf:"bytes,1,opt,name=input,proto3" json:"input,omitempty"`
	// Output data returned by the policy engine
	Output []byte `protobuf:"bytes,2,opt,name=output,proto3" json:"output,omitempty"`
	// contains filtered or unexported fields
}

type PolicyEvaluation_Reference struct {
	Name    string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	Digest  string `protobuf:"bytes,2,opt,name=digest,proto3" json:"digest,omitempty"`
	Uri     string `protobuf:"bytes,3,opt,name=uri,proto3" json:"uri,omitempty"`
	OrgName string `protobuf:"bytes,4,opt,name=org_name,json=orgName,proto3" json:"org_name,omitempty"`
	// contains filtered or unexported fields
}

type PolicyEvaluation_Violation struct {
	Subject string `protobuf:"bytes,1,opt,name=subject,proto3" json:"subject,omitempty"`
	Message string `protobuf:"bytes,2,opt,name=message,proto3" json:"message,omitempty"`
	// Structured finding data, validated against the policy's declared finding_type.
	// Only populated in the CAS-stored PolicyEvaluationBundle, not in the
	// inline attestation predicate.
	//
	// Types that are valid to be assigned to Finding:
	//
	//	*PolicyEvaluation_Violation_Vulnerability
	//	*PolicyEvaluation_Violation_Sast
	//	*PolicyEvaluation_Violation_LicenseViolation
	Finding isPolicyEvaluation_Violation_Finding `protobuf_oneof:"finding"`
	// Suppression hint set by the policy. When true the gate count
	// excludes this entry, but it is still stored in CAS and ingested
	// (audit trail preserved). Set by the policy author (typically based
	// on `assessment.effective_status`) — the engine reads the bool
	// without interpreting why.
	Suppress bool `protobuf:"varint,6,opt,name=suppress,proto3" json:"suppress,omitempty"`
	// contains filtered or unexported fields
}

type PolicyEvaluation_Violation_LicenseViolation struct {
	LicenseViolation *PolicyLicenseViolationFinding `protobuf:"bytes,5,opt,name=license_violation,json=licenseViolation,proto3,oneof"`
}

type PolicyEvaluation_Violation_Sast struct {
	Sast *PolicySASTFinding `protobuf:"bytes,4,opt,name=sast,proto3,oneof"`
}

type PolicyEvaluation_Violation_Vulnerability struct {
	Vulnerability *PolicyVulnerabilityFinding `protobuf:"bytes,3,opt,name=vulnerability,proto3,oneof"`
}

type PolicyLicenseViolationFinding struct {

	// Human-readable violation description
	Message string `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
	// Component name (e.g., "lodash")
	ComponentName string `protobuf:"bytes,2,opt,name=component_name,json=componentName,proto3" json:"component_name,omitempty"`
	// Package URL (e.g., pkg:npm/lodash@4.17.21)
	PackagePurl string `protobuf:"bytes,3,opt,name=package_purl,json=packagePurl,proto3" json:"package_purl,omitempty"`
	// License identifier (e.g., "GPL-3.0", "AGPL-3.0")
	LicenseId string `protobuf:"bytes,4,opt,name=license_id,json=licenseId,proto3" json:"license_id,omitempty"`
	// Human-readable license name
	LicenseName string `protobuf:"bytes,5,opt,name=license_name,json=licenseName,proto3" json:"license_name,omitempty"`
	// Component version
	ComponentVersion string `protobuf:"bytes,6,opt,name=component_version,json=componentVersion,proto3" json:"component_version,omitempty"`
	// Suggested fix
	Recommendation string `protobuf:"bytes,7,opt,name=recommendation,proto3" json:"recommendation,omitempty"`
	// Optional assessment context. See PolicyAssessmentResult.
	Assessment *PolicyAssessmentResult `protobuf:"bytes,8,opt,name=assessment,proto3,oneof" json:"assessment,omitempty"`
	// contains filtered or unexported fields
}

type PolicySASTFinding struct {

	// Human-readable violation description
	Message string `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
	// Tool-specific rule identifier (e.g., java:S1234, go-sec:G101)
	RuleId string `protobuf:"bytes,2,opt,name=rule_id,json=ruleId,proto3" json:"rule_id,omitempty"`
	// Severity level (CRITICAL, HIGH, MEDIUM, LOW)
	Severity string `protobuf:"bytes,3,opt,name=severity,proto3" json:"severity,omitempty"`
	// File path where the issue was found
	Location string `protobuf:"bytes,4,opt,name=location,proto3" json:"location,omitempty"`
	// Line number in the file
	LineNumber int32 `protobuf:"varint,5,opt,name=line_number,json=lineNumber,proto3" json:"line_number,omitempty"`
	// Code snippet showing the issue
	CodeSnippet string `protobuf:"bytes,6,opt,name=code_snippet,json=codeSnippet,proto3" json:"code_snippet,omitempty"`
	// Suggested fix
	Recommendation string `protobuf:"bytes,7,opt,name=recommendation,proto3" json:"recommendation,omitempty"`
	// Optional numeric severity score from the scanner (scale is tool-defined)
	SeverityScore *float64 `protobuf:"fixed64,8,opt,name=severity_score,json=severityScore,proto3,oneof" json:"severity_score,omitempty"`
	// Optional assessment context. See PolicyAssessmentResult.
	Assessment *PolicyAssessmentResult `protobuf:"bytes,9,opt,name=assessment,proto3,oneof" json:"assessment,omitempty"`
	// contains filtered or unexported fields
}

type PolicyVulnerabilityFinding struct {

	// Human-readable violation description
	Message string `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
	// Vulnerability identifier (e.g., CVE-2024-1234, GHSA-xxxx)
	ExternalId string `protobuf:"bytes,2,opt,name=external_id,json=externalId,proto3" json:"external_id,omitempty"`
	// Package URL of the affected component (e.g., pkg:golang/example.com/lib@v1.0.0)
	PackagePurl string `protobuf:"bytes,3,opt,name=package_purl,json=packagePurl,proto3" json:"package_purl,omitempty"`
	// Severity level (CRITICAL, HIGH, MEDIUM, LOW)
	Severity string `protobuf:"bytes,4,opt,name=severity,proto3" json:"severity,omitempty"`
	// CVSS v3 score (0.0-10.0)
	CvssV3Score float64 `protobuf:"fixed64,5,opt,name=cvss_v3_score,json=cvssV3Score,proto3" json:"cvss_v3_score,omitempty"`
	// CWE references (e.g., CWE-79, CWE-89)
	Cwes []string `protobuf:"bytes,6,rep,name=cwes,proto3" json:"cwes,omitempty"`
	// Suggested fix or upgrade path
	Recommendation string `protobuf:"bytes,7,opt,name=recommendation,proto3" json:"recommendation,omitempty"`
	// Optional longer description of the vulnerability
	Description string `protobuf:"bytes,8,opt,name=description,proto3" json:"description,omitempty"`
	// Version that fixes the vulnerability (e.g., "2.0.1", "1.3.4-patch1")
	FixedVersion string `protobuf:"bytes,9,opt,name=fixed_version,json=fixedVersion,proto3" json:"fixed_version,omitempty"`
	// Optional assessment context. See PolicyAssessmentResult.
	Assessment *PolicyAssessmentResult `protobuf:"bytes,10,opt,name=assessment,proto3,oneof" json:"assessment,omitempty"`
	// contains filtered or unexported fields
}

type ProjectVersion struct {
	Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
	// if it's pre-release
	Prerelease     bool `protobuf:"varint,2,opt,name=prerelease,proto3" json:"prerelease,omitempty"`
	MarkAsReleased bool `protobuf:"varint,3,opt,name=mark_as_released,json=markAsReleased,proto3" json:"mark_as_released,omitempty"`
	// contains filtered or unexported fields
}

type ResourceDescriptor struct {
	Name             string            `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	Uri              string            `protobuf:"bytes,2,opt,name=uri,proto3" json:"uri,omitempty"`
	Digest           map[string]string `` /* 139-byte string literal not displayed */
	Content          []byte            `protobuf:"bytes,4,opt,name=content,proto3" json:"content,omitempty"`
	DownloadLocation string            `protobuf:"bytes,5,opt,name=download_location,json=downloadLocation,proto3" json:"download_location,omitempty"`
	MediaType        string            `protobuf:"bytes,6,opt,name=media_type,json=mediaType,proto3" json:"media_type,omitempty"`
	// Per the Struct protobuf spec, this type corresponds to
	// a JSON Object, which is truly a map<string, Value> under the hood.
	// So, the Struct a) is still consistent with our specification for
	// the `annotations` field, and b) has native support in some language
	// bindings making their use easier in implementations.
	// See: https://pkg.go.dev/google.golang.org/protobuf/types/known/structpb#Struct
	Annotations *structpb.Struct `protobuf:"bytes,7,opt,name=annotations,proto3" json:"annotations,omitempty"`
	// contains filtered or unexported fields
}

type RunnerEnvironment struct {

	// Workflow file path that was used during build
	WorkflowFilePath string `protobuf:"bytes,1,opt,name=workflow_file_path,json=workflowFilePath,proto3" json:"workflow_file_path,omitempty"`
	// Runner environment name, i.e. github-hosted
	Environment string `protobuf:"bytes,2,opt,name=environment,proto3" json:"environment,omitempty"`
	// Whether the runner is authenticated, i.e. via the OIDC token
	Authenticated bool `protobuf:"varint,3,opt,name=authenticated,proto3" json:"authenticated,omitempty"`
	// Runner type
	Type v1.CraftingSchema_Runner_RunnerType `protobuf:"varint,4,opt,name=type,proto3,enum=workflowcontract.v1.CraftingSchema_Runner_RunnerType" json:"type,omitempty"`
	// Runner URL
	Url string `protobuf:"bytes,5,opt,name=url,proto3" json:"url,omitempty"`
	// contains filtered or unexported fields
}

type WorkflowMetadata struct {
	Name    string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	Project string `protobuf:"bytes,2,opt,name=project,proto3" json:"project,omitempty"`
	// kept for backwards compatibility with remote state storage
	//
	// Deprecated: Marked as deprecated in attestation/v1/crafting_state.proto.
	ProjectVersion string `protobuf:"bytes,9,opt,name=project_version,json=projectVersion,proto3" json:"project_version,omitempty"`
	// project version
	Version        *ProjectVersion `protobuf:"bytes,10,opt,name=version,proto3" json:"version,omitempty"`
	Team           string          `protobuf:"bytes,3,opt,name=team,proto3" json:"team,omitempty"`
	WorkflowId     string          `protobuf:"bytes,5,opt,name=workflow_id,json=workflowId,proto3" json:"workflow_id,omitempty"`
	WorkflowRunId  string          `protobuf:"bytes,6,opt,name=workflow_run_id,json=workflowRunId,proto3" json:"workflow_run_id,omitempty"` // Not required since we might be doing a dry-run
	SchemaRevision string          `protobuf:"bytes,7,opt,name=schema_revision,json=schemaRevision,proto3" json:"schema_revision,omitempty"`
	// contract name (contract version is "schema_revision")
	ContractName string `protobuf:"bytes,11,opt,name=contract_name,json=contractName,proto3" json:"contract_name,omitempty"`
	// organization name
	Organization string `protobuf:"bytes,8,opt,name=organization,proto3" json:"organization,omitempty"`
	// contains filtered or unexported fields
}