presets

type Option struct {
	Type        string `yaml:"type" toml:"type"`                 // string, bool, int, array
	Default     any    `yaml:"default" toml:"default"`           // Default value
	Description string `yaml:"description" toml:"description"`   // Help text
	EnvVar      string `yaml:"env_var" toml:"env_var"`           // Maps to environment variable
	CommandFlag string `yaml:"command_flag" toml:"command_flag"` // Maps to command flag
}

type OptionTOML struct {
	Type        string      `toml:"type"`
	Default     interface{} `toml:"default"`
	Description string      `toml:"description"`
	CommandFlag string      `toml:"command_flag"`
	EnvVar      string      `toml:"env_var"`
}

type Preset struct {
	Name          string            `yaml:"name" toml:"name"`
	Phase         string            `yaml:"phase" toml:"phase"`
	Image         string            `yaml:"image" toml:"image"`
	Description   string            `yaml:"description,omitempty" toml:"description,omitempty"` // Usage notes and constraints, shown by `preset info`
	Hardened      bool              `yaml:"hardened,omitempty" toml:"hardened,omitempty"`       // Uses Docker Hardened Image (dhi.io)
	Command       string            `yaml:"command" toml:"command"`
	Entrypoint    []string          `yaml:"entrypoint" toml:"entrypoint"`
	Workdir       string            `yaml:"workdir" toml:"workdir"`
	Volumes       []string          `yaml:"volumes" toml:"volumes"`
	Env           map[string]string `yaml:"env" toml:"env"`
	ConfigFiles   []string          `yaml:"config_files" toml:"config_files"`
	Options       map[string]Option `yaml:"options" toml:"options"`
	RequireCI     bool              `yaml:"require_ci" toml:"require_ci"`                       // Requires CI environment
	LocalBehavior string            `yaml:"local_behavior" toml:"local_behavior"`               // draft, no-push, dry-run, disabled
	Privileged    bool              `yaml:"privileged,omitempty" toml:"privileged,omitempty"`   // Requires root privileges (skip user mapping)
	PullPolicy    string            `yaml:"pull_policy,omitempty" toml:"pull_policy,omitempty"` // always, if-not-present, never (default: env-based)
	Timeout       string            `yaml:"timeout,omitempty" toml:"timeout,omitempty"`         // duration string (e.g., "5m", "45m"), default: 30m
}

type PresetTOML struct {
	Name          string                `toml:"name"`
	Phase         string                `toml:"phase"`
	Image         string                `toml:"image"`
	Description   string                `toml:"description"`
	Hardened      bool                  `toml:"hardened"`
	Command       string                `toml:"command"`
	Entrypoint    []string              `toml:"entrypoint"`
	Workdir       string                `toml:"workdir"`
	Volumes       []string              `toml:"volumes"`
	Env           map[string]string     `toml:"env"`
	ConfigFiles   []string              `toml:"config_files"`
	Options       map[string]OptionTOML `toml:"options"`
	RequireCI     bool                  `toml:"require_ci"`
	LocalBehavior string                `toml:"local_behavior"`
	Privileged    bool                  `toml:"privileged"`
	PullPolicy    string                `toml:"pull_policy"`
	Timeout       string                `toml:"timeout"`
}

type PresetsFile struct {
	Presets map[string]PresetTOML `toml:"presets"`
}

type PromotionDecision struct {
	// Promote reports whether the candidate may replace the running image.
	Promote bool

	// Reason states why. Always set, for promotions as much as for holds — a
	// candidate held for another week has to say so somewhere, or the policy
	// silently swallows it.
	Reason string

	// WaivedFor names the vulnerabilities that bought the candidate its way
	// past the cooldown. Empty when no waiver was needed, so a promotion never
	// claims a waiver that did nothing.
	WaivedFor []string

	// AgeDays is how long the candidate has been public, in whole days. Nil
	// when the registry gave no date.
	AgeDays *int
}

type ScanDecision struct {
	// Promote reports whether the findings leave the candidate promotable.
	Promote bool

	// Reason states why — for a pass as much as for a hold. A candidate the
	// scan gate holds has to say so somewhere, or the promotion silently
	// swallows it, which is the failure mode #247 was about in the first place.
	Reason string

	// Introduces names the findings that blocked the promotion: on the
	// candidate, on neither the running image's record nor the candidate's own,
	// and therefore new. Empty on a pass, so a promotion never implies findings
	// it does not have.
	Introduces []string
}