cipolicy

type ArchiveComparison struct {
	Left  ArchiveSnapshot
	Right ArchiveSnapshot
}

type ArchiveEntry struct {
	Name       string
	Type       string
	Mode       int
	SHA256     string
	LineEnding string
	LinkTarget string
}

type ArchiveSnapshot struct {
	Platform string
	Entries  []ArchiveEntry
}

type ArtifactCheck struct {
	Expectation ArtifactExpectation
	Artifact    ArtifactManifest
}

type ArtifactContractManifest struct {
	SchemaVersion  int    `json:"schema_version"`
	ManifestDigest string `json:"manifest_digest"`
	ArtifactType   string `json:"artifact_type"`
	ArtifactID     string `json:"artifact_id"`
	ArtifactFormat string `json:"artifact_format"`
	ArtifactDigest string `json:"artifact_digest"`

	PolicyVersion   string         `json:"policy_version"`
	PolicyDigest    string         `json:"policy_digest"`
	PlanDigest      string         `json:"plan_digest"`
	ResultDigest    string         `json:"result_digest"`
	DetectorVersion string         `json:"detector_version"`
	DetectorDigest  string         `json:"detector_digest"`
	Source          SourceRevision `json:"source"`
	Event           EventSelection `json:"event"`
	TrustTier       string         `json:"trust_tier"`

	Mode         string            `json:"mode"`
	Coordinate   string            `json:"coordinate"`
	Capability   string            `json:"capability"`
	Platform     string            `json:"platform"`
	OS           string            `json:"os"`
	Architecture string            `json:"architecture"`
	CostClass    string            `json:"cost_class"`
	Requiredness string            `json:"requiredness"`
	Matrix       map[string]string `json:"matrix"`

	Dependencies []IdentityDigest   `json:"dependencies"`
	Toolchains   []IdentityDigest   `json:"toolchains"`
	BuildFlags   []BuildFlag        `json:"build_flags"`
	Files        []ArtifactFile     `json:"files"`
	Provenance   ArtifactProvenance `json:"provenance"`
}

type ArtifactExpectation struct {
	Plan          RunPlan
	Job           PlanJob
	Digest        string
	ProducerRunID string
	RunAttempt    int
	Now           time.Time
	MaxAge        time.Duration
}

type ArtifactFile struct {
	Path       string `json:"path"`
	Kind       string `json:"kind"`
	Mode       int64  `json:"mode"`
	Size       int64  `json:"size"`
	SHA256     string `json:"sha256"`
	LinkTarget string `json:"link_target,omitempty"`
}

type ArtifactManifest struct {
	Name           string
	Digest         string
	ContentDigest  string
	PlanDigest     string
	PolicyDigest   string
	SourceCommit   string
	SourceTree     string
	Mode           string
	Coordinate     string
	ProducerRunID  string
	RunAttempt     int
	CreatedAt      time.Time
	UploadComplete bool
}

type ArtifactManifestInput struct {
	ArtifactType   string
	ArtifactID     string
	ArtifactFormat string
	ArtifactDigest string
	Dependencies   []IdentityDigest
	Toolchains     []IdentityDigest
	BuildFlags     []BuildFlag
	Files          []ArtifactFile
	Provenance     ArtifactProvenance
}

type ArtifactProvenance struct {
	Workflow       string `json:"workflow"`
	WorkflowSHA256 string `json:"workflow_sha256"`
	RunID          int64  `json:"run_id"`
	RunAttempt     int    `json:"run_attempt"`
	JobID          string `json:"job_id"`
	JobName        string `json:"job_name"`
	ProducerStatus string `json:"producer_status"`
	UploadComplete bool   `json:"upload_complete"`
	ArtifactID     string `json:"artifact_id"`
	ArtifactDigest string `json:"artifact_digest"`
}

type ArtifactVerificationOptions struct {
	ArtifactType       string
	ArtifactID         string
	ArtifactDigest     string
	ProducerMode       string
	ProducerCoordinate string
	ConsumerPlan       RunPlan
	ConsumerJob        PlanJob
	Workflow           string
	RunID              int64
	RunAttempt         int
}

type BaselineInventory struct {
	Path             string `json:"path"`
	SchemaVersion    int    `json:"schema_version"`
	Digest           string `json:"digest"`
	ObservationState string `json:"observation_state"`
}

type BuildFlag struct {
	Name  string `json:"name"`
	Value string `json:"value"`
}

type CacheEntry struct {
	Key             string
	ToolchainDigest string
	Checksum        string
	TrustTier       string
	WrittenBy       string
	WriterDigest    string
	PlanDigest      string
	PolicyDigest    string
	SourceCommit    string
	SourceTree      string
	Mode            string
	Coordinate      string
	CreatedAt       time.Time
	ExpiresAt       time.Time
}

type CacheKeyMaterial struct {
	SchemaVersion int              `json:"schema_version"`
	PolicyVersion string           `json:"policy_version"`
	PolicyDigest  string           `json:"policy_digest"`
	Source        SourceRevision   `json:"source"`
	Mode          string           `json:"mode"`
	Coordinate    string           `json:"coordinate"`
	Capability    string           `json:"capability"`
	Platform      string           `json:"platform"`
	OS            string           `json:"os"`
	Architecture  string           `json:"architecture"`
	Dependencies  []IdentityDigest `json:"dependencies"`
	Toolchains    []IdentityDigest `json:"toolchains"`
	BuildFlags    []BuildFlag      `json:"build_flags"`
}

type CacheManifest struct {
	SchemaVersion  int    `json:"schema_version"`
	ManifestDigest string `json:"manifest_digest"`
	CacheKey       string `json:"cache_key"`
	CacheKeyDigest string `json:"cache_key_digest"`
	CacheFormat    string `json:"cache_format"`
	CacheDigest    string `json:"cache_digest"`

	PolicyVersion   string         `json:"policy_version"`
	PolicyDigest    string         `json:"policy_digest"`
	PlanDigest      string         `json:"plan_digest"`
	ResultDigest    string         `json:"result_digest"`
	DetectorVersion string         `json:"detector_version"`
	DetectorDigest  string         `json:"detector_digest"`
	Source          SourceRevision `json:"source"`
	Event           EventSelection `json:"event"`
	TrustTier       string         `json:"trust_tier"`

	Mode         string            `json:"mode"`
	Coordinate   string            `json:"coordinate"`
	Capability   string            `json:"capability"`
	Platform     string            `json:"platform"`
	OS           string            `json:"os"`
	Architecture string            `json:"architecture"`
	CostClass    string            `json:"cost_class"`
	Requiredness string            `json:"requiredness"`
	Matrix       map[string]string `json:"matrix"`

	Dependencies []IdentityDigest `json:"dependencies"`
	Toolchains   []IdentityDigest `json:"toolchains"`
	BuildFlags   []BuildFlag      `json:"build_flags"`
	Files        []ArtifactFile   `json:"files"`
	Provenance   CacheProvenance  `json:"provenance"`
}

type CacheManifestInput struct {
	CacheFormat  string
	CacheDigest  string
	Dependencies []IdentityDigest
	Toolchains   []IdentityDigest
	BuildFlags   []BuildFlag
	Files        []ArtifactFile
	Provenance   CacheProvenance
}

type CacheProvenance struct {
	Workflow       string `json:"workflow"`
	WorkflowSHA256 string `json:"workflow_sha256"`
	RunID          int64  `json:"run_id"`
	RunAttempt     int    `json:"run_attempt"`
	JobID          string `json:"job_id"`
	JobName        string `json:"job_name"`
	ProducerStatus string `json:"producer_status"`
	UploadComplete bool   `json:"upload_complete"`
	CacheKey       string `json:"cache_key"`
	CacheDigest    string `json:"cache_digest"`
}

type CacheReadOptions struct {
	Dependencies []IdentityDigest
	Toolchains   []IdentityDigest
	BuildFlags   []BuildFlag
}

type CacheRequest struct {
	Plan            RunPlan
	Job             PlanJob
	Key             string
	ToolchainDigest string
	Checksum        string
	TrustTier       string
	Now             time.Time
}

type CacheRestoreCheck struct {
	Job     PlanJob
	Request CacheRequest
	Entry   CacheEntry
}

type Capability struct {
	ID          string   `json:"id"`
	Owner       string   `json:"owner"`
	Description string   `json:"description"`
	Modes       []string `json:"modes"`
}

type Coordinate struct {
	ID           string            `json:"id"`
	Platform     string            `json:"platform"`
	Matrix       map[string]string `json:"matrix"`
	Requiredness string            `json:"requiredness"`
	GitHubName   string            `json:"github_name"`
	EvidenceRefs []string          `json:"evidence_refs"`
	Trace        LegacyTrace       `json:"trace"`
}

type CostClass struct {
	ID          string `json:"id"`
	Owner       string `json:"owner"`
	Description string `json:"description"`
}

type CredentialOperation struct {
	Operation  string
	TrustTier  string
	Capability string
	Token      SyntheticToken
	Target     string
}

type Detection struct {
	DetectorVersion    string   `json:"detector_version"`
	DetectorDigest     string   `json:"detector_digest"`
	ExactFileList      bool     `json:"exact_file_list"`
	ChangedFilesDigest string   `json:"changed_files_digest"`
	Capabilities       []string `json:"capabilities"`
	Superset           bool     `json:"superset"`
	SupersetReasons    []string `json:"superset_reasons"`
	Errors             []string `json:"errors"`
}

type EventIdentity struct {
	ID          string   `json:"id"`
	Source      string   `json:"source"`
	GitHubEvent string   `json:"github_event"`
	Refs        []string `json:"refs"`
	TrustTiers  []string `json:"trust_tiers"`
	Description string   `json:"description"`
}

type EventInput struct {
	Source              string `json:"source"`
	GitHubEvent         string `json:"github_event"`
	Ref                 string `json:"ref"`
	BaseRef             string `json:"base_ref"`
	HeadRef             string `json:"head_ref"`
	BaseRepository      string `json:"base_repository"`
	HeadRepository      string `json:"head_repository"`
	Commit              string `json:"commit"`
	Tree                string `json:"tree"`
	PullRequestFork     bool   `json:"pull_request_fork"`
	SameRepositoryAgent bool   `json:"same_repository_agent"`
	TrustedBase         bool   `json:"trusted_base"`
	Publication         bool   `json:"publication"`
}

type EventSelection struct {
	Source              string `json:"source"`
	Event               string `json:"event"`
	GitHubEvent         string `json:"github_event"`
	Ref                 string `json:"ref"`
	BaseRef             string `json:"base_ref"`
	HeadRef             string `json:"head_ref"`
	BaseRepository      string `json:"base_repository"`
	HeadRepository      string `json:"head_repository"`
	PullRequestFork     bool   `json:"pull_request_fork"`
	SameRepositoryAgent bool   `json:"same_repository_agent"`
	TrustedBase         bool   `json:"trusted_base"`
	Publication         bool   `json:"publication"`
}

type FanInDecision struct {
	Mode       string `json:"mode"`
	Coordinate string `json:"coordinate"`
	Status     string `json:"status"`
	Reason     string `json:"reason"`
}

type FanInReport struct {
	SchemaVersion int             `json:"schema_version"`
	PlanDigest    string          `json:"plan_digest"`
	PolicyDigest  string          `json:"policy_digest"`
	Source        SourceRevision  `json:"source"`
	Event         EventSelection  `json:"event"`
	TrustTier     string          `json:"trust_tier"`
	Status        string          `json:"status"`
	Accepted      []FanInDecision `json:"accepted"`
	Rejected      []FanInDecision `json:"rejected"`
}

type FaultInjection struct {
	ID    string
	Apply func(*FixtureRun)
}

type FixtureFile struct {
	Path    string `json:"path"`
	SHA256  string `json:"sha256"`
	Content []byte `json:"-"`
}

type FixtureRun struct {
	Manifest             Manifest
	KnownFiles           []FixtureFile
	Environment          map[string]string
	PlanOptions          PlanOptions
	WorkflowData         GeneratedWorkflowData
	Observations         []JobObservation
	CacheRestores        []CacheRestoreCheck
	Artifacts            []ArtifactCheck
	ArchiveComparisons   []ArchiveComparison
	CredentialOperations []CredentialOperation
	Now                  time.Time
}

type GeneratedUnsupported struct {
	Mode         string `json:"mode"`
	Coordinate   string `json:"coordinate"`
	Platform     string `json:"platform"`
	TrustTier    string `json:"trust_tier"`
	Requiredness string `json:"requiredness"`
	Status       string `json:"status,omitempty"`
}

type GeneratedWorkflowData struct {
	SchemaVersion int                    `json:"schema_version"`
	PolicyVersion string                 `json:"policy_version"`
	PolicyDigest  string                 `json:"policy_digest"`
	PlanDigest    string                 `json:"plan_digest"`
	Jobs          []GeneratedWorkflowJob `json:"jobs"`
	Unsupported   []GeneratedUnsupported `json:"unsupported"`
}

type GeneratedWorkflowJob struct {
	Mode       string            `json:"mode"`
	Coordinate string            `json:"coordinate"`
	GitHubName string            `json:"github_name"`
	Display    string            `json:"display"`
	Platform   string            `json:"platform"`
	TrustTier  string            `json:"trust_tier"`
	Matrix     map[string]string `json:"matrix"`
}

type IdentityDigest struct {
	ID      string `json:"id"`
	Version string `json:"version"`
	Digest  string `json:"digest"`
}

type JobObservation struct {
	Mode           string
	Coordinate     string
	Display        string
	Status         string
	FailureClass   string
	StartedAt      time.Time
	CompletedAt    time.Time
	EvidenceDigest string
	ArtifactDigest string
	CacheDigest    string
	SupersededBy   string
	UploadComplete bool
}

type LegacyTrace struct {
	InventoryMapping string `json:"inventory_mapping"`
	LegacyWorkflow   string `json:"legacy_workflow"`
	LegacyJob        string `json:"legacy_job"`
	WorkflowPath     string `json:"workflow_path"`
	WorkflowSHA256   string `json:"workflow_sha256"`
	LegacyCondition  string `json:"legacy_condition"`
	SkipSemantics    string `json:"skip_semantics"`
}

type Manifest struct {
	SchemaVersion int                   `json:"schema_version"`
	PolicyVersion string                `json:"policy_version"`
	PolicyDigest  string                `json:"policy_digest"`
	Source        SourceIdentity        `json:"source"`
	TrustTiers    []TrustTier           `json:"trust_tiers"`
	Events        []EventIdentity       `json:"events"`
	Platforms     []Platform            `json:"platforms"`
	CostClasses   []CostClass           `json:"cost_classes"`
	Capabilities  []Capability          `json:"capabilities"`
	Modes         []Mode                `json:"modes"`
	Unsupported   []UnsupportedDecision `json:"unsupported"`
}

type Mode struct {
	ID           string        `json:"id"`
	Capability   string        `json:"capability"`
	Owner        string        `json:"owner"`
	Requiredness string        `json:"requiredness"`
	CostClass    string        `json:"cost_class"`
	ProofType    string        `json:"proof_type"`
	SourceEvents []SourceEvent `json:"source_events"`
	TrustTiers   []string      `json:"trust_tiers"`
	Coordinates  []Coordinate  `json:"coordinates"`
	EvidenceRefs []string      `json:"evidence_refs"`
	Trace        LegacyTrace   `json:"trace"`
}

type P11CompatibilityComparison struct {
	ID              string
	HelperPath      string
	PlanDigest      string
	TrustTier       string
	Capabilities    []string
	RequiredModes   []string
	Coordinates     []string
	Superset        bool
	SupersetReasons []string
	FanInStatus     string
	AcceptedCount   int
}

type P11CompatibilitySample struct {
	ID                         string
	HelperPath                 string
	Description                string
	PlanOptions                PlanOptions
	ExpectedTrustTier          string
	ExpectedCapabilities       []string
	ExpectedSupersetReasons    []string
	ExpectedManifestModes      []P11ManifestModeExpectation
	ExpectedPresentCoordinates []string
	ExpectedAbsentCoordinates  []string
	CredentialExpectations     []P11CredentialExpectation
}

type P11CompatibilitySampleRequirement struct {
	ID          string
	Description string
}

type P11CredentialExpectation struct {
	Operation           CredentialOperation
	Allowed             bool
	BindToPlan          bool
	PlanTrustTier       string
	CredentialTrustTier string
	WantErrorSubstr     string
}

type P11JSHelperContract struct {
	Path                 string
	Owner                string
	Kind                 string
	Callers              []string
	PolicyInputs         []string
	PolicyOutputs        []string
	Disposition          string
	ExecutableContract   string
	DeletionCriterion    string
	CompatibilitySamples []P11CompatibilitySampleRequirement
	Tranche              string
}

type P11ManifestCoordinateExpectation struct {
	ID           string
	Requiredness string
}

type P11ManifestModeExpectation struct {
	ID           string
	Capability   string
	Requiredness string
	TrustTiers   []string
	Coordinates  []P11ManifestCoordinateExpectation
}

type P11WorkflowJob struct {
	Name                  string
	If                    string
	Needs                 []string
	RunsOn                string
	Permissions           map[string]string
	PermissionsExpression string
	Env                   map[string]string
	Steps                 []P11WorkflowStep
}

type P11WorkflowStep struct {
	Name string
	Uses string
	If   string
	Env  map[string]string
	With map[string]string
	Run  string
}

type P11WorkflowSummary struct {
	Name                  string
	Events                []string
	Permissions           map[string]string
	PermissionsExpression string
	Env                   map[string]string
	Jobs                  map[string]P11WorkflowJob
}

type PlanJob struct {
	Source       string            `json:"source"`
	Event        string            `json:"event"`
	TrustTier    string            `json:"trust_tier"`
	Mode         string            `json:"mode"`
	Coordinate   string            `json:"coordinate"`
	Capability   string            `json:"capability"`
	Platform     string            `json:"platform"`
	CostClass    string            `json:"cost_class"`
	Requiredness string            `json:"requiredness"`
	Owner        string            `json:"owner"`
	GitHubName   string            `json:"github_name"`
	Matrix       map[string]string `json:"matrix"`
	EvidenceRefs []string          `json:"evidence_refs"`
}

type PlanOptions struct {
	Event           EventInput
	ChangedFiles    []string
	ExactFileList   bool
	DetectorVersion string
	DetectorErrors  []string
	CreatedAt       time.Time
	ExpiresAt       time.Time
	Now             time.Time
	PlanTTL         time.Duration
}

type PlanUnsupportedDecision struct {
	Mode              string   `json:"mode"`
	Coordinate        string   `json:"coordinate"`
	Source            string   `json:"source"`
	Event             string   `json:"event"`
	Platform          string   `json:"platform"`
	TrustTier         string   `json:"trust_tier"`
	Requiredness      string   `json:"requiredness"`
	Owner             string   `json:"owner"`
	Rationale         string   `json:"rationale"`
	Expires           string   `json:"expires"`
	SilentPassAllowed bool     `json:"silent_pass_allowed"`
	EvidenceRefs      []string `json:"evidence_refs"`
}

type Platform struct {
	ID           string `json:"id"`
	Owner        string `json:"owner"`
	RunnerLabel  string `json:"runner_label"`
	OS           string `json:"os"`
	Architecture string `json:"architecture"`
	Description  string `json:"description"`
}

type ResultAttempt struct {
	Attempt        int       `json:"attempt"`
	Status         string    `json:"status"`
	FailureClass   string    `json:"failure_class"`
	StartedAt      time.Time `json:"started_at"`
	CompletedAt    time.Time `json:"completed_at"`
	EvidenceDigest string    `json:"evidence_digest"`
	ArtifactDigest string    `json:"artifact_digest"`
	CacheDigest    string    `json:"cache_digest"`
}

type ResultRecord struct {
	SchemaVersion     int               `json:"schema_version"`
	ResultDigest      string            `json:"result_digest"`
	PlanDigest        string            `json:"plan_digest"`
	PolicyVersion     string            `json:"policy_version"`
	PolicyDigest      string            `json:"policy_digest"`
	DetectorVersion   string            `json:"detector_version"`
	DetectorDigest    string            `json:"detector_digest"`
	Source            SourceRevision    `json:"source"`
	Event             EventSelection    `json:"event"`
	TrustTier         string            `json:"trust_tier"`
	Mode              string            `json:"mode"`
	Coordinate        string            `json:"coordinate"`
	Capability        string            `json:"capability"`
	Platform          string            `json:"platform"`
	CostClass         string            `json:"cost_class"`
	Requiredness      string            `json:"requiredness"`
	Owner             string            `json:"owner"`
	Matrix            map[string]string `json:"matrix"`
	Attempts          []ResultAttempt   `json:"attempts"`
	FirstStatus       string            `json:"first_status"`
	FirstFailureClass string            `json:"first_failure_class"`
	Status            string            `json:"status"`
	FailureClass      string            `json:"failure_class"`
	StartedAt         time.Time         `json:"started_at"`
	CompletedAt       time.Time         `json:"completed_at"`
	EvidenceDigest    string            `json:"evidence_digest"`
	ArtifactDigest    string            `json:"artifact_digest"`
	CacheDigest       string            `json:"cache_digest"`
	SupersededBy      string            `json:"superseded_by"`
}

type RunPlan struct {
	SchemaVersion        int                       `json:"schema_version"`
	PlanDigest           string                    `json:"plan_digest"`
	PolicyVersion        string                    `json:"policy_version"`
	PolicyDigest         string                    `json:"policy_digest"`
	DetectorVersion      string                    `json:"detector_version"`
	DetectorDigest       string                    `json:"detector_digest"`
	Source               SourceRevision            `json:"source"`
	Event                EventSelection            `json:"event"`
	TrustTier            string                    `json:"trust_tier"`
	DetectedCapabilities []string                  `json:"detected_capabilities"`
	Capabilities         []string                  `json:"capabilities"`
	RequiredModes        []string                  `json:"required_modes"`
	Jobs                 []PlanJob                 `json:"jobs"`
	Unsupported          []PlanUnsupportedDecision `json:"unsupported"`
	ExactFileList        bool                      `json:"exact_file_list"`
	ChangedFilesDigest   string                    `json:"changed_files_digest"`
	Superset             bool                      `json:"superset"`
	SupersetReasons      []string                  `json:"superset_reasons"`
	DetectorErrors       []string                  `json:"detector_errors"`
	CreatedAt            time.Time                 `json:"created_at"`
	ExpiresAt            time.Time                 `json:"expires_at"`
}

type SourceEvent struct {
	Source string `json:"source"`
	Event  string `json:"event"`
}

type SourceIdentity struct {
	ID                string            `json:"id"`
	Repository        string            `json:"repository"`
	DefaultBranch     string            `json:"default_branch"`
	PolicyPath        string            `json:"policy_path"`
	BaselineInventory BaselineInventory `json:"baseline_inventory"`
}

type SourceRevision struct {
	Repository     string `json:"repository"`
	Ref            string `json:"ref"`
	Commit         string `json:"commit"`
	Tree           string `json:"tree"`
	BaseRef        string `json:"base_ref"`
	HeadRef        string `json:"head_ref"`
	HeadRepository string `json:"head_repository"`
}

type SyntheticToken struct {
	Name         string
	TrustTier    string
	Class        string
	Scopes       []string
	AllowedRoots []string
}

type TrustTier struct {
	ID                     string `json:"id"`
	Owner                  string `json:"owner"`
	Description            string `json:"description"`
	PublicationCredentials bool   `json:"publication_credentials"`
}

type UnsupportedDecision struct {
	Mode              string   `json:"mode"`
	Coordinate        string   `json:"coordinate"`
	Source            string   `json:"source"`
	Event             string   `json:"event"`
	Platform          string   `json:"platform"`
	TrustTier         string   `json:"trust_tier"`
	Requiredness      string   `json:"requiredness"`
	Owner             string   `json:"owner"`
	Rationale         string   `json:"rationale"`
	Expires           string   `json:"expires"`
	SilentPassAllowed bool     `json:"silent_pass_allowed"`
	EvidenceRefs      []string `json:"evidence_refs"`
}