pbom

type ContainerImage struct {
	// Full image reference (e.g., "docker.io/library/golang:1.22-alpine")
	Image string `json:"image"`

	// Parsed components
	Registry string `json:"registry"`
	Name     string `json:"name"`
	Tag      string `json:"tag,omitempty"`

	// Usage context
	Jobs []string `json:"jobs"`

	// Compliance status (from analysis, if available)
	Authorized   *bool `json:"authorized,omitempty"`
	ForbiddenTag *bool `json:"forbiddenTag,omitempty"`
}

type CycloneDX struct {
	BOMFormat    string               `json:"bomFormat"`
	SpecVersion  string               `json:"specVersion"`
	Version      int                  `json:"version"`
	SerialNumber string               `json:"serialNumber"`
	Metadata     CycloneDXMetadata    `json:"metadata"`
	Components   []CycloneDXComponent `json:"components"`
}

type CycloneDXComponent struct {
	Type        string              `json:"type"`
	BOMRef      string              `json:"bom-ref,omitempty"`
	Name        string              `json:"name"`
	Version     string              `json:"version,omitempty"`
	Description string              `json:"description,omitempty"`
	Purl        string              `json:"purl,omitempty"`
	Properties  []CycloneDXProperty `json:"properties,omitempty"`
}

type CycloneDXMetadata struct {
	Timestamp  string              `json:"timestamp"`
	Tools      []CycloneDXTool     `json:"tools,omitempty"`
	Component  *CycloneDXComponent `json:"component,omitempty"`
	Properties []CycloneDXProperty `json:"properties,omitempty"`
}

type CycloneDXProperty struct {
	Name  string `json:"name"`
	Value string `json:"value"`
}

type CycloneDXTool struct {
	Vendor  string `json:"vendor"`
	Name    string `json:"name"`
	Version string `json:"version"`
}

type Generator struct {
	// contains filtered or unexported fields
}

type GitHubComplianceData struct {
	// ForbiddenTagImages keys on the full image reference
	// (`docker.io/golang:1.22`).
	ForbiddenTagImages map[string]bool
	// ImagesPinnedByDigest keys on the full image reference; true
	// when the image carries an `@sha256:…` suffix.
	ImagesPinnedByDigest map[string]bool
	// UnpinnedActions keys on the full action ref (`actions/checkout@v4`);
	// true when the ref is not a 40-char SHA.
	UnpinnedActions map[string]bool
	// ArchivedActions keys on the full action ref; true when the
	// upstream repository is archived (ISSUE-702). Sourced from the
	// per-action GitHub API metadata enrichment.
	ArchivedActions map[string]bool
	// VulnerableActions keys on the full action ref; true when the
	// upstream repository has at least one published GitHub Advisory
	// (ISSUE-703). Same metadata enrichment path as ArchivedActions.
	VulnerableActions map[string]bool
	// ActionAdvisories keys on the full action ref, value is the
	// list of GHSA IDs published against the action's repository.
	// Populated alongside VulnerableActions and surfaced into the
	// Include / CDX layer so consumers see which advisories triggered
	// the finding.
	ActionAdvisories map[string][]string
}

type ImageComplianceData struct {
	// ForbiddenTagImages maps image links to true if they use a forbidden tag
	ForbiddenTagImages map[string]bool
	// UnauthorizedImages maps image links to true if they are from unauthorized sources
	UnauthorizedImages map[string]bool
}

type Include struct {
	// Type of include: "component", "project", "local", "remote",
	// "template" (GitLab) or "action", "reusableWorkflow" (GitHub).
	Type string `json:"type"`

	// Location/path of the include
	Location string `json:"location"`

	// For project includes
	Project string `json:"project,omitempty"`

	// Version information
	Version       string `json:"version,omitempty"`
	LatestVersion string `json:"latestVersion,omitempty"`
	UpToDate      *bool  `json:"upToDate,omitempty"`

	// For components from GitLab CI/CD Catalog
	ComponentName string `json:"componentName,omitempty"`
	FromCatalog   bool   `json:"fromCatalog,omitempty"`

	// Whether this is a nested include (included by another include)
	Nested bool `json:"nested,omitempty"`

	// Override information (populated from control results)
	Overridden     bool                        `json:"overridden,omitempty"`
	OverriddenJobs []utils.OverriddenJobDetail `json:"overriddenJobs,omitempty"`

	// GitHub-only compliance enrichments populated from GitHubComplianceData.
	// Archived is true when the action's upstream repository is archived
	// (ISSUE-702). HasCVE is true when the action's upstream carries at
	// least one published GitHub Advisory (ISSUE-703). Advisories is the
	// list of GHSA IDs that triggered HasCVE.
	Archived   *bool    `json:"archived,omitempty"`
	HasCVE     *bool    `json:"hasCve,omitempty"`
	Advisories []string `json:"advisories,omitempty"`
}

type IncludeOverrideData struct {
	// Overrides maps a clean include path to its overridden job details
	Overrides map[string][]utils.OverriddenJobDetail
}

type PBOM struct {
	PBOMVersion string    `json:"pbomVersion"`
	GeneratedAt time.Time `json:"generatedAt"`

	Project ProjectInfo `json:"project"`

	Summary Summary `json:"summary"`

	PlumberScore *PlumberScoreSummary `json:"plumberScore,omitempty"`

	// Policies and PlatformGlobalScore are the platform-mode score block
	// (spec 2026-09-10-cli-platform-mode-policies-only s5). In that mode
	// there is no run-level score to put in PlumberScore: every verdict
	// belongs to one of the platform's policies, and the single global
	// figure is the platform's own, present only when the push returned one.
	// Both are absent from a standalone PBOM.
	Policies            []PolicyScore        `json:"policies,omitempty"`
	PlatformGlobalScore *PlatformGlobalScore `json:"platformGlobalScore,omitempty"`

	ContainerImages []ContainerImage `json:"containerImages"`
	Includes        []Include        `json:"includes"`
}

type PlatformGlobalScore struct {
	Letter string `json:"letter,omitempty"`
	Points int    `json:"points"`
}

type PlatformSummary struct {
	Policies                  []PolicyScore
	GlobalScore               *PlatformGlobalScore
	ForbiddenTagEvaluated     bool
	AuthorizedSourceEvaluated bool
}

type PlumberScoreCounts struct {
	Critical int `json:"critical"`
	High     int `json:"high"`
	Medium   int `json:"medium"`
	Low      int `json:"low"`
}

type PlumberScoreSummary struct {
	ProfileID            string             `json:"profileId"`
	RawPoints            float64            `json:"rawPoints"`
	FinalPoints          float64            `json:"finalPoints"`
	Score                string             `json:"score,omitempty"`
	CriticalMalusApplied bool               `json:"criticalMalusApplied,omitempty"`
	CriticalMalusMax     float64            `json:"criticalMalusMax,omitempty"`
	Counts               PlumberScoreCounts `json:"counts"`
}

type PolicyScore struct {
	Name        string `json:"name"`
	Enforcement string `json:"enforcement"`
	Score       string `json:"score,omitempty"`
	FinalPoints *int   `json:"finalPoints,omitempty"`
	Applied     bool   `json:"applied"`
	Reason      string `json:"reason,omitempty"`
}

type ProjectInfo struct {
	Path      string `json:"path"`
	ID        int    `json:"id,omitempty"`
	Provider  string `json:"provider,omitempty"`
	URL       string `json:"url,omitempty"`
	GitLabURL string `json:"gitlabUrl,omitempty"`
	Branch    string `json:"branch,omitempty"`
	// CommitSHA and Ref are the analyzed commit and its branch/tag (#443).
	// Empty when the commit could not be resolved.
	CommitSHA string `json:"commitSHA,omitempty"`
	Ref       string `json:"ref,omitempty"`
}

type Summary struct {
	// Image counts
	TotalImages      int `json:"totalImages"`
	UniqueRegistries int `json:"uniqueRegistries"`

	// Include counts
	TotalIncludes   int `json:"totalIncludes"`
	Components      int `json:"components"`
	ProjectIncludes int `json:"projectIncludes"`
	LocalIncludes   int `json:"localIncludes"`
	RemoteIncludes  int `json:"remoteIncludes"`
	Templates       int `json:"templates"`

	// GitHub-specific include counts. Always emitted (matches the
	// pattern the GitLab-side counters above use — zero is meaningful
	// and gets serialised as `0`, not dropped).
	Actions           int `json:"actions"`
	ReusableWorkflows int `json:"reusableWorkflows"`
}