pbom

type Capability struct {
	Kind     string `json:"kind"`
	Job      string `json:"job"`
	Tool     string `json:"tool"`
	Evidence string `json:"evidence"`
}

type ContainerImage struct {
	// Full image reference (e.g., "docker.io/library/golang:1.22-alpine")
	Image string `json:"image"`

	// Parsed components
	Registry string `json:"registry"`
	Name     string `json:"name"`
	Tag      string `json:"tag,omitempty"`

	// Usage context
	Jobs []string `json:"jobs"`

	// Unresolved reports that the reference still held a $VARIABLE after
	// substitution, so Registry, Name and Tag above were parsed out of a
	// placeholder rather than out of an image reference. The collector knows
	// this and the compliance enrichment already honours it (an unresolved
	// image claims no verdict); carrying it here lets a consumer that keys a
	// resource on the reference refuse to key one on a variable name.
	//
	// The inventory still LISTS the entry: the pipeline does declare it, and
	// the document's job is to say what the pipeline declares.
	Unresolved bool `json:"unresolved,omitempty"`

	// Nested reports a GitHub image no job runs itself: a `uses: docker://`
	// step a composite action pulls in. An image some job also runs directly
	// is not nested.
	Nested bool `json:"nested,omitempty"`

	// Via is the chain a nested image was pulled in through, outermost
	// first, the first one seen when it is reached on several paths (as for
	// Include.Via). Empty on a direct image.
	Via []string `json:"via,omitempty"`

	// Compliance status (from analysis, if available)
	Authorized   *bool `json:"authorized,omitempty"`
	ForbiddenTag *bool `json:"forbiddenTag,omitempty"`
}

type ContainerImageRef struct {
	Image    string `json:"image"`
	Registry string `json:"registry,omitempty"`
	Name     string `json:"name"`
	Tag      string `json:"tag,omitempty"`
	Digest   string `json:"digest,omitempty"`
	// Unresolved reports that the reference still held a $VARIABLE when it
	// was parsed, so the fields above describe a placeholder rather than an
	// image. See ContainerImage.Unresolved: same signal, same reason.
	Unresolved bool `json:"unresolved,omitempty"`
}

type CycloneDX struct {
	BOMFormat    string               `json:"bomFormat"`
	SpecVersion  string               `json:"specVersion"`
	Version      int                  `json:"version"`
	SerialNumber string               `json:"serialNumber"`
	Metadata     CycloneDXMetadata    `json:"metadata"`
	Components   []CycloneDXComponent `json:"components"`
}

type CycloneDXComponent struct {
	Type        string              `json:"type"`
	BOMRef      string              `json:"bom-ref,omitempty"`
	Name        string              `json:"name"`
	Version     string              `json:"version,omitempty"`
	Description string              `json:"description,omitempty"`
	Purl        string              `json:"purl,omitempty"`
	Properties  []CycloneDXProperty `json:"properties,omitempty"`
}

type CycloneDXMetadata struct {
	Timestamp  string              `json:"timestamp"`
	Tools      []CycloneDXTool     `json:"tools,omitempty"`
	Component  *CycloneDXComponent `json:"component,omitempty"`
	Properties []CycloneDXProperty `json:"properties,omitempty"`
}

type CycloneDXProperty struct {
	Name  string `json:"name"`
	Value string `json:"value"`
}

type CycloneDXTool struct {
	Vendor  string `json:"vendor"`
	Name    string `json:"name"`
	Version string `json:"version"`
}

type Generator struct {
	// contains filtered or unexported fields
}

type GitHubComplianceData struct {
	// ForbiddenTagImages keys on the full image reference
	// (`docker.io/golang:1.22`).
	ForbiddenTagImages map[string]bool
	// ImagesPinnedByDigest keys on the full image reference; true
	// when the image carries an `@sha256:…` suffix.
	ImagesPinnedByDigest map[string]bool
	// UnpinnedActions keys on the full action ref (`actions/checkout@v4`);
	// true when the ref is not a 40-char SHA.
	UnpinnedActions map[string]bool
	// ArchivedActions keys on the full action ref; true when the
	// upstream repository is archived (ISSUE-702). Sourced from the
	// per-action GitHub API metadata enrichment.
	ArchivedActions map[string]bool
	// VulnerableActions keys on the full action ref; true when the
	// upstream repository has at least one published GitHub Advisory
	// (ISSUE-703). Same metadata enrichment path as ArchivedActions.
	VulnerableActions map[string]bool
	// ActionAdvisories keys on the full action ref, value is the
	// list of GHSA IDs published against the action's repository.
	// Populated alongside VulnerableActions and surfaced into the
	// Include / CDX layer so consumers see which advisories triggered
	// the finding.
	ActionAdvisories map[string][]string
}

type ImageComplianceData struct {
	// ForbiddenTagImages maps image links to true if they use a forbidden tag
	ForbiddenTagImages map[string]bool
	// UnauthorizedImages maps image links to true if they are from unauthorized sources
	UnauthorizedImages map[string]bool
}

type Include struct {
	// Type of include: "component", "project", "local", "remote",
	// "template" (GitLab) or "action", "reusableWorkflow" (GitHub).
	Type string `json:"type"`

	// Location/path of the include
	Location string `json:"location"`

	// For project includes
	Project string `json:"project,omitempty"`

	// Version information
	Version       string `json:"version,omitempty"`
	LatestVersion string `json:"latestVersion,omitempty"`
	UpToDate      *bool  `json:"upToDate,omitempty"`

	// For components from GitLab CI/CD Catalog
	ComponentName string `json:"componentName,omitempty"`
	FromCatalog   bool   `json:"fromCatalog,omitempty"`

	// Whether this is a nested include (included by another include)
	Nested bool `json:"nested,omitempty"`

	// Via is the chain a nested GitHub include was pulled in through,
	// outermost first (spec 2026-10-16 section 8). Empty on a direct include.
	// When the include is reached on several paths, the chain of the first
	// one seen (the findings' identities tell the paths apart, the bill
	// does not). The platform push keeps its outermost 8 entries
	// (review of PR 549), the full chain stays here.
	Via []string `json:"via,omitempty"`

	// Override information (populated from control results)
	Overridden     bool                        `json:"overridden,omitempty"`
	OverriddenJobs []utils.OverriddenJobDetail `json:"overriddenJobs,omitempty"`

	// GitHub-only compliance enrichments populated from GitHubComplianceData.
	// Archived is true when the action's upstream repository is archived
	// (ISSUE-702). HasCVE is true when the action's upstream carries at
	// least one published GitHub Advisory (ISSUE-703). Advisories is the
	// list of GHSA IDs that triggered HasCVE.
	Archived   *bool    `json:"archived,omitempty"`
	HasCVE     *bool    `json:"hasCve,omitempty"`
	Advisories []string `json:"advisories,omitempty"`
}

type IncludeOverrideData struct {
	// Overrides maps a clean include path to its overridden job details
	Overrides map[string][]utils.OverriddenJobDetail
}

type JobResources struct {
	Name       string              `json:"name"`
	Services   []ContainerImageRef `json:"services,omitempty"`
	RunnerTags []string            `json:"runnerTags,omitempty"`
}

type PBOM struct {
	PBOMVersion string    `json:"pbomVersion"`
	GeneratedAt time.Time `json:"generatedAt"`

	Project ProjectInfo `json:"project"`

	Summary Summary `json:"summary"`

	PlumberScore *PlumberScoreSummary `json:"plumberScore,omitempty"`

	// Policies and PlatformGlobalScore are the platform-mode score block
	// (spec 2026-09-10-cli-platform-mode-policies-only s5). In that mode
	// there is no run-level score to put in PlumberScore: every verdict
	// belongs to one of the platform's policies, and the single global
	// figure is the platform's own, present only when the push returned one.
	// Both are absent from a standalone PBOM.
	Policies            []PolicyScore        `json:"policies,omitempty"`
	PlatformGlobalScore *PlatformGlobalScore `json:"platformGlobalScore,omitempty"`

	ContainerImages []ContainerImage `json:"containerImages"`
	Includes        []Include        `json:"includes"`

	// Jobs names the per-job resources the pipeline asks a runner for: the
	// service images started alongside the job, and the runner tags that
	// decide which runner picks it up. Only the jobs carrying at least one
	// of the two are listed, sorted by name.
	//
	// Absent, not empty, when the generator was never handed the pipeline
	// model: an empty list would read as "this pipeline has no service and
	// no runner tag" for a run that simply never looked.
	Jobs []JobResources `json:"jobs,omitempty"`

	// Capabilities lists what the pipeline's jobs do, as the CLI recognized it (package
	// capability): one entry per job and capability, with the tool and the evidence the
	// match rested on. Absent when nothing was recognized.
	Capabilities []Capability `json:"capabilities,omitempty"`
}

type PlatformGlobalScore struct {
	Letter string `json:"letter,omitempty"`
	Points int    `json:"points"`
}

type PlatformSummary struct {
	Policies                  []PolicyScore
	GlobalScore               *PlatformGlobalScore
	ForbiddenTagEvaluated     bool
	AuthorizedSourceEvaluated bool
}

type PlumberScoreCounts struct {
	Critical int `json:"critical"`
	High     int `json:"high"`
	Medium   int `json:"medium"`
	Low      int `json:"low"`
}

type PlumberScoreSummary struct {
	ProfileID            string             `json:"profileId"`
	RawPoints            float64            `json:"rawPoints"`
	FinalPoints          float64            `json:"finalPoints"`
	Score                string             `json:"score,omitempty"`
	CriticalMalusApplied bool               `json:"criticalMalusApplied,omitempty"`
	CriticalMalusMax     float64            `json:"criticalMalusMax,omitempty"`
	Counts               PlumberScoreCounts `json:"counts"`
	// PathCounts is the scoring-v4 attack-path count per tier, non-zero
	// tiers only; absent under scoring-v3.
	PathCounts map[string]int `json:"pathCounts,omitempty"`
}

type PolicyScore struct {
	Name        string `json:"name"`
	Enforcement string `json:"enforcement"`
	Score       string `json:"score,omitempty"`
	FinalPoints *int   `json:"finalPoints,omitempty"`
	Applied     bool   `json:"applied"`
	Reason      string `json:"reason,omitempty"`
}

type ProjectInfo struct {
	Path      string `json:"path"`
	ID        int    `json:"id,omitempty"`
	Provider  string `json:"provider,omitempty"`
	URL       string `json:"url,omitempty"`
	GitLabURL string `json:"gitlabUrl,omitempty"`
	Branch    string `json:"branch,omitempty"`
	// CommitSHA and Ref are the analyzed commit and its branch/tag (#443).
	// Empty when the commit could not be resolved.
	CommitSHA string `json:"commitSHA,omitempty"`
	Ref       string `json:"ref,omitempty"`
}

type Summary struct {
	// Image counts
	TotalImages      int `json:"totalImages"`
	UniqueRegistries int `json:"uniqueRegistries"`

	// Include counts
	TotalIncludes   int `json:"totalIncludes"`
	Components      int `json:"components"`
	ProjectIncludes int `json:"projectIncludes"`
	LocalIncludes   int `json:"localIncludes"`
	RemoteIncludes  int `json:"remoteIncludes"`
	Templates       int `json:"templates"`

	// GitHub-specific include counts. Always emitted (matches the
	// pattern the GitLab-side counters above use — zero is meaningful
	// and gets serialised as `0`, not dropped).
	Actions           int `json:"actions"`
	ReusableWorkflows int `json:"reusableWorkflows"`
}