ir

type Action struct {
	Uses string         `json:"uses"`
	With map[string]any `json:"with,omitempty"`
	// Name is the step's `name:` from the workflow YAML, when the author
	// provided one. It is the only stable discriminator between two steps in
	// the same job that reference the same action: the line number tells them
	// apart within a scan but moves whenever unrelated code above them is
	// edited, so the name is what a run-over-run identifier can rely on.
	Name string `json:"name,omitempty"`
	// Line is the 1-based line number of the `uses:` directive in the
	// source workflow file. Populated by the provider collector so
	// action-level findings can point the reviewer at the exact step
	// instead of the surrounding job header. Zero when unknown.
	Line int `json:"line,omitempty"`
	// If is the step-level `if:` expression guarding this action step
	// (GitHub Actions), verbatim from the workflow YAML, "" when the
	// step is unconditional. Policies that reason per trigger can use
	// it to exclude the step from events its condition rules out.
	If       string          `json:"if,omitempty"`
	Metadata *ActionMetadata `json:"metadata,omitempty"`
	Comment  string          `json:"comment,omitempty"`
	// Nested is true when the step was not written in the scanned workflow but
	// pulled in by a composite action or a called workflow (spec 2026-10-16, R1).
	Nested bool `json:"nested,omitempty"`
	// Via is the chain of references the step was reached through, outermost
	// first, as written in the file that pulled each one in:
	// ["thomasboni/nested-actions-b@main", "thomasboni/nested-actions-d@main"].
	Via []string `json:"via,omitempty"`
	// DefinedIn locates the uses: line inside the container that holds it,
	// "owner/repo@ref:path/action.yml:9" (a local composite: "./.github/actions/x/action.yml:4").
	DefinedIn string `json:"definedIn,omitempty"`
}

type ActionMetadata struct {
	RepoArchived bool `json:"repoArchived,omitempty"`
	RefExists    bool `json:"refExists,omitempty"`
	// RefKnownAbsent is true ONLY when the upstream API definitively
	// answered that the ref does not exist (a 404 / 422 on a readable
	// repo). It stays false when the ref could not be verified (private
	// repo, rate limit, network error) so impostor-commit (ISSUE-707)
	// never flags a valid SHA it merely failed to reach.
	RefKnownAbsent bool   `json:"refKnownAbsent,omitempty"`
	RefKind        string `json:"refKind,omitempty"`
	// RefCommitSha is set only when the pinned ref is the SHA of an
	// annotated tag OBJECT: it carries the commit that tag object
	// dereferences to. Empty for every other ref shape, including a
	// plain commit pin (there the ref already IS the commit).
	RefCommitSha     string   `json:"refCommitSha,omitempty"`
	TagSha           string   `json:"tagSha,omitempty"`
	LatestTag        string   `json:"latestTag,omitempty"`
	LatestReleaseSha string   `json:"latestReleaseSha,omitempty"`
	CommentVersion   string   `json:"commentVersion,omitempty"`
	CommentTagSha    string   `json:"commentTagSha,omitempty"`
	RefIsAmbiguous   bool     `json:"refIsAmbiguous,omitempty"`
	Advisories       []string `json:"advisories,omitempty"`
	// AdvisorySeverities maps a GHSA id of Advisories to the severity the
	// GitHub Advisory Database rates it with, lower-cased (low, medium,
	// high, critical); an id it did not rate is absent. The path assembly
	// caps an ISSUE-703 path by the worst of them.
	AdvisorySeverities map[string]string `json:"advisorySeverities,omitempty"`
	// StargazersCount is the action repository's star count, resolved
	// from the GitHub API at collect time. Consumed by the authorized-
	// sources control (ISSUE-713) to enforce a minimum-stars trust
	// threshold. Zero when enrichment did not run or the repo was
	// unreachable — policies must abstain rather than flag on absence.
	StargazersCount int `json:"stargazersCount,omitempty"`
	// MutableRemoteExec, when set, records that the action's own source
	// fetches code or a download-steering manifest from a MOVING ref
	// (main/master/HEAD/…) at runtime — so pinning this action by SHA
	// does not make its execution immutable. Nil when the source was not
	// analysed (offline, non-github.com host, trusted owner) or nothing
	// mutable was found. Consumed by the mutable-remote-exec control.
	MutableRemoteExec *MutableRemoteExec `json:"mutableRemoteExec,omitempty"`
	// RedirectedOwner is the owner the action's repository currently
	// reports as its full_name (the metadata lane's own `GET
	// repos/{owner}/{repo}` call), when it differs from the `uses`
	// owner, case insensitive. GitHub keeps the old owner/repo path
	// resolving after a rename or an organisation transfer, so this is
	// who can actually change the code, not who the workflow still
	// names. Empty when the names agree or the repository could not be
	// read.
	RedirectedOwner string `json:"redirectedOwner,omitempty"`
}

type AnalyzedWorkflow struct {
	Path    string
	Content string
}

type ArtifactRef struct {
	Name    string   `json:"name,omitempty"`
	Pattern string   `json:"pattern,omitempty"`
	Paths   []string `json:"paths,omitempty"`
	Mode    string   `json:"mode"` // "produce" or "consume"
	// CrossRun is true on a consume entry that reads another workflow
	// run's artifacts (GitHub download-artifact with a run-id input), the
	// one way an artifact crosses workflow files.
	CrossRun bool `json:"crossRun,omitempty"`
}

type Branch struct {
	Name                      string `json:"name"`
	Protected                 bool   `json:"protected"`
	ProtectionPattern         string `json:"protectionPattern,omitempty"`
	AllowForcePush            bool   `json:"allowForcePush,omitempty"`
	CodeOwnerApprovalRequired bool   `json:"codeOwnerApprovalRequired,omitempty"`
	MinPushAccessLevel        int    `json:"minPushAccessLevel,omitempty"`
	MinMergeAccessLevel       int    `json:"minMergeAccessLevel,omitempty"`
	ProtectionDetailsKnown    bool   `json:"protectionDetailsKnown,omitempty"`
}

type CacheModeDecl struct {
	Value     string `json:"value"`
	Effective string `json:"effective,omitempty"`
	Line      int    `json:"line"`
	Level     string `json:"level"`
}

type CacheRef struct {
	// Key is what a restore and a save must share for one to read the
	// other: the actions/cache key as written, or the key a caching action
	// builds (its discriminators included: a dependency path, a buildx
	// scope, a job id). Family is the name a reader recognizes, the key
	// without the part that tells two caches of one kind apart; empty when
	// it is the key itself.
	Key    string   `json:"key,omitempty"`
	Family string   `json:"family,omitempty"`
	Paths  []string `json:"paths,omitempty"`
	Mode   string   `json:"mode"` // "restore", "save" or "both"
	Prefix bool     `json:"prefix,omitempty"`
	Uses   string   `json:"uses,omitempty"`
	Line   int      `json:"line,omitempty"`
	// Parts is the discriminators of the real key a caching action builds
	// itself, resolved to a concrete value, by name: "os", "arch"
	// (read off the job's own runs-on, every caching action), "version"
	// and "manager" (setup-node, setup-python, setup-go; the input that
	// gives it, when it is a literal, never a `.nvmrc`/a `*-version-file`
	// or an expression), "job" and "key" (Swatinem/rust-cache, the job id
	// and the key/shared-key input when literal). A discriminator this
	// program cannot resolve is absent here, never guessed; the situation
	// layer's key-template match (control/cachekeys.go) then leaves it an
	// open placeholder.
	Parts map[string]string `json:"parts,omitempty"`
}

type DependabotConfig struct {
	Path                   string   `json:"path"`
	InsecureExecEcosystems []string `json:"insecureExecEcosystems,omitempty"`
	// MissingCooldownEcosystems lists ecosystems in the config that
	// have no `cooldown:` block. A cooldown window gives security
	// advisory pipelines time to flag a bad release before
	// Dependabot's PR automation picks it up.
	MissingCooldownEcosystems []string `json:"missingCooldownEcosystems,omitempty"`
}

type Dockerfile struct {
	Path  string           `json:"path"`
	Bases []DockerfileBase `json:"bases,omitempty"`
}

type DockerfileBase struct {
	Image          string `json:"image"`
	Line           int    `json:"line"`
	PinnedByDigest bool   `json:"pinnedByDigest,omitempty"`
}

type Environment struct {
	Name              string `json:"name"`
	Known             bool   `json:"known,omitempty"`
	RequiredReviewers bool   `json:"requiredReviewers,omitempty"`
	Reviewers         int    `json:"reviewers,omitempty"`
	PreventSelfReview bool   `json:"preventSelfReview,omitempty"`
	WaitTimer         int    `json:"waitTimer,omitempty"`
	BranchPolicy      bool   `json:"branchPolicy,omitempty"`
}

type Function struct {
	Name string `json:"name,omitempty"`
	Ref  string `json:"ref"`
	Kind string `json:"kind"`
	// Deprecated is true when the step used the legacy `step:` key
	// (renamed to `func:`) or Kind is "git" (deprecated git-repository
	// loading, superseded by OCI registry refs).
	Deprecated bool `json:"deprecated,omitempty"`
}

type Gate struct {
	Class     GateClass `json:"class"`
	Reason    string    `json:"reason,omitempty"`
	PinnedSha bool      `json:"pinnedSha,omitempty"`
	// Unknown lists the references ClassifyGate could not resolve when
	// Class is GateUnknown.
	Unknown []string `json:"unknown,omitempty"`
}

type GateClass string

type Image struct {
	Name                string `json:"name"`
	Tag                 string `json:"tag,omitempty"`
	Digest              string `json:"digest,omitempty"`
	Registry            string `json:"registry,omitempty"`
	CredentialsPassword string `json:"credentialsPassword,omitempty"`
	// Unresolved reports that the reference still held a `$VARIABLE` when it
	// was parsed, so Registry, Name and Tag describe a placeholder rather
	// than an image. A rule that judges a registry or a tag must skip such an
	// image: those fields are present and WRONG, not absent, so a rule that
	// merely checks for emptiness would answer confidently over a guess.
	//
	// The zero value is "resolved", so every hand-built fixture and every
	// provider that does not set it behaves exactly as before.
	Unresolved bool `json:"unresolved,omitempty"`
}

type Include struct {
	Kind    string `json:"kind"`
	Source  string `json:"source"`
	Ref     string `json:"ref,omitempty"`
	Current string `json:"current,omitempty"`
	Path    string `json:"path,omitempty"`
	AltPath string `json:"altPath,omitempty"`
	// TemplatePath is the template's own identity, read from its pinned
	// ref rather than from where its file happens to live. A template
	// repository can tag a file under a name that has nothing to do with
	// its file path (a template "gitleaks" served from
	// jobs/gitleaks/gitleaks.yml, say), in which case neither Path nor
	// AltPath ever equals what a policy requires - only this field does.
	// Empty when the collector could not establish it.
	TemplatePath  string `json:"templatePath,omitempty"`
	Nested        bool   `json:"nested,omitempty"`
	ComponentName string `json:"componentName,omitempty"`
	// RefIsAmbiguous is set by the collector when the include's
	// symbolic ref resolves upstream as BOTH a tag and a branch
	// (ref-confusion, ISSUE-402). Zero-valued when the ref is a SHA,
	// `~latest`, or when the API probe could not confirm both — the
	// rule fires only on a positive double-hit, so a degraded probe
	// never invents a finding.
	RefIsAmbiguous bool `json:"refIsAmbiguous,omitempty"`
	// OriginFile + OriginLine point at the line in the user's
	// .gitlab-ci.yml that introduced this include. They let rules
	// emit findings with a clickable source pointer instead of a
	// repo-level "somewhere in the config" reference. Empty for
	// nested includes pulled in transitively by an upstream
	// component.
	OriginFile string `json:"originFile,omitempty"`
	OriginLine int    `json:"originLine,omitempty"`
	// OriginHash is a stable identifier for the origin of this
	// include, used by external tooling to deduplicate the same
	// upstream source across pipelines.
	OriginHash     uint64          `json:"originHash,omitempty"`
	OverriddenJobs []OverriddenJob `json:"overriddenJobs,omitempty"`
	// OverrideFingerprint is the canonical digest of the override
	// content above (see OverrideFingerprint). It lets a consumer tell
	// "the same override as last time" from "the override changed"
	// without carrying the content itself. Empty when nothing is
	// overridden.
	OverrideFingerprint string `json:"overrideFingerprint,omitempty"`
}

type Job struct {
	Name  string `json:"name"`
	Image *Image `json:"image,omitempty"`
	// MatrixCombinations is the combinations the job's `strategy.matrix` runs,
	// each as its keys' literal values, kept by the collector to resolve
	// a reusable workflow call's inputs built from them; never part of
	// the evaluation input.
	MatrixCombinations []map[string]string `json:"-"`
	// ImageRef is the container reference as written, kept by the
	// collector to resolve a reference built from a reusable workflow's
	// inputs against each caller; never part of the evaluation input.
	ImageRef string  `json:"-"`
	Services []Image `json:"services,omitempty"`
	// MatrixImages are the images Image resolves to when its reference is
	// built from `${{ matrix.X }}` values the job's matrix lists as
	// literals (GitHub `strategy.matrix`): one per value, sorted. The
	// image policies judge these instead of the reference as written.
	// Empty when the reference holds no matrix value, holds another
	// expression, or the matrix is computed at run time.
	MatrixImages []Image `json:"matrixImages,omitempty"`
	// Tags are the job's runner tags (GitLab's `tags:` keyword), read off
	// the merged configuration so a tag inherited from `default:` counts
	// exactly as a job-level one does. Sorted and de-duplicated, so the
	// order never depends on how the pipeline was authored. Empty for a job
	// that names no tag, which is the honest answer: the job runs on
	// whichever runner the instance picks, and no tag is claimed for it.
	Tags    []string `json:"tags,omitempty"`
	Scripts []string `json:"scripts,omitempty"`
	// ScriptBlocks names the source block ("before_script", "script",
	// "after_script") for each entry of Scripts, in the same order.
	// Lets script-scanning policies surface where the offending line
	// lives so legacy consumers (the Rego-port issue payload) can
	// echo the v0.2.x scriptBlock attribute. Empty when the collector
	// did not track origins (older fixtures).
	ScriptBlocks []string `json:"scriptBlocks,omitempty"`
	// ScriptIfs carries each Scripts entry's step-level `if:` expression
	// (GitHub Actions), in the same order as Scripts, "" for a step that
	// declared none. Set only when at least one run step in the job is
	// conditional, so the field stays absent in the common unconditional
	// case. Read by the situation facts alongside the job's texts.
	ScriptIfs    []string          `json:"scriptIfs,omitempty"`
	AllowFailure bool              `json:"allowFailure,omitempty"`
	When         string            `json:"when,omitempty"`
	Variables    map[string]string `json:"variables,omitempty"`
	// LocalVariables is the raw `variables:` map authored by the
	// project itself (root .gitlab-ci.yml or workflow file), before any
	// merge with upstream component/template definitions. Empty when
	// the user did not declare a `variables:` block on this job —
	// distinguishing "user wrote SAST_DISABLED here" from "upstream
	// template ships SAST_DISABLED". Variable-override policies must
	// read this field, never the merged Variables, to avoid punishing
	// projects for variables their upstream catalogs already set.
	LocalVariables map[string]string `json:"localVariables,omitempty"`
	// Rules captures the job's `rules:` block (GitLab CI). Each entry
	// is a {if, when, allow_failure, exists, changes, …} map; rules
	// such as `- when: never` neutralise the job at runtime even when
	// the job is otherwise correctly configured. Policies that care
	// about effective execution (security-job weakening) read this
	// list and reject any rule whose terminal `when` would prevent
	// the job from running.
	Rules []map[string]any `json:"rules,omitempty"`
	// Only and Except capture GitLab's legacy `only:`/`except:` keywords,
	// string refs only (branches, tags, merge_requests, schedules, …).
	// The map form (`only: {refs: [...]}`) flattens to its `refs` list;
	// the `variables`/`changes` conditions of that map form are dropped,
	// since they cannot be decided statically. A job with a `rules:`
	// block never has these: GitLab treats `rules` and `only`/`except`
	// as mutually exclusive.
	Only       []string `json:"only,omitempty"`
	Except     []string `json:"except,omitempty"`
	OriginFile string   `json:"originFile,omitempty"`
	OriginLine int      `json:"originLine,omitempty"`
	OriginKind string   `json:"originKind,omitempty"`
	// Functions lists this job's `run:`-step function references
	// (docs.gitlab.com/ci/functions, GitLab CI only). Kind classifies
	// the reference form so policies can skip same-repo file
	// references (no supply-chain concern) and flag deprecated forms
	// independently of trust.
	Functions []Function `json:"functions,omitempty"`
	// Overridden is true when the job inherits from an upstream
	// component or template but the project locally redefined some of
	// its keys. Lets policies distinguish "user-authored override" from
	// "vanilla upstream definition" — the rules-redefinition guard in
	// security_jobs_weakened depends on this signal.
	Overridden bool `json:"overridden,omitempty"`
	// OverriddenKeys lists the specific job-level keys the project
	// redefined when overriding an upstream definition (`rules`,
	// `image`, `when`, …). Empty when the job was not overridden,
	// which lets policies target a particular kind of override
	// (rules redefinition, image substitution, …) without flagging
	// every override globally.
	OverriddenKeys []string `json:"overriddenKeys,omitempty"`

	// Permissions are the job's effective permissions as declared in the
	// source provider. For GitHub Actions this is the job-level block if
	// present, otherwise the inherited workflow-level block. The value may
	// be a string shortcut ("write-all", "read-all") or a map of scope
	// names to access level — policies are expected to handle both.
	Permissions any `json:"permissions,omitempty"`

	// Triggers are the event names under which the enclosing workflow runs
	// (for GitHub Actions, the `on:` section of the workflow file). The
	// collector propagates them to every job of the workflow. GitLab jobs
	// leave this field empty: the concept maps poorly onto GitLab's
	// `workflow.rules` and `only/except` semantics, and the few rules that
	// care about triggers are GitHub-specific.
	Triggers []string `json:"triggers,omitempty"`
	// WorkflowHasTriggers is true when the enclosing workflow declares an
	// `on:` key naming at least one event, false when `on:` is absent or
	// names none. Set only by the GitHub collector; GitLab jobs leave it
	// at its zero value (false), which is why MarkInert gates its "no
	// trigger" reason on the pipeline's provider rather than on this
	// field alone: a GitLab job with an empty Triggers is the norm, not
	// a job that cannot run.
	WorkflowHasTriggers bool `json:"workflowHasTriggers,omitempty"`
	// TriggerTypes is each event's `on.<event>.types` filter, keyed by
	// event name, as written (GitHub Actions). An event with no types:
	// filter (every type fires), and every event of the string and list
	// forms of on:, has no entry; nil when no event carries one.
	// ClassifyGates reads it to decide which event actions an outsider
	// can produce.
	TriggerTypes map[string][]string `json:"triggerTypes,omitempty"`

	// RunsOn is the job's `runs-on:` literal labels (GitHub Actions): a
	// single string or a list, normalized to one entry per label as
	// written. Empty when the value is a runtime expression or a
	// `group:`/`labels:` object form (see RunsOnExpression) this
	// collector does not model.
	RunsOn []string `json:"runsOn,omitempty"`
	// RunsOnExpression is true when `runs-on:` holds a `${{ ... }}`
	// expression (in the value itself or any list element) or the
	// `group:`/`labels:` object form. MarkInert cannot decide a retired
	// runner label from either, so it sets nothing for the runner on
	// such a job.
	RunsOnExpression bool `json:"runsOnExpression,omitempty"`

	// PushBranches, PushBranchesIgnore, PushTags and PushTagsIgnore carry
	// GitHub's `on.push.branches` / `branches-ignore` / `tags` /
	// `tags-ignore` filters (PR #513 review): each entry is a glob pattern
	// exactly as the workflow author wrote it. All four are empty when
	// `push:` carries no filter at all (the bare "push" string or
	// list-element form, or a `push:` entry with none of these four keys),
	// which situation.rego's unprotected_push reads as "every branch",
	// never as "no push trigger at all". PushTagsIgnore on its own (no
	// branches, no branches-ignore) reads the same as PushTags alone: a
	// tag filter with no branch filter at all means the workflow never
	// runs on a branch push. GitLab carries no equivalent: its push
	// surface is read off its rules:/only:/except: keywords instead.
	PushBranches       []string `json:"pushBranches,omitempty"`
	PushBranchesIgnore []string `json:"pushBranchesIgnore,omitempty"`
	PushTags           []string `json:"pushTags,omitempty"`
	PushTagsIgnore     []string `json:"pushTagsIgnore,omitempty"`

	// WorkflowRunWorkflows is the `on.workflow_run.workflows` list of the
	// enclosing GitHub workflow, verbatim: the upstream workflows (by
	// name, or by file path for a workflow with no name) whose runs
	// trigger this one. Empty when the workflow has no workflow_run
	// trigger or names no upstream. GitLab carries no equivalent.
	WorkflowRunWorkflows []string `json:"workflowRunWorkflows,omitempty"`

	// Uses lists every third-party action referenced by the job's steps
	// (for GitHub Actions, `jobs.<name>.steps[].uses` with its
	// accompanying `with:` block). Empty for GitLab jobs, which model
	// external code through `include:` instead (already covered by the
	// pipeline Includes list).
	Uses []Action `json:"uses,omitempty"`

	// ReusableWorkflowUses is the `uses:` declared at the job level (not
	// the step level). Populated only for GitHub Actions jobs that are
	// reusable-workflow calls: `jobs.<name>.uses:
	// owner/repo/.github/workflows/x.yml@ref`. Empty for every other
	// job type.
	ReusableWorkflowUses string `json:"reusableWorkflowUses,omitempty"`

	// SecretsInherit is true when a reusable-workflow call forwards
	// every caller-visible secret to the callee via `secrets: inherit`.
	// Only meaningful when ReusableWorkflowUses is set.
	SecretsInherit bool `json:"secretsInherit,omitempty"`

	// ReusableSecrets is a reusable-workflow call's explicit `secrets:`
	// map: the called workflow's secret name to the expression the caller
	// passes (`R2_KEY: ${{ secrets.R2_KEY }}`). ReusableWith is the call's
	// `with:` inputs, as written. Both empty on any other job.
	ReusableSecrets map[string]string `json:"reusableSecrets,omitempty"`
	ReusableWith    map[string]any    `json:"reusableWith,omitempty"`

	// ReusableCallees are, on a job calling a reusable workflow of the
	// repository itself, the jobs of that workflow and of every workflow it
	// calls in turn, sorted: the jobs the call runs.
	ReusableCallees []string `json:"reusableCallees,omitempty"`

	// Callers are, on a job of a reusable workflow of the repository
	// (on: workflow_call), every call that runs it: the calling job, with
	// the token, the events, the secrets and the inputs that call gives
	// it. A called workflow runs under its caller's event with its caller's
	// token, so these, not the job's own workflow, say what it holds. A call
	// from a workflow itself called carries what the top of the chain
	// gives, one entry per chain. Sorted by calling job.
	Callers []ReusableCaller `json:"callers,omitempty"`

	// Nested is true on a job appended from a reusable workflow of another
	// repository, Via the chain of calls that runs it (spec 3.2).
	Nested bool     `json:"nested,omitempty"`
	Via    []string `json:"via,omitempty"`

	// If is the JOB-level `if:` expression (GitHub Actions), verbatim,
	// "" when the job is unconditional. Distinct from Conditions, which
	// flattens the job's and its steps' conditions together for
	// pattern-matching policies; per-trigger resolution (the situation's
	// gated_triggers) needs the job gate alone, because it excludes every
	// step from the events it rules out.
	If string `json:"if,omitempty"`
	// Dead is true when the job-level `if:` is the constant false (`if:
	// false`, `if: ${{ false }}`, `if: 'false'`): the job never runs, so
	// it holds nothing, changes nothing and hands nothing over.
	Dead bool `json:"dead,omitempty"`
	// Inert is why this job can never run, filled by MarkInert: its
	// workflow is disabled, its runner label is retired, it has no
	// trigger, it is a reusable workflow nobody calls, or it is pinned
	// to another repository (see the MarkInert doc comment for the full
	// precedence). Empty for a job that can run. GitHub only; MarkInert
	// is a no-op on GitLab.
	Inert string `json:"inert,omitempty"`
	// Gate is who can make this job run on its privileged triggers, filled
	// by ClassifyGates: the weakest gate across the privileged triggers
	// the job carries (an outsider on one of them makes it an outsider's).
	// Nil for a job with no privileged trigger, and on GitLab.
	Gate *Gate `json:"gate,omitempty"`
	// Conditions collects every `if:` expression attached to the job
	// (job-level + each step's). Kept as raw YAML strings so Rego
	// policies can match them with regular expressions — no attempt
	// at GitHub-expression-language parsing at the collector level.
	Conditions []string `json:"conditions,omitempty"`

	// WorkflowName is the value of the top-level `name:` field of the
	// enclosing workflow. Empty when the workflow has no explicit
	// name (GitHub falls back to the file path in the UI). Propagated
	// to every job of the workflow by the collector.
	WorkflowName string `json:"workflowName,omitempty"`

	// WorkflowHasConcurrency is true when the enclosing workflow
	// declares a top-level `concurrency:` block. Job-level
	// concurrency is tracked separately via JobHasConcurrency.
	WorkflowHasConcurrency bool `json:"workflowHasConcurrency,omitempty"`

	// JobHasConcurrency is true when the job has its own
	// `concurrency:` block, independent of the workflow-level one.
	JobHasConcurrency bool `json:"jobHasConcurrency,omitempty"`

	// CacheMode is the GitHub `cache-mode:` in effect for the job: its
	// own, else its workflow's. Nil when neither declares one, which
	// leaves GitHub's trigger-based default (write on trusted triggers,
	// read on low-trust ones).
	CacheMode *CacheModeDecl `json:"cacheMode,omitempty"`

	// Environment is the `environment:` field declared on the job
	// (GitHub Actions deployment environment gate). Accepts both the
	// `environment: production` shorthand and the long form — the
	// collector keeps only the name. Empty when no environment is set.
	Environment string `json:"environment,omitempty"`

	// Needs lists the Job.Name values this job depends on (GitHub: qualified
	// with the workflow namespace exactly like Name; GitLab: bare job names,
	// as GitLab names them). The path assembler walks it one hop. A GitLab
	// `needs: []` and an absent `needs:` both decode to nil.
	Needs []string `json:"needs,omitempty"`
	// Caches and Artifacts are the structured cache and artifact uses of the
	// job: on GitHub derived from actions/cache* and actions/*-artifact steps,
	// on GitLab from the job's cache:, artifacts: and dependencies: keys.
	Caches    []CacheRef    `json:"caches,omitempty"`
	Artifacts []ArtifactRef `json:"artifacts,omitempty"`
}

type MRApprovalRule struct {
	// ID is GitLab's approval-rule ID, stringified. It is stable for the
	// rule's lifetime (it churns only on delete-and-recreate, which is a
	// new rule), so ISSUE-502 keys its finding identity on ID rather than
	// on the renameable Name, per the #370 volatile-field discipline.
	ID string `json:"id"`
	// Name is the human label. It renders in findings but is deliberately
	// NOT an identity field: renaming a rule must not re-key its finding.
	Name string `json:"name,omitempty"`
	// ApprovalsRequired is how many approvals the rule mandates.
	ApprovalsRequired int `json:"approvalsRequired"`
	// AppliesToAllProtectedBranches is GitLab's explicit "all protected
	// branches" flag. ISSUE-504 requires at least one rule to carry it.
	AppliesToAllProtectedBranches bool `json:"appliesToAllProtectedBranches,omitempty"`
	// ProtectedBranchCount is how many specific protected branches the rule
	// is scoped to. Zero means it is scoped to none in particular, which
	// GitLab treats as covering all branches; ISSUE-502 checks a rule that
	// covers all protected branches (the explicit flag OR a zero count).
	ProtectedBranchCount int `json:"protectedBranchCount"`
}

type MRApprovalSettings struct {
	// PreventApprovalByAuthor is true when MR authors cannot approve their
	// own merge requests (GitLab: !merge_requests_author_approval).
	PreventApprovalByAuthor bool `json:"preventApprovalByAuthor"`
	// PreventApprovalsByCommitters is true when users who committed to an MR
	// cannot approve it (GitLab: merge_requests_disable_committers_approval).
	PreventApprovalsByCommitters bool `json:"preventApprovalsByCommitters"`
	// PreventEditingApprovalRulesInMR is true when approval rules cannot be
	// overridden per merge request
	// (GitLab: disable_overriding_approvers_per_merge_request).
	PreventEditingApprovalRulesInMR bool `json:"preventEditingApprovalRulesInMR"`
	// RequireReAuthToApprove is true when approving requires
	// re-authentication (GitLab: require_password_to_approve).
	RequireReAuthToApprove bool `json:"requireReAuthToApprove"`
	// BehaviorWhenCommitIsAdded is one of the MRApprovalBehavior* values,
	// derived from GitLab's reset_approvals_on_push and
	// selective_code_owner_removals flags.
	BehaviorWhenCommitIsAdded string `json:"behaviorWhenCommitIsAdded"`
}

type MRSettings struct {
	// MergeMethod is the project's merge method: "merge", "ff", or
	// "rebase_merge" (GitLab: merge_method).
	MergeMethod string `json:"mergeMethod"`
	// SquashOption is the project's squash policy: "never", "always",
	// "default_on", or "default_off" (GitLab: squash_option).
	SquashOption string `json:"squashOption"`
	// MergePipelinesEnabled is true when merged results pipelines are enabled
	// (GitLab: merge_pipelines_enabled; Premium/Ultimate).
	MergePipelinesEnabled bool `json:"mergePipelinesEnabled"`
	// MergeTrainsEnabled is true when merge trains are enabled
	// (GitLab: merge_trains_enabled; Premium/Ultimate).
	MergeTrainsEnabled bool `json:"mergeTrainsEnabled"`
	// AllowMergeOnSkippedPipeline is true when an MR can be merged while its
	// pipeline is skipped (GitLab: allow_merge_on_skipped_pipeline).
	AllowMergeOnSkippedPipeline bool `json:"allowMergeOnSkippedPipeline"`
	// ResolveOutdatedDiffDiscussions is true when outdated diff discussions are
	// auto-resolved on push (GitLab: resolve_outdated_diff_discussions).
	ResolveOutdatedDiffDiscussions bool `json:"resolveOutdatedDiffDiscussions"`
	// PrintingMergeRequestLinkEnabled is true when the MR-creation link is
	// printed on push (GitLab: printing_merge_request_link_enabled).
	PrintingMergeRequestLinkEnabled bool `json:"printingMergeRequestLinkEnabled"`
	// RemoveSourceBranchAfterMerge is true when the source branch is deleted by
	// default after merge (GitLab: remove_source_branch_after_merge).
	RemoveSourceBranchAfterMerge bool `json:"removeSourceBranchAfterMerge"`
}

type MutableRemoteExec struct {
	Tier string `json:"tier"`
	URL  string `json:"url"`
	Ref  string `json:"ref,omitempty"`
	File string `json:"file"`
	// DownloadGuard is the tool name when the fetch sits under a
	// preinstalled-tool guard (`if ! command -v X`, `command -v X ||`,
	// `which X ||`, `[ -x <path> ] ||`, `test -x ... ||`, `type X
	// >/dev/null ||`): the download never runs on a runner where X is
	// already on PATH. Empty when no such guard wraps the fetch.
	DownloadGuard string `json:"downloadGuard,omitempty"`
	// DownloadVerified is true when a checksum or signature check
	// (sha256sum -c/--check, shasum -a 256/512 -c, sha512sum -c, gpg
	// --verify, cosign verify-blob, or a literal 64-hex digest compared
	// with the downloaded file) follows the fetch in the same step or
	// the next: the content is pinned even though the ref is not.
	DownloadVerified bool `json:"downloadVerified,omitempty"`
}

type NormalizedPipeline struct {
	Provider      Provider          `json:"provider"`
	ProjectPath   string            `json:"projectPath,omitempty"`
	DefaultBranch string            `json:"defaultBranch,omitempty"`
	Jobs          []Job             `json:"jobs,omitempty"`
	Includes      []Include         `json:"includes,omitempty"`
	Branches      []Branch          `json:"branches,omitempty"`
	Dependabot    *DependabotConfig `json:"dependabot,omitempty"`

	// WorkflowStates maps a GitHub Actions workflow file's path, exactly
	// as the workflows listing endpoint returns it (e.g.
	// ".github/workflows/ci.yml", matching Job.OriginFile), to its state
	// ("active", "disabled_manually", "disabled_inactivity",
	// "disabled_fork", "deleted", ...). GitHub only.
	WorkflowStates map[string]string `json:"workflowStates,omitempty"`
	// WorkflowStatesKnown is whether the workflows listing could actually
	// be read (false on a 401/403/404/network failure): WorkflowStates
	// and ActionsDisabled carry no information when this is false.
	WorkflowStatesKnown bool `json:"workflowStatesKnown,omitempty"`
	// ActionsDisabled is true when the repository's GitHub Actions are
	// turned off entirely. Derived, never fetched as its own signal: true
	// only when the listing is known, names at least one workflow, and
	// every one of them is disabled_manually or disabled_inactivity. A
	// known but empty listing is never read as disabled: the workflows
	// endpoint only lists workflows registered on the default branch, so
	// a workflow added on a feature branch would otherwise read as
	// Actions being off. For the same reason MarkInert applies it only
	// to a job whose workflow the listing names: one absent from it
	// keeps running.
	ActionsDisabled bool `json:"actionsDisabled,omitempty"`

	// DefaultTokenWrite is whether the repository's actual default
	// GITHUB_TOKEN (the token a job with no permissions block at all,
	// its own or its workflow's, runs with) can write: "true" or
	// "false" once FetchGitHubDefaultTokenWrite read it from a run's
	// own "GITHUB_TOKEN Permissions" log block, "true" when a
	// github-actions[bot] release or default-branch commit proved it
	// instead. Omitted (absent means unknown) when neither route could
	// decide it. GitHub only.
	DefaultTokenWrite string `json:"defaultTokenWrite,omitempty"`
	// DefaultTokenSource is how DefaultTokenWrite was decided: "log"
	// (the run's own permissions log block) or "effect" (a
	// github-actions[bot] release or default-branch commit). Omitted
	// (absent means unknown) when DefaultTokenWrite is also absent.
	// GitHub only.
	DefaultTokenSource string `json:"defaultTokenSource,omitempty"`

	// RegistryHost is the container registry host of the scanned GitLab
	// project's instance (e.g. registry.gitlab.com), where GitLab Function
	// OCI references live. It comes from the GitLab API
	// (container_registry_image_prefix) or, when the API reports none, is
	// derived from the configured instance URL — never from a CI/CD
	// variable, which the scanned pipeline itself can redefine. GitLab only.
	RegistryHost string `json:"registryHost,omitempty"`

	// SelfActionMutableExec is set when the scanned repository is itself
	// a GitHub Action (has an action.yml) whose own source fetches and
	// executes mutable remote code at runtime. This is the producer-side
	// counterpart of the per-`uses:` action.metadata.mutableRemoteExec:
	// scanning the action's own repo must flag that the action it
	// publishes is the mutable-remote-exec vector. Nil otherwise.
	SelfActionMutableExec *MutableRemoteExec `json:"selfActionMutableExec,omitempty"`

	// WorkflowFileCount is the number of workflow files the GitHub
	// collector fetched in remote (--github-url) mode. Used by
	// TotalProgressStepsForPipeline to size the progress bar across
	// the listing+fetch+enrichment phases of upstream-fetch scans.
	// Stays zero in local-clone mode (the local scanner reports a
	// single "Scanning" tick rather than per-file).
	WorkflowFileCount int `json:"-"`

	// AnalyzedWorkflows are the GitHub workflow files this scan read, each
	// with its repo-relative path and content (#443). Carried json:"-" like
	// WorkflowFileCount above: a collector-side record for the JSON report,
	// never part of the OPA evaluation input. Empty on the GitLab path.
	AnalyzedWorkflows []AnalyzedWorkflow `json:"-"`

	// GlobalVariables are pipeline-level variables declared at the top
	// of the source (e.g. `variables:` block at the root of
	// .gitlab-ci.yml). Includes the merge with upstream component /
	// template defaults — convenient for "what will actually be set at
	// runtime" checks (CI_DEBUG_TRACE leaking secrets, insecure
	// DOCKER_TLS_CERTDIR …).
	GlobalVariables map[string]string `json:"globalVariables,omitempty"`

	// LocalGlobalVariables are the pipeline-level variables the user
	// wrote directly at the root of their CI file, before any merge
	// with included templates or components. Empty when the user did
	// not declare a `variables:` block at the root. Used by policies
	// that must distinguish "user-authored override" from "shipped by
	// upstream template" — notably ISSUE-205 (variable-override).
	// Mirrors the raw-conf scan in
	// controlGitlabPipelineJobVariablesOverride.go.
	LocalGlobalVariables map[string]string `json:"localGlobalVariables,omitempty"`

	// RenovateConfigPath is the file path where a Renovate config was
	// discovered (`renovate.json`, `.renovaterc`, `renovate.json5`,
	// …). Empty when no Renovate config is present.
	RenovateConfigPath string `json:"renovateConfigPath,omitempty"`

	// SecurityPolicyPath is the path of the repository's SECURITY.md
	// (root, .github/, or docs/). Empty when the file is absent.
	SecurityPolicyPath string `json:"securityPolicyPath,omitempty"`

	// MRApprovalRules are the project's merge-request approval rules
	// (GitLab: Settings > Merge requests > Approval rules), each with the
	// number of approvals it requires and its protected-branch coverage.
	// Projected from the same protection collection as Branches; empty on
	// providers without approval rules. Read by the
	// mergeRequestApprovalRulesMust* controls (ISSUE-502/504).
	MRApprovalRules []MRApprovalRule `json:"mrApprovalRules,omitempty"`

	// MRApprovalRulesKnown is true when the approval-rules listing was
	// fetched authoritatively (an empty MRApprovalRules then means "no
	// rules", a real state the rules reason about). It is false when the
	// listing could not be read — a 401/403 on the approvals API (commonly
	// a non-premium GitLab, or a token without scope) — so a control keyed
	// on these rules reports not-evaluable rather than a false pass.
	// Mirrors Branch.ProtectionDetailsKnown.
	MRApprovalRulesKnown bool `json:"mrApprovalRulesKnown,omitempty"`

	// Environments are the repository's deployment environments (GitHub:
	// Settings > Environments) and the reviewer rules each one carries.
	// GitHub only; empty on GitLab.
	Environments []Environment `json:"environments,omitempty"`

	// EnvironmentsKnown is true when Environments was fetched
	// authoritatively (an empty Environments then means "no
	// environments", a real state the situation facts reason about). It
	// is false when the listing could not be read (a 401/403 on the
	// environments API, a 404, or a network failure), so a job's
	// environment reviewer fact stays unknown rather than a false "no
	// reviewers". Mirrors MRApprovalRulesKnown.
	EnvironmentsKnown bool `json:"environmentsKnown,omitempty"`

	// SettingsVariables are the project's CI/CD settings variables
	// (GitLab: Settings > CI/CD > Variables), each with its security
	// flags — NOT the CI file's `variables:` block (that lives in
	// GlobalVariables / job Variables). The value is deliberately never
	// projected, per the #370 variable-sensitivity tiers, so a scan
	// report never carries secret material. Empty on providers without
	// settings variables.
	SettingsVariables []SettingsVariable `json:"settingsVariables,omitempty"`

	// SettingsVariablesKnown is true when the settings-variable listing
	// was fetched authoritatively (an empty SettingsVariables then means
	// "no variables", a pass). It is false when the listing could not be
	// read — a 401/403 on the settings API, or a provider that has no
	// such concept — so a control keyed on these variables reports
	// not-evaluable rather than a false pass. Mirrors Branch.
	// ProtectionDetailsKnown.
	SettingsVariablesKnown bool `json:"settingsVariablesKnown,omitempty"`

	// MRApprovalSettings are the project's merge-request approval settings
	// (GitLab: Settings > Merge requests), normalized to positive-security
	// form. nil when the settings could not be read (a 401/403 from a token
	// without scope), so the mergeRequestApprovalSettingsMustBeCompliant
	// control (ISSUE-503) abstains and reports not-evaluable rather than a
	// false pass. Projected from the same protection collection as
	// MRApprovalRules.
	MRApprovalSettings *MRApprovalSettings `json:"mrApprovalSettings,omitempty"`

	// MRSettings are the project's merge-request/merge settings (GitLab:
	// Settings > Merge requests — merge method, squash, merge trains, etc.),
	// carried in raw form so the mergeRequestSettingsMustBeCompliant control
	// (ISSUE-506) can compare each against the configured expectation. nil when
	// the project payload could not be read, so the control abstains and reports
	// not-evaluable rather than a false pass. Projected from the same protection
	// collection as MRApprovalSettings.
	MRSettings *MRSettings `json:"mrSettings,omitempty"`

	// SecurityPolicyProject is the GitLab security policy project linked to this
	// project (Settings > Security & Compliance > Policies), projected from the
	// protection collection. nil when the linkage was not collected (the control
	// is disabled) or could not be read authoritatively, so the
	// projectMustHaveSecurityPolicySource control (ISSUE-601) abstains and
	// reports not-evaluable. Distinct from SecurityPolicyPath above, which is the
	// repository's SECURITY.md file (a GitHub-oriented, unrelated control).
	SecurityPolicyProject *SecurityPolicyProjectState `json:"securityPolicyProject,omitempty"`

	// Dockerfiles lists every Dockerfile the collector scanned at the
	// repo root and under common build directories, with each FROM
	// base-image extracted so policies can check pinning state.
	Dockerfiles []Dockerfile `json:"dockerfiles,omitempty"`

	// AdvisoryWarnings collects one human-readable line per action whose
	// known-CVE check could not be completed because the pinned commit
	// could not be resolved to a version (the action repo's tag list was
	// unavailable — org IP allow list, rate limit, network). The renderer
	// and the JSON/SARIF/GLSAST writers surface these as "could not
	// verify" warnings so a degraded check is visible instead of silently
	// passing. Empty when every action resolved or no action was degraded.
	AdvisoryWarnings []string `json:"advisoryWarnings,omitempty"`

	// UnexpandedActions lists what the nested actions resolution could not
	// expand, NestedBudgetExceeded says the container budget was passed (R3)
	// and NestedUnresolvedCause why the closure could not be resolved at all
	// (R6), "" when it was (spec 2026-10-16 section 7). Never in the Rego input.
	// The cause is decided by the run's first remote read only, so the two
	// cannot both be set; if they ever are, the overflow wins and the run
	// degrades (coordinator ruling L7, applied by the control package).
	UnexpandedActions     []UnexpandedAction `json:"-"`
	NestedBudgetExceeded  bool               `json:"-"`
	NestedUnresolvedCause string             `json:"-"`
	// NestedEntriesOverflow counts the budget references of the list that
	// the per-job entry bound left unexpanded, the others being past the
	// container budget (NestedBudgetExceeded covers both).
	NestedEntriesOverflow int `json:"-"`
	// NestedJobsOverflow counts the budget references of the list that the
	// run-wide cap on appended nested jobs left unexpanded: the calls of a
	// reusable workflow of another repository past the cap.
	NestedJobsOverflow int `json:"-"`

	Raw map[string]any `json:"raw,omitempty"`

	// Visibility is the repository's exposure as the provider reports it:
	// VisibilityPublic, VisibilityPrivate or VisibilityUnknown. The situation
	// facts weigh contributor entries by it; unknown is treated as public.
	Visibility string `json:"visibility,omitempty"`
}

type OverriddenJob struct {
	Name string   `json:"name"`
	Keys []string `json:"keys,omitempty"`
	// Values holds the whole local job block exactly as the user's own
	// configuration declares it, Keys being only the CI/CD keywords the
	// override regex matched inside it. It exists to feed the override
	// fingerprint, which digests the block as a whole so that any change
	// to the overriding job moves it, and is never serialised: this IR is
	// the policy engine's input and can be dumped, so the user's job
	// content must not travel with it. What leaves the CLI about an
	// override is the fingerprint, the job name and the key names, never
	// the content behind them.
	Values map[string]any `json:"-"`
}

type Provider string

type ReusableCaller struct {
	// Job is the calling job's name.
	Job string `json:"job"`
	// Permissions is the calling job's effective permissions (its own, its
	// workflow's, or, up a chain of calls, the first declared), nil when
	// nothing up the chain declares any: the assumed repository default.
	Permissions any `json:"permissions,omitempty"`
	// Triggers is the events the call runs on: those of the workflow at the
	// top of the chain, workflow_call left out.
	Triggers []string `json:"triggers,omitempty"`
	// SecretsInherit is true when the call passes every secret; Secrets is
	// otherwise the explicit map, the called workflow's secret name to the
	// expression passed (resolved up the chain where it forwards one).
	SecretsInherit bool              `json:"secretsInherit,omitempty"`
	Secrets        map[string]string `json:"secrets,omitempty"`
	// With is the call's inputs, an input passed through from a caller up
	// the chain (`${{ inputs.x }}`) replaced by what that caller passes.
	With map[string]any `json:"with,omitempty"`
	// If is the calling job's own job-level `if:`, verbatim, "" when the
	// call is unconditional: the called workflow runs only on the events
	// it lets through (ClassifyGates reads it through the calling job).
	If string `json:"if,omitempty"`
}

type SecurityPolicyProjectState struct {
	// Known is true when the linkage was read authoritatively.
	Known bool `json:"known"`
	// LinkedProjectID is the numeric ID of the linked security policy project,
	// or 0 when none is linked.
	LinkedProjectID int `json:"linkedProjectId"`
	// LinkedProjectPath is the full path of the linked security policy project,
	// or "" when none is linked.
	LinkedProjectPath string `json:"linkedProjectPath"`
}

type SettingsVariable struct {
	Name string `json:"name"`
	// Type and Environment always serialize (no omitempty): both are
	// identity fields for the cicdVariablesMustBe* controls, and the rules
	// read them unconditionally, so an absent key would break the finding
	// or leave an inconsistent identity. GitLab always supplies both
	// ("env_var"/"file" and the environment scope, "*" for all).
	Type        string `json:"type"`
	Environment string `json:"environment"`
	Protected   bool   `json:"protected"`
	Masked      bool   `json:"masked"`
}

type UnexpandedAction struct {
	Uses   string   `json:"uses"`
	Via    []string `json:"via,omitempty"`
	Reason string   `json:"reason"`
	// Invalid marks a reference refused before any fetch because it is
	// outside GitHub's grammar (reason fetch). The capped fetch warning
	// names the reason from it, so it adds no warning line of its own.
	Invalid bool `json:"-"`
}