ast

type ASTAnalyzer struct {
	// contains filtered or unexported fields
}

type ASTConfig struct {
	EnableActionAnalysis       bool
	EnableShellAnalysis        bool
	EnableAdvancedReachability bool
	TrustMarketplaceActions    bool
	MaxComplexityThreshold     int
	EnableContextAnalysis      bool
}

type ActionAnalysis struct {
	ActionName    string
	Step          *StepNode
	Metadata      *ActionMetadata
	Risks         []string
	DataFlowRisks []string
}

type ActionAnalyzer struct {
	// contains filtered or unexported fields
}

type ActionMetadata struct {
	Name             string
	Source           string // "marketplace", "custom", "local"
	TrustedVendor    bool   // Whether this is from a trusted vendor
	DataFlowRisks    []string
	Permissions      []string
	OutputPatterns   []string
	InputPatterns    []string
	ShellAccess      bool
	NetworkAccess    bool
	FileSystemAccess bool
	Secrets          []string // Secrets this action typically uses
}

type ActionReference struct {
	Owner      string
	Repository string
	Path       string // For actions in subdirectories
	Ref        string // Version, tag, or commit
	IsLocal    bool   // Whether it's a local action (./path)
	IsDocker   bool   // Whether it's a Docker action (docker://)
}

type AnalysisContext struct {
	WorkflowPath     string
	Platform         string
	ProjectMetadata  map[string]interface{}
	SecurityContext  *SecurityContext
	PerformanceHints *PerformanceHints
	UserConfig       map[string]interface{}
}

type AnalyzerPlugin interface {
	Plugin
	Analyze(workflow *WorkflowAST, context *AnalysisContext) (*PluginResult, error)
	GetAnalysisType() string
	GetPriority() int
}

type BottleneckAnalysis struct {
	SlowestComponent        string
	SlowestComponentTime    time.Duration
	MemoryIntensiveStage    string
	MostFrequentError       string
	OptimizationSuggestions []string
}

type Cache struct {
	// contains filtered or unexported fields
}

type CacheConfig struct {
	MaxSizeMB   int           // Maximum cache size in MB
	MaxEntries  int           // Maximum number of cache entries
	TTL         time.Duration // Time to live for entries
	CleanupFreq time.Duration // Frequency of cache cleanup
}

type CacheKey struct {
	WorkflowHash string
	ConfigHash   string
	AnalysisType string
	Version      string
}

type CacheStats struct {
	Entries      int     `json:"entries"`
	CurrentSize  int64   `json:"current_size_bytes"`
	MaxSize      int64   `json:"max_size_bytes"`
	HitCount     int64   `json:"hit_count"`
	MissCount    int64   `json:"miss_count"`
	HitRate      float64 `json:"hit_rate_percent"`
	UsagePercent float64 `json:"usage_percent"`
}

type CachedAnalyzer struct {
	// contains filtered or unexported fields
}

type CachedResult struct {
	Key         CacheKey
	Result      interface{}
	CreatedAt   time.Time
	AccessedAt  time.Time
	AccessCount int64
	Size        int64 // Estimated size in bytes
}

type CallGraph struct {
	// contains filtered or unexported fields
}

type CallNode struct {
	ID       string
	Type     string // "job", "step", "action", "workflow", "trigger"
	Name     string
	Platform string
	Metadata map[string]interface{}
}

type CommandSegment struct {
	Command     string
	Arguments   []string
	Environment map[string]string
	Dangerous   bool
	Category    string // "network", "file", "system", "data"
}

type CommandSubstitution struct {
	Command   string
	Context   string // Where it's used
	Dangerous bool
}

type ComplexityMetrics struct {
	AverageJobCount            float64
	AverageStepCount           float64
	AverageConditionComplexity float64
	MaxCallGraphDepth          int
	AverageDataFlowCount       float64
}

type ComponentMetrics struct {
	Name              string
	TotalExecutions   int64
	TotalTime         time.Duration
	AverageTime       time.Duration
	MinTime           time.Duration
	MaxTime           time.Duration
	ErrorCount        int64
	LastExecutionTime time.Time
}

type ComprehensiveAnalysisResult struct {
	ReachabilityAnalysis map[string]bool
	DataFlows            []*DataFlow
	ActionAnalyses       []*ActionAnalysis
	ShellAnalyses        []*ShellCommand
	SecurityRisks        []string
	ComplexConditions    []*ConditionAnalyzer
}

type ConditionAnalyzer struct {
	Expression        string
	Variables         []string
	Secrets           []string
	Github            []string // github.* context
	Inputs            []string // inputs.* context
	Env               []string // env.* context
	Vars              []string // vars.* context
	Steps             []string // steps.* context
	Jobs              []string // jobs.* context
	Needs             []string // needs.* context
	Matrix            []string // matrix.* context
	Always            bool     // always() function used
	Failure           bool     // failure() function used
	Success           bool     // success() function used
	Cancelled         bool     // cancelled() function used
	StaticEval        *bool    // static evaluation result if determinable
	ContextDependency bool     // depends on runtime context
	Complexity        int      // complexity score for the condition
	Operators         []string // logical operators used
	Functions         []string // functions called in condition
}

type DataFlow struct {
	SourceID string
	SinkID   string
	Path     []string // Nodes the data flows through
	Tainted  bool
	Severity string // "LOW", "MEDIUM", "HIGH", "CRITICAL"
	Risk     string // Description of the risk
}

type DataFlowAnalyzer struct {
	// contains filtered or unexported fields
}

type DataFlowGraph struct {
	// contains filtered or unexported fields
}

type DataSink struct {
	ID        string
	Type      string // "output", "log", "network", "file", "env", "action_input"
	Name      string
	NodeID    string
	Sensitive bool   // Whether this sink could leak sensitive data
	Command   string // The command or action that creates this sink
}

type DataSource struct {
	ID      string
	Type    string // "input", "secret", "env", "output", "artifact", "github_context"
	Name    string
	NodeID  string
	Tainted bool   // Whether this source contains sensitive data
	Origin  string // Where the data originally comes from
	Value   string // The actual value or reference
}

type EnvNode struct {
	Name    string `yaml:"-"`
	Value   string `yaml:",inline"`
	Tainted bool   `yaml:"-"`
	Source  string `yaml:"-"`
}

type ExtensionRegistry struct {
	// contains filtered or unexported fields
}

type JobNode struct {
	ID          string            `yaml:"-"`
	Name        string            `yaml:"name"`
	Steps       []*StepNode       `yaml:"steps"`
	Needs       []string          `yaml:"needs"`
	If          string            `yaml:"if"`
	Environment string            `yaml:"environment"`
	Permissions map[string]string `yaml:"permissions"`
	Secrets     []string          `yaml:"-"` // Extracted from steps
	Variables   map[string]string `yaml:"env"`
	RunsOn      string            `yaml:"runs-on"`
	Reachable   bool              `yaml:"-"` // Will be set by reachability analysis
}

type LifecycleEvent string

type LifecycleHook func(event LifecycleEvent, data interface{}) error

type Location struct {
	File    string `json:"file"`
	Line    int    `json:"line"`
	Column  int    `json:"column"`
	JobID   string `json:"job_id,omitempty"`
	StepID  string `json:"step_id,omitempty"`
	Context string `json:"context,omitempty"`
}

type Metrics struct {
	// contains filtered or unexported fields
}

type MetricsCollector struct {
	// contains filtered or unexported fields
}

type MiddlewareFunc func(*WorkflowAST) (*WorkflowAST, error)

type MiddlewarePlugin interface {
	Plugin
	Process(workflow *WorkflowAST, next MiddlewareFunc) (*WorkflowAST, error)
	GetOrder() int
}

type PerformanceHints struct {
	MaxAnalysisTime   int64
	MemoryLimitMB     int64
	PreferredCaching  bool
	ParallelExecution bool
}

type PerformanceProfile struct {
	WorkflowSizeDistribution map[string]int64 // small, medium, large
	ComplexityMetrics        ComplexityMetrics
	ResourceUsage            ResourceUsage
	BottleneckAnalysis       BottleneckAnalysis
}

type PerformanceReport struct {
	GeneratedAt     time.Time     `json:"generated_at"`
	UpTime          time.Duration `json:"uptime"`
	TotalAnalyses   int64         `json:"total_analyses"`
	Metrics         *Metrics      `json:"metrics"`
	Recommendations []string      `json:"recommendations"`
}

type Pipe struct {
	LeftCommand  string
	RightCommand string
	DataFlow     bool // Whether sensitive data flows through the pipe
}

type Plugin interface {
	GetInfo() *PluginInfo
	Initialize(config interface{}) error
	Cleanup() error
	Validate() error
}

type PluginConfig struct {
	EnablePlugins      bool
	PluginTimeout      int64 // seconds
	MaxPluginMemoryMB  int64
	AllowedPluginTypes []string
	SecurityPolicy     PluginSecurityPolicy
}

type PluginInfo struct {
	Name         string                 `json:"name"`
	Version      string                 `json:"version"`
	Author       string                 `json:"author"`
	Description  string                 `json:"description"`
	Homepage     string                 `json:"homepage"`
	License      string                 `json:"license"`
	Tags         []string               `json:"tags"`
	Dependencies []string               `json:"dependencies"`
	Metadata     map[string]interface{} `json:"metadata"`
}

type PluginManager struct {
	// contains filtered or unexported fields
}

type PluginRegistration struct {
	Info        *PluginInfo
	Constructor func() Plugin
	Config      interface{}
	Enabled     bool
}

type PluginResult struct {
	PluginName    string                 `json:"plugin_name"`
	AnalysisType  string                 `json:"analysis_type"`
	Findings      []*SecurityFinding     `json:"findings"`
	Metrics       map[string]interface{} `json:"metrics"`
	Metadata      map[string]interface{} `json:"metadata"`
	ExecutionTime int64                  `json:"execution_time_ms"`
	Success       bool                   `json:"success"`
	Errors        []string               `json:"errors,omitempty"`
}

type PluginSecurityPolicy struct {
	AllowFileAccess    bool
	AllowNetworkAccess bool
	AllowedDomains     []string
	RestrictedCommands []string
	MaxExecutionTime   int64 // seconds
}

type ReachabilityAnalyzer struct {
	// contains filtered or unexported fields
}

type ReachabilityReport struct {
	TotalNodes       int
	ReachableNodes   int
	UnreachableNodes []string
	ConditionalNodes map[string]*ConditionAnalyzer
}

type Redirection struct {
	Type   string // "input", "output", "append", "error"
	Source string
	Target string
	Risky  bool
}

type Remediation struct {
	Summary     string   `json:"summary"`
	Description string   `json:"description"`
	Steps       []string `json:"steps"`
	Examples    []string `json:"examples"`
	Links       []string `json:"links"`
}

type ReportConfig struct {
	Format         string                 `json:"format"`
	IncludeMetrics bool                   `json:"include_metrics"`
	FilterSeverity []string               `json:"filter_severity"`
	GroupBy        string                 `json:"group_by"`
	Template       string                 `json:"template,omitempty"`
	OutputPath     string                 `json:"output_path,omitempty"`
	CustomFields   map[string]interface{} `json:"custom_fields"`
}

type ReporterPlugin interface {
	Plugin
	GenerateReport(results *ComprehensiveAnalysisResult, config *ReportConfig) ([]byte, error)
	GetFormat() string
	GetMimeType() string
}

type ResourceUsage struct {
	AverageMemoryMB   float64
	PeakMemoryMB      uint64
	AverageCPUPercent float64
	GCPauseTimeMS     float64
	AllocationsPerSec float64
}

type RuleContext struct {
	WorkflowAST   *WorkflowAST
	CurrentJob    *JobNode
	CurrentStep   *StepNode
	ParentNodes   []interface{}
	GlobalContext map[string]interface{}
}

type RulePlugin interface {
	Plugin
	Evaluate(node interface{}, context *RuleContext) (*RuleResult, error)
	GetRuleID() string
	GetSeverity() string
	GetCategory() string
}

type RuleResult struct {
	RuleID      string                 `json:"rule_id"`
	Passed      bool                   `json:"passed"`
	Severity    string                 `json:"severity"`
	Message     string                 `json:"message"`
	Location    *Location              `json:"location,omitempty"`
	Remediation *Remediation           `json:"remediation,omitempty"`
	Metadata    map[string]interface{} `json:"metadata"`
}

type SecretNode struct {
	Name        string `yaml:"-"`
	Value       string `yaml:",inline"`
	Required    bool   `yaml:"required"`
	Description string `yaml:"description"`
}

type SecurityContext struct {
	TrustedDomains     []string
	AllowedActions     []string
	SecurityLevel      string
	ComplianceProfiles []string
}

type SecurityFinding struct {
	ID          string       `json:"id"`
	Title       string       `json:"title"`
	Description string       `json:"description"`
	Severity    string       `json:"severity"`
	Category    string       `json:"category"`
	Location    *Location    `json:"location"`
	Remediation *Remediation `json:"remediation"`
	References  []string     `json:"references"`
	CWE         []string     `json:"cwe,omitempty"`
	OWASP       []string     `json:"owasp,omitempty"`
}

type SecurityMetrics struct {
	TotalRisks         int
	HighRiskActions    int
	UntrustedActions   int
	DangerousCommands  int
	ComplexConditions  int
	SensitiveDataFlows int
}

type ShellAnalyzer struct {
	// contains filtered or unexported fields
}

type ShellCommand struct {
	OriginalCommand string
	ParsedCommands  []*CommandSegment
	Variables       []*VariableReference
	Redirections    []*Redirection
	Pipes           []*Pipe
	Substitutions   []*CommandSubstitution
	SecurityRisks   []string
	DataFlowRisks   []string
}

type SinkInfo struct {
	// contains filtered or unexported fields
}

type StepNode struct {
	ID          string            `yaml:"id"`
	Name        string            `yaml:"name"`
	Uses        string            `yaml:"uses"`
	With        map[string]string `yaml:"with"`
	Run         string            `yaml:"run"`
	Env         map[string]string `yaml:"env"`
	If          string            `yaml:"if"`
	Shell       string            `yaml:"shell"`
	WorkingDir  string            `yaml:"working-directory"`
	Outputs     []string          `yaml:"-"` // Extracted from analysis
	Inputs      []string          `yaml:"-"` // Extracted from analysis
	Reachable   bool              `yaml:"-"`
	DataSources []string          `yaml:"-"` // Where data comes from
	DataSinks   []string          `yaml:"-"` // Where data goes to
}

type TriggerNode struct {
	Event     string                 `yaml:"-"`
	Config    map[string]interface{} `yaml:",inline"`
	Reachable bool                   `yaml:"-"`
}

type VariableReference struct {
	Name      string
	Value     string
	Source    string // "env", "github", "secret", "input"
	Sensitive bool
	Usage     string // "read", "write", "expand"
}

type WorkflowAST struct {
	Jobs     map[string]*JobNode    `yaml:"jobs"`
	Triggers []*TriggerNode         `yaml:"on"`
	Env      map[string]*EnvNode    `yaml:"env"`
	Secrets  map[string]*SecretNode `yaml:"secrets"`
	Platform string                 // "github" or "gitlab"
}