core

type Cache struct {
	// contains filtered or unexported fields
}

type CacheEntry struct {
	Data      interface{} `json:"data"`
	ExpiresAt time.Time   `json:"expires_at"`
	URL       string      `json:"url"`
}

type ConfigFile struct {
	DefaultLanguageVersion struct {
		Python string `yaml:"python"`
	} `yaml:"default_language_version"`
	Repos []Repo `yaml:"repos"`
}

type Flags struct {
	// Existing fields
	DryRun          bool
	Update          bool
	File            string
	Directory       string
	GitHubToken     string
	Stable          *uint
	Entries         []string // For tracking entries
	Days            *uint    // Days parameter
	ContinueOnError bool     // Continue on error flag
	Deep            bool
	Sources         []string

	// New cache fields
	Cache        *Cache
	CacheEnabled bool
	CacheTTL     time.Duration

	Silent        bool // suppress diff output (used by org bulk mode)
	PinOnly       bool // pin current tag to SHA without checking for upgrades
	Substitutions []Substitution
	InputUpgrades []InputUpgrade

	OpenPR    bool
	AutoMerge bool
	Branch    string
	PRToken   string
}

type GhatConfig struct {
	Substitutions []Substitution `yaml:"substitutions"`
	InputUpgrades []InputUpgrade `yaml:"input_upgrades"`
}

type GitlabCIAnalysis struct {
	// Jobs is the ordered list of job definitions found in the file, sorted
	// by job name for deterministic output.
	Jobs []GitlabJobAnalysis
}

type GitlabImageAnalysis struct {
	// Name is the image reference exactly as written in the YAML
	// (before any comment stripping), e.g. "golang:1.21" or
	// "gcr.io/project/app@sha256:abc123 # v1.6.0".
	Name string
	// IsDigestPinned is true when the image reference contains "@sha256:".
	IsDigestPinned bool
	// IsSuppressed is true when the image line carries a # ghat:suppress
	// annotation in the source file.
	IsSuppressed bool
}

type GitlabJobAnalysis struct {
	// Name is the job key in the YAML.
	Name string
	// HasTimeout is true when the job declares a timeout: field.
	HasTimeout bool
	// AllowFailure is true when allow_failure: true is set, or when
	// allow_failure: is an object (partial failure via exit_codes).
	AllowFailure bool
	// Images is the list of container images declared for this job.
	Images []GitlabImageAnalysis
}

type Hook struct {
	ID                      string   `yaml:"id"`
	Name                    string   `yaml:"name,omitempty"`
	Entry                   string   `yaml:"entry,omitempty"`
	Language                string   `yaml:"language,omitempty"`
	Files                   string   `yaml:"files,omitempty"`
	Exclude                 string   `yaml:"exclude,omitempty"`
	Types                   []string `yaml:"types,omitempty"`
	TypesOr                 []string `yaml:"types_or,omitempty"`
	ExcludeTypes            []string `yaml:"exclude_types,omitempty"`
	AlwaysRun               *bool    `yaml:"always_run,omitempty"`
	FailFast                *bool    `yaml:"fail_fast,omitempty"`
	Verbose                 *bool    `yaml:"verbose,omitempty"`
	PassFilenames           *bool    `yaml:"pass_filenames,omitempty"`
	RequireSerial           *bool    `yaml:"require_serial,omitempty"`
	Description             string   `yaml:"description,omitempty"`
	LanguageVersion         string   `yaml:"language_version,omitempty"`
	MinimumPrecommitVersion string   `yaml:"minimum_pre_commit_version,omitempty"`
	Args                    []string `yaml:"args,omitempty"`
	Stages                  []string `yaml:"stages,omitempty"`
}

type ImageReference struct {
	Registry    string
	Repository  string
	Tag         string
	Digest      string
	Original    string
	TagImplicit bool // true when no tag was written in the source (defaulted to latest)
}

type InputUpgrade struct {
	Action      string `yaml:"action"`       // e.g. "golangci/golangci-lint-action"
	Input       string `yaml:"input"`        // e.g. "version"
	FromPattern string `yaml:"from_pattern"` // regex matched against the current value
	To          string `yaml:"to"`           // literal version or "latest:owner/repo"
}

type JobAnalysis struct {
	// Name is the job key in the YAML, e.g. "build" or "deploy".
	Name string
	// HasTimeout is true when timeout-minutes: is declared on the job.
	HasTimeout     bool
	TimeoutMinutes int
	// IsReusable is true when the job delegates entirely to a reusable
	// workflow via a job-level `uses:` key.  GitHub does not support
	// timeout-minutes on such jobs; the timeout lives inside the called
	// workflow.
	IsReusable bool
	// RunsOn is the normalised runner label(s) for the job. For a single
	// string label this is just that string; for a list of labels the
	// values are joined with commas.
	RunsOn string
	// HasPermissions is true when the job declares its own permissions: block.
	HasPermissions bool
	// Permissions maps each GitHub Actions permission scope to its value
	// (e.g. "contents" → "read").  When permissions: write-all is set the
	// map has a single "_all" key with value "write-all".
	Permissions map[string]string
}

type OrgFlags struct {
	Provider    string // "github" (default) or "gitlab"
	BaseURL     string // self-hosted API root, e.g. https://gitlab.example.com
	Owner       string
	Repos       []string // explicit list; if set, Owner/Limit are ignored
	Token       string   // PAT for Provider (clone/push/PR)
	GitHubToken string   // separate PAT for api.github.com lookups during the sweep
	Branch      string
	Offset      int
	Limit       int
	DryRun      bool
	OpenPR      bool
	AutoMerge   bool
	Threshold   int // pause when fewer than this many API requests remain
}

type ProviderInfo struct {
	Name           string
	Source         string
	Namespace      string
	Type           string
	CurrentVersion string
	LatestVersion  string
}

type ProviderVersion struct {
	Version   string   `json:"version"`
	Protocols []string `json:"protocols"`
	Platforms []struct {
		OS   string `json:"os"`
		Arch string `json:"arch"`
	} `json:"platforms"`
}

type ProviderVersionsResponse struct {
	Versions []ProviderVersion `json:"versions"`
}

type RateLimitError struct {
	ResetTime time.Time
	Remaining int
}

type Registry struct {
	Registry      bool
	LatestVersion string
}

type Repo struct {
	Hooks []Hook `yaml:"hooks"`
	Repo  string `yaml:"repo"`
	Rev   string `yaml:"rev,omitempty"`
}

type RepoResult struct {
	Repo   string
	Status string // "pinned", "already-pinned", "pr-open", "error"
	PRUrl  string
	Error  error
	Gaps   []string
}

type StepAnalysis struct {
	// Action is the action reference without the @ref part, e.g.
	// "actions/checkout" or "aws-actions/configure-aws-credentials".
	Action string
	// Ref is the raw ref as written in the YAML, e.g. "v4" or the ghat
	// pinned format "abc1234…  # v4".
	Ref string
	// IsSHAPinned is true when Ref is anchored to an immutable 40-char
	// commit SHA (bare or in the "sha # tag" comment format).
	IsSHAPinned bool
	// SHA is the extracted commit SHA when IsSHAPinned is true.
	SHA string
	// Tag is the human-readable tag associated with SHA (from the
	// "sha # tag" comment), or the raw floating tag when not yet pinned.
	Tag string
	// Suppressed is true when the uses: line carries a # ghat:suppress
	// annotation — the step is intentionally exempt from pinning.
	Suppressed bool
	// ExposesSecretInEnv is true when the step's env: block contains a
	// ${{ secrets.* }} expression, leaking secret values into the process
	// environment where they are visible to child processes and debug logs.
	ExposesSecretInEnv bool
}

type Submodule struct {
	Name           string
	Path           string
	URL            string
	Suppressed     bool
	SuppressReason string
}

type Substitution struct {
	From string `yaml:"from"`
	To   string `yaml:"to"`
}

type URLFormatError struct {
	// contains filtered or unexported fields
}

type WorkflowAnalysis struct {
	// HasPermissions is true when the workflow declares a top-level
	// permissions: block (any value, including write-all).
	HasPermissions bool
	// IsWriteAll is true when permissions: write-all is set, granting the
	// GITHUB_TOKEN full repository write access to every job.
	IsWriteAll bool
	// HasDangerousTrigger is true when a dangerous trigger combination is
	// detected:
	//   - pull_request_target with a checkout of the PR head, OR
	//   - github.event.* interpolated directly into a run: shell block.
	HasDangerousTrigger  bool
	DangerousTriggerDesc string
	// HasConcurrency is true when the workflow declares a top-level
	// concurrency: block, preventing parallel runs from corrupting state.
	HasConcurrency bool
	// Steps is the ordered list of external uses: action references found in
	// the workflow. Local paths, docker:// refs, and reusable workflow calls
	// are excluded.
	Steps []StepAnalysis
	// Jobs is the per-job analysis, sorted by job name.
	Jobs []JobAnalysis
}