core

type AuditScore struct {
	Bucket   string   // "ok", "RISK", or "STALE"
	Checks   []Check  // per-check results
	Unpinned []string // workflow refs that are not SHA-pinned
}

type Cache struct {
	// contains filtered or unexported fields
}

type CacheEntry struct {
	Data      interface{} `json:"data"`
	ExpiresAt time.Time   `json:"expires_at"`
	URL       string      `json:"url"`
}

type Check struct {
	Name    string
	Outcome CheckOutcome
	Detail  string
}

type CheckOutcome int

type ConfigFile struct {
	DefaultLanguageVersion struct {
		Python string `yaml:"python"`
	} `yaml:"default_language_version"`
	Repos []Repo `yaml:"repos"`
}

type DepRef struct {
	Ecosystem   string // one of the Source* constants
	Name        string // e.g. "actions/checkout", "lodash", "requests"
	Version     string // e.g. "v4", "^1.0.0", "==2.31.0"
	Line        int    // 1-indexed line of the name/source declaration
	VersionLine int    // 1-indexed line of the version attribute when separate (0 = same as Line)
}

type DockerImageAnalysis struct {
	// Raw is the image reference as written, e.g. "golang:1.21" or
	// "golang:1.21@sha256:abc…".
	Raw string
	// Resolved is Raw with ARG defaults expanded, e.g. "golang:1.21" when
	// Raw was "golang:${GO}" and ARG GO=1.21 preceded it.
	Resolved string
	// Image is the repository portion after ARG expansion, without tag/digest.
	Image string
	// Tag is the tag portion after ARG expansion, or "" when none was given.
	Tag string
	// IsDigestPinned is true when the reference contains "@sha256:".
	IsDigestPinned bool
	// Suppressed is true when the FROM line carries # ghat:suppress.
	Suppressed bool
	// Line is the 1-indexed source line of the FROM directive.
	Line int
}

type DockerfileAnalysis struct {
	Images []DockerImageAnalysis
}

type Flags struct {
	// Existing fields
	DryRun          bool
	Update          bool
	File            string
	Directory       string
	GitHubToken     string
	Stable          *uint
	Entries         []string // For tracking entries
	Days            *uint    // Days parameter
	ContinueOnError bool     // Continue on error flag
	Deep            bool
	Sources         []string

	// New cache fields
	Cache        *Cache
	CacheEnabled bool
	CacheTTL     time.Duration

	Silent        bool // suppress diff output (used by org bulk mode)
	PinOnly       bool // pin current tag to SHA without checking for upgrades
	Substitutions []Substitution
	InputUpgrades []InputUpgrade

	OpenPR    bool
	AutoMerge bool
	Branch    string
	PRToken   string
}

type GhatConfig struct {
	Substitutions []Substitution `yaml:"substitutions"`
	InputUpgrades []InputUpgrade `yaml:"input_upgrades"`
}

type GitlabCIAnalysis struct {
	// Jobs is the ordered list of job definitions found in the file, sorted
	// by job name for deterministic output.
	Jobs []GitlabJobAnalysis
}

type GitlabImageAnalysis struct {
	// Name is the image reference exactly as written in the YAML
	// (before any comment stripping), e.g. "golang:1.21" or
	// "gcr.io/project/app@sha256:abc123 # v1.6.0".
	Name string
	// IsDigestPinned is true when the image reference contains "@sha256:".
	IsDigestPinned bool
	// IsSuppressed is true when the image line carries a # ghat:suppress
	// annotation in the source file.
	IsSuppressed bool
	// Line is the 1-indexed source line of the image: declaration. 0 when unknown.
	Line int
}

type GitlabJobAnalysis struct {
	// Name is the job key in the YAML.
	Name string
	// HasTimeout is true when the job declares a timeout: field.
	HasTimeout bool
	// AllowFailure is true when allow_failure: true is set, or when
	// allow_failure: is an object (partial failure via exit_codes).
	AllowFailure bool
	// Images is the list of container images declared for this job.
	Images []GitlabImageAnalysis
	// Line is the 1-indexed source line of the job key. 0 when unknown.
	Line int
}

type Hook struct {
	ID                      string   `yaml:"id"`
	Name                    string   `yaml:"name,omitempty"`
	Entry                   string   `yaml:"entry,omitempty"`
	Language                string   `yaml:"language,omitempty"`
	Files                   string   `yaml:"files,omitempty"`
	Exclude                 string   `yaml:"exclude,omitempty"`
	Types                   []string `yaml:"types,omitempty"`
	TypesOr                 []string `yaml:"types_or,omitempty"`
	ExcludeTypes            []string `yaml:"exclude_types,omitempty"`
	AlwaysRun               *bool    `yaml:"always_run,omitempty"`
	FailFast                *bool    `yaml:"fail_fast,omitempty"`
	Verbose                 *bool    `yaml:"verbose,omitempty"`
	PassFilenames           *bool    `yaml:"pass_filenames,omitempty"`
	RequireSerial           *bool    `yaml:"require_serial,omitempty"`
	Description             string   `yaml:"description,omitempty"`
	LanguageVersion         string   `yaml:"language_version,omitempty"`
	MinimumPrecommitVersion string   `yaml:"minimum_pre_commit_version,omitempty"`
	Args                    []string `yaml:"args,omitempty"`
	Stages                  []string `yaml:"stages,omitempty"`
}

type ImageReference struct {
	Registry    string
	Repository  string
	Tag         string
	Digest      string
	Original    string
	TagImplicit bool // true when no tag was written in the source (defaulted to latest)
}

type InputUpgrade struct {
	Action      string `yaml:"action"`       // e.g. "golangci/golangci-lint-action"
	Input       string `yaml:"input"`        // e.g. "version"
	FromPattern string `yaml:"from_pattern"` // regex matched against the current value
	To          string `yaml:"to"`           // literal version or "latest:owner/repo"
}

type JobAnalysis struct {
	// Name is the job key in the YAML, e.g. "build" or "deploy".
	Name string
	// HasTimeout is true when timeout-minutes: is declared on the job.
	HasTimeout     bool
	TimeoutMinutes int
	// IsReusable is true when the job delegates entirely to a reusable
	// workflow via a job-level `uses:` key.  GitHub does not support
	// timeout-minutes on such jobs; the timeout lives inside the called
	// workflow.
	IsReusable bool
	// RunsOn is the normalised runner label(s) for the job. For a single
	// string label this is just that string; for a list of labels the
	// values are joined with commas.
	RunsOn string
	// HasPermissions is true when the job declares its own permissions: block.
	HasPermissions bool
	// Permissions maps each GitHub Actions permission scope to its value
	// (e.g. "contents" → "read").  When permissions: write-all is set the
	// map has a single "_all" key with value "write-all".
	Permissions map[string]string
	// Line is the 1-indexed source line of the job key. 0 when unknown.
	Line int
}

type ManifestKind int

type OrgFlags struct {
	Provider    string // "github" (default) or "gitlab"
	BaseURL     string // self-hosted API root, e.g. https://gitlab.example.com
	Owner       string
	Repos       []string // explicit list; if set, Owner/Limit are ignored
	Token       string   // PAT for Provider (clone/push/PR)
	GitHubToken string   // separate PAT for api.github.com lookups during the sweep
	Branch      string
	Offset      int
	Limit       int
	DryRun      bool
	OpenPR      bool
	AutoMerge   bool
	Threshold   int // pause when fewer than this many API requests remain
}

type PreCommitAnalysis struct {
	Repos []PreCommitRepoAnalysis
}

type PreCommitRepoAnalysis struct {
	// Repo is the repository URL as written, e.g.
	// "https://github.com/pre-commit/pre-commit-hooks".
	Repo string
	// Rev is the raw rev: value as written.
	Rev string
	// IsSHAPinned is true when Rev is a 40-char hex SHA (bare or "sha # tag").
	IsSHAPinned bool
	// Suppressed is true when either the repo: or rev: line carries
	// # ghat:suppress.
	Suppressed bool
	// Line is the 1-indexed source line of the `rev:` key.
	Line int
}

type ProviderInfo struct {
	Name           string
	Source         string
	Namespace      string
	Type           string
	CurrentVersion string
	LatestVersion  string
}

type ProviderVersion struct {
	Version   string   `json:"version"`
	Protocols []string `json:"protocols"`
	Platforms []struct {
		OS   string `json:"os"`
		Arch string `json:"arch"`
	} `json:"platforms"`
}

type ProviderVersionsResponse struct {
	Versions []ProviderVersion `json:"versions"`
}

type RateLimitError struct {
	ResetTime time.Time
	Remaining int
}

type Registry struct {
	Registry      bool
	LatestVersion string
}

type Repo struct {
	Hooks []Hook `yaml:"hooks"`
	Repo  string `yaml:"repo"`
	Rev   string `yaml:"rev,omitempty"`
}

type RepoResult struct {
	Repo   string
	Status string // "pinned", "already-pinned", "pr-open", "error"
	PRUrl  string
	Error  error
	Gaps   []string
}

type StepAnalysis struct {
	// Action is the action reference without the @ref part, e.g.
	// "actions/checkout" or "aws-actions/configure-aws-credentials".
	Action string
	// Ref is the raw ref as written in the YAML, e.g. "v4" or the ghat
	// pinned format "abc1234…  # v4".
	Ref string
	// IsSHAPinned is true when Ref is anchored to an immutable 40-char
	// commit SHA (bare or in the "sha # tag" comment format).
	IsSHAPinned bool
	// SHA is the extracted commit SHA when IsSHAPinned is true.
	SHA string
	// Tag is the human-readable tag associated with SHA (from the
	// "sha # tag" comment), or the raw floating tag when not yet pinned.
	Tag string
	// Suppressed is true when the uses: line carries a # ghat:suppress
	// annotation — the step is intentionally exempt from pinning.
	Suppressed bool
	// ExposesSecretInEnv is true when the step's env: block contains a
	// ${{ secrets.* }} expression, leaking secret values into the process
	// environment where they are visible to child processes and debug logs.
	ExposesSecretInEnv bool
	// Line is the 1-indexed source line of the `uses:` key. 0 when unknown.
	Line int
}

type Submodule struct {
	Name           string
	Path           string
	URL            string
	Suppressed     bool
	SuppressReason string
}

type Substitution struct {
	From string `yaml:"from"`
	To   string `yaml:"to"`
}

type URLFormatError struct {
	// contains filtered or unexported fields
}

type WorkflowAnalysis struct {
	// HasPermissions is true when the workflow declares a top-level
	// permissions: block (any value, including write-all).
	HasPermissions bool
	// IsWriteAll is true when permissions: write-all is set, granting the
	// GITHUB_TOKEN full repository write access to every job.
	IsWriteAll bool
	// HasDangerousTrigger is true when a dangerous trigger combination is
	// detected:
	//   - pull_request_target with a checkout of the PR head, OR
	//   - github.event.* interpolated directly into a run: shell block.
	HasDangerousTrigger  bool
	DangerousTriggerDesc string
	// HasConcurrency is true when the workflow declares a top-level
	// concurrency: block, preventing parallel runs from corrupting state.
	HasConcurrency bool
	// Line numbers (1-indexed) for the constructs above. 0 when absent.
	PermissionsLine      int
	WriteAllLine         int
	DangerousTriggerLine int
	// JobsLine is the line of the top-level `jobs:` key, used by editors
	// as an insert anchor for a permissions: block.
	JobsLine int
	// Steps is the ordered list of external uses: action references found in
	// the workflow. Local paths, docker:// refs, and reusable workflow calls
	// are excluded.
	Steps []StepAnalysis
	// Jobs is the per-job analysis, sorted by job name.
	Jobs []JobAnalysis
}