cli

type ArtifactHandoffResult struct {
	// ID is the GitHub artifact identifier.
	ID int64 `json:"id"`
	// Name is the GitHub artifact name.
	Name string `json:"name"`
	// Digest is the GitHub-reported digest, always sha256-prefixed.
	Digest string `json:"digest"`
	// SizeBytes is the reported archive size.
	SizeBytes int64 `json:"size_bytes"`
	// RunID is the workflow run that owns the artifact.
	RunID int64 `json:"run_id"`
	// ExpiresAt is the RFC3339 expiry instant, or empty when GitHub omitted it.
	ExpiresAt string `json:"expires_at"`
}

type BinaryResult struct {
	// Arch is the GOARCH of the selected binary.
	Arch string `json:"arch"`
	// Name is the binary filename.
	Name string `json:"name"`
	// Path is the original GoReleaser path, including the --dist basename prefix.
	Path string `json:"path"`
	// Mode is the observed permission bits as an octal string.
	Mode string `json:"mode"`
}

type BuildInfo struct {
	// Version is the release version.
	Version string
	// Commit is the source commit used to build the binary.
	Commit string
	// Protocol is the workflow/binary contract integer.
	Protocol int
}

type BundleFileResult struct {
	// Name is the flat file name inside the distribution directory.
	Name string `json:"name"`
	// Digest is the lowercase SHA-256 hex digest with no prefix.
	Digest string `json:"digest"`
}

type BundleResult struct {
	// Dist is the distribution directory selected by --dist or RELEASE_DIST.
	Dist string `json:"dist"`
	// Identity is the exact certificate identity URL used for verification.
	Identity string `json:"identity"`
	// Issuer is the OIDC issuer used for verification.
	Issuer string `json:"issuer"`
	// Payloads are the checksummed release payloads, in checksums.txt order.
	Payloads []BundleFileResult `json:"payloads"`
	// Controls are checksums.txt then checksums.txt.sigstore.json.
	Controls []BundleFileResult `json:"controls"`
}

type Envelope struct {
	// Schema identifies the envelope version.
	Schema string `json:"schema"`
	// Command is the verb path that produced the document.
	Command string `json:"command"`
	// OK is true when the command succeeded.
	OK bool `json:"ok"`
	// Result is the command-specific payload.
	Result any `json:"result"`
}

type ErrorResult struct {
	// Error is the diagnostic string also written to stderr.
	Error string `json:"error"`
}

type GitHubEndpoint struct {
	// APIURL is a non-public GitHub API base. Empty selects api.github.com.
	APIURL string
	// ServerURL is the GitHub HTML/upload base used with a non-public APIURL.
	ServerURL string
}

type HandoffResult struct {
	// Artifact is the verified Actions artifact metadata.
	Artifact ArtifactHandoffResult `json:"artifact"`
}

type HomebrewTapInitResult struct {
	// Tap is the initialized owner/homebrew-name repository.
	Tap string `json:"tap"`
	// Output is the local scaffold directory.
	Output string `json:"output"`
	// Files lists every generated slash-separated path in lexical order.
	Files []string `json:"files"`
}

type LookupEnv func(key string) (string, bool)

type Options struct {
	// In receives command input.
	In io.Reader
	// Out receives machine-readable command output.
	Out io.Writer
	// Err receives diagnostics and human-readable status.
	Err io.Writer
	// LookupEnv resolves RELEASE_* and Actions environment variables. Nil selects [os.LookupEnv].
	LookupEnv LookupEnv
	// Build controls version output.
	Build BuildInfo
	// ArtifactMeta, when set, is the handoff metadata port. Tests inject it.
	ArtifactMeta pubgh.ArtifactMeta
	// NewArtifactMeta constructs the metadata port from a token and API endpoint.
	NewArtifactMeta func(token string, endpoint GitHubEndpoint) (pubgh.ArtifactMeta, error)
	// StateReader, when set, is the registry read port. Tests inject it.
	StateReader puboci.StateReader
	// NewStateReader constructs the registry read port from resolved registry config.
	NewStateReader func(config RegistryConfig) (puboci.StateReader, error)
	// ContentPusher, when set, is the registry write port. Tests inject it.
	ContentPusher puboci.ContentPusher
	// NewContentPusher constructs the registry write port from resolved registry config.
	NewContentPusher func(config RegistryConfig) (puboci.ContentPusher, error)
	// Signer, when set, is the Cosign signing port. Tests inject it.
	Signer puboci.Signer
	// NewSigner constructs the Cosign signing port from a binary path.
	//
	// An empty path resolves cosign from PATH.
	NewSigner func(path string) (puboci.Signer, error)
	// TagCommitter, when set, is the registry tag-write port. Tests inject it.
	TagCommitter puboci.TagCommitter
	// NewTagCommitter constructs the registry tag-write port from resolved registry config.
	NewTagCommitter func(config RegistryConfig) (puboci.TagCommitter, error)
	// BlobVerifier, when set, is the detached-bundle verification port. Tests inject it.
	BlobVerifier pubgh.BlobVerifier
	// NewBlobVerifier constructs the detached-bundle verification port from a
	// Cosign binary path and a distribution directory.
	//
	// An empty path resolves cosign from PATH.
	NewBlobVerifier func(path, dir string) (pubgh.BlobVerifier, error)
	// ReleaseReader, when set, is the GitHub release read port. Tests inject it.
	ReleaseReader pubgh.ReleaseReader
	// NewReleaseReader constructs the GitHub release read port from a token
	// and API endpoint.
	NewReleaseReader func(token rel.Secret, endpoint GitHubEndpoint) (pubgh.ReleaseReader, error)
	// AssetReplacer, when set, is the GitHub release upload port. Tests inject it.
	AssetReplacer pubgh.AssetReplacer
	// NewAssetReplacer constructs the GitHub release upload port from a token,
	// a gh binary path, and a working directory.
	//
	// An empty path resolves gh from PATH.
	NewAssetReplacer func(token rel.Secret, path, dir string) (pubgh.AssetReplacer, error)
	// Publisher, when set, is the GitHub release undraft port. Tests inject it.
	Publisher pubgh.Publisher
	// NewPublisher constructs the GitHub release undraft port from a token
	// and API endpoint.
	NewPublisher func(token rel.Secret, endpoint GitHubEndpoint) (pubgh.Publisher, error)
	// RefResolver, when set, is the local tag-to-SHA port. Tests inject it.
	RefResolver pubgh.RefResolver
	// NewRefResolver constructs the local tag-to-SHA port from a git binary
	// path and a working directory.
	//
	// An empty path resolves git from PATH. An empty directory inherits
	// the process working directory.
	NewRefResolver func(path, dir string) (pubgh.RefResolver, error)
	// TapReader, when set, is the Homebrew tap read port. Tests inject it.
	TapReader pubbrew.RepositoryReader
	// NewTapReader constructs the tap read port from a token and API endpoint.
	NewTapReader func(token rel.Secret, endpoint GitHubEndpoint) (pubbrew.RepositoryReader, error)
	// TapWriter, when set, is the Homebrew tap mutation port. Tests inject it.
	TapWriter pubbrew.RepositoryWriter
	// NewTapWriter constructs the tap mutation port from a token and API endpoint.
	NewTapWriter func(token rel.Secret, endpoint GitHubEndpoint) (pubbrew.RepositoryWriter, error)
	// BucketReader, when set, is the Scoop bucket read port. Tests inject it.
	BucketReader pubscoop.RepositoryReader
	// NewBucketReader constructs the bucket read port from a token and API endpoint.
	NewBucketReader func(token rel.Secret, endpoint GitHubEndpoint) (pubscoop.RepositoryReader, error)
	// BucketWriter, when set, is the Scoop bucket mutation port. Tests inject it.
	BucketWriter pubscoop.RepositoryWriter
	// NewBucketWriter constructs the bucket mutation port from a token and API endpoint.
	NewBucketWriter func(token rel.Secret, endpoint GitHubEndpoint) (pubscoop.RepositoryWriter, error)
	// APKBuilder, when set, is the Melange APK-build port. Tests inject it.
	APKBuilder image.APKBuilder
	// NewAPKBuilder constructs the Melange APK-build port from a binary path.
	//
	// An empty path resolves melange from PATH.
	NewAPKBuilder func(path string) (image.APKBuilder, error)
	// Composer, when set, is the apko compose port. Tests inject it.
	Composer image.Composer
	// NewComposer constructs the apko compose port from a binary path.
	//
	// An empty path resolves apko from PATH.
	NewComposer func(path string) (image.Composer, error)
	// RunGoReleaser builds the release bundle. Nil selects [goprof.RunGoReleaser].
	RunGoReleaser func(ctx context.Context, options goprof.GoReleaserOptions) error
	// PackageRepositoryPublisher, when set, is the complete package publication seam.
	// Tests inject it to avoid network, process, and object-storage side effects.
	PackageRepositoryPublisher PackageRepositoryPublisher
	// contains filtered or unexported fields
}

type PackageRepositoryPublisher interface {
	// Publish verifies one producer release and converges the configured repository.
	Publish(ctx context.Context, input pkgrepo.PublishInput) (pkgrepo.PublishResult, error)
}

type PlanTagsResult struct {
	// Image is the OCI image whose tags were inspected.
	Image string `json:"image"`
	// Version is the candidate stable release version.
	Version string `json:"version"`
	// Digest is the candidate OCI index digest.
	Digest string `json:"digest"`
	// Tags are the tags with a create decision, in decision order.
	Tags []string `json:"tags"`
	// Decisions are the exact tag and each channel, in policy order.
	Decisions []TagDecisionResult `json:"decisions"`
}

type RegistryConfig struct {
	// Credentials authenticates registry reads and writes. An empty password is anonymous.
	Credentials RegistryCredentials
	// PlainHTTP forces HTTP instead of HTTPS. Tests use this against a local registry.
	PlainHTTP bool
}

type RegistryCredentials struct {
	// Username is GITHUB_ACTOR, or x-access-token when a token is present.
	Username string
	// Password is the token from GITHUB_TOKEN or GH_TOKEN.
	Password rel.Secret
}

type ScoopBucketInitResult struct {
	// Bucket is the initialized owner/repository bucket.
	Bucket string `json:"bucket"`
	// Output is the local scaffold directory.
	Output string `json:"output"`
	// Files lists every generated slash-separated path in lexical order.
	Files []string `json:"files"`
}

type Settings struct {
	// Profile is the selected --profile / RELEASE_PROFILE value.
	Profile string
	// Dist is the selected --dist / RELEASE_DIST path.
	Dist string
	// Identity is the selected --identity / RELEASE_IDENTITY URL.
	Identity string
	// Issuer is the selected --issuer / RELEASE_ISSUER URL.
	Issuer string
	// ArtifactID is the selected --artifact-id / RELEASE_ARTIFACT_ID value.
	ArtifactID string
	// Image is the selected --image / RELEASE_IMAGE value.
	Image string
	// Version is the selected --version / RELEASE_VERSION value.
	Version string
	// Digest is the selected --digest / RELEASE_DIGEST value.
	Digest string
	// Layout is the selected --layout / RELEASE_LAYOUT path.
	Layout string
	// Input is the selected --input / RELEASE_INPUT path.
	Input string
	// Work is the selected --work / RELEASE_WORK path.
	Work string
	// Output is the selected --output / RELEASE_OUTPUT path.
	Output string
	// MelangeConfig is the selected --melange-config / RELEASE_MELANGE_CONFIG path.
	MelangeConfig string
	// ApkoConfig is the selected --apko-config / RELEASE_APKO_CONFIG path.
	ApkoConfig string
	// BuildDate is the selected --build-date / RELEASE_BUILD_DATE value.
	BuildDate string
	// Binary is the selected --binary / RELEASE_BINARY value.
	Binary string
	// DryRun reports whether --dry-run / RELEASE_DRY_RUN requested a dry run.
	DryRun bool
	// PlainHTTP reports whether --plain-http requested HTTP.
	PlainHTTP bool
	// NoUndraft reports whether --no-undraft requested a draft-only publish.
	NoUndraft bool

	// JSON reports whether --json / RELEASE_JSON requested structured output.
	JSON bool
	// contains filtered or unexported fields
}

type StageResult struct {
	// Assets is the number of checksummed payloads that matched.
	Assets int `json:"assets"`
	// Binaries are the verified Linux binaries, architecture-major then name-ascending.
	Binaries []BinaryResult `json:"binaries"`
}

type TagDecisionResult struct {
	// Tag is the exact or channel tag that was evaluated.
	Tag string `json:"tag"`
	// Scope is the tag scope: exact, minor, major, or latest.
	Scope string `json:"scope"`
	// Action is the planned outcome: create, accept, or retain.
	Action string `json:"action"`
}

type VersionResult struct {
	// Version is the stamped release version.
	Version string `json:"version"`
	// Commit is the stamped source commit.
	Commit string `json:"commit"`
	// Protocol is the workflow/binary contract integer.
	Protocol int `json:"protocol"`
}