data

type BinaryAnalysis struct {
	Suspected    []string // OSPS-QA-05.01: suspected executable binary artifacts
	Unreviewable []string // OSPS-QA-05.02: unreviewable binary artifacts
	Err          error
}

type ClientMock struct {
	Response *http.Response
	Err      error
}

type GitHubRepositoryMetadata struct {
	Releases []ReleaseData
	// contains filtered or unexported fields
}

type GraphqlRepoData struct {
	Repository struct {
		Name                    string
		HasDiscussionsEnabled   bool
		HasIssuesEnabled        bool
		IsSecurityPolicyEnabled bool

		Object struct {
			Tree struct {
				Entries []struct {
					Name string
					Type string // "blob" for files, "tree" for directories
					Path string
				}
			} `graphql:"... on Tree"`
		} `graphql:"object(expression: \"HEAD:\")"`

		DefaultBranchRef struct {
			Name          string
			RefUpdateRule struct {
				AllowsDeletions              bool
				AllowsForcePushes            bool
				RequiredApprovingReviewCount int
			}
			BranchProtectionRule struct {
				RestrictsPushes             bool // This didn't give an accurate result
				RequiresApprovingReviews    bool // This gave an accurate result
				RequiresCommitSignatures    bool
				RequiresStatusChecks        bool
				RequireLastPushApproval     bool
				RequiredStatusCheckContexts []string
			}

			Target struct {
				OID    string `graphql:"oid"` // Latest commit SHA
				Commit struct {
					Status struct {
						State    string // Overall commit status
						Contexts []struct {
							Context     string
							Description string
							State       string
							TargetURL   string `graphql:"targetUrl"`
						}
					} `graphql:"status"` // Classic status API

					AssociatedPullRequests struct {
						Nodes []struct {
							StatusCheckRollup struct {
								Commit struct {
									CheckSuites struct {
										Nodes []struct {
											CheckRuns struct {
												Nodes []struct {
													Name string `graphql:"name"`
												}
											} `graphql:"checkRuns(first: 25)"`
										}
									} `graphql:"checkSuites(first: 25)"`
								}
							}
						}
					} `graphql:"associatedPullRequests(last: 1)"`
				} `graphql:"... on Commit"`
			} `graphql:"target"`
		}
		LicenseInfo struct {
			Name   string
			SpdxId string
			Url    string
		}
		LatestRelease struct {
			Description string
		}
		ContributingGuidelines struct {
			Body string
		}
		Releases struct {
			Nodes []struct {
				TagName string
				Name    string
				Assets  struct {
					Nodes []struct {
						Name        string
						ContentType string
					}
				} `graphql:"releaseAssets(first: 100)"`
			}
		} `graphql:"releases(first: 1, orderBy: {field: CREATED_AT, direction: DESC})"`

		// Selected here rather than in its own query: it targets the same
		// repository node, so it costs nothing extra to fetch alongside.
		DependencyGraphManifests struct {
			TotalCount int
		}
	} `graphql:"repository(owner: $owner, name: $name)"`
}

type GraphqlRepoTree struct {
	Repository struct {
		Object struct {
			Tree struct {
				Entries []struct {
					Name   string
					Type   string
					Path   string
					Mode   int
					Object *struct {
						Blob struct {
							IsBinary    *bool
							IsTruncated bool
						} `graphql:"... on Blob"`
						Tree struct {
							Entries []struct {
								Name   string
								Type   string
								Path   string
								Mode   int
								Object *struct {
									Blob struct {
										IsBinary    *bool
										IsTruncated bool
									} `graphql:"... on Blob"`
									Tree struct {
										Entries []struct {
											Name   string
											Type   string
											Path   string
											Mode   int
											Object *struct {
												Blob struct {
													IsBinary    *bool
													IsTruncated bool
												} `graphql:"... on Blob"`
											} `graphql:"object"`
										}
									} `graphql:"... on Tree"`
								} `graphql:"object"`
							}
						} `graphql:"... on Tree"`
					} `graphql:"object"`
				}
			} `graphql:"... on Tree"`
		} `graphql:"object(expression: $branch)"`
	} `graphql:"repository(owner: $owner, name: $name)"`
}

type GraphqlWorkflowFiles struct {
	Repository struct {
		Object struct {
			Tree struct {
				Entries []WorkflowTreeEntry
			} `graphql:"... on Tree"`
		} `graphql:"object(expression: $expression)"`
	} `graphql:"repository(owner: $owner, name: $name)"`
}

type HttpClient interface {
	Do(req *http.Request) (*http.Response, error)
}

type Payload struct {
	*GraphqlRepoData
	*RestData
	*pluginkit.APICallCounter // Enable Privateer benchmarking for API calls
	Evidence                  *gemara.EvidenceCollector
	Config                    *config.Config
	RepositoryMetadata        RepositoryMetadata
	DependencyManifestsCount  int
	IsCodeRepo                bool
	SecurityPosture           SecurityPosture
	Binaries                  BinaryAnalysis
	// contains filtered or unexported fields
}

type PrivateVulnReporting struct {
	Enabled bool
	Known   bool
}

type ReleaseAsset struct {
	Name        string `json:"name"`
	DownloadURL string `json:"browser_download_url"`
}

type ReleaseData struct {
	Id      int            `json:"id"`
	Name    string         `json:"name"`
	TagName string         `json:"tag_name"`
	URL     string         `json:"url"`
	Assets  []ReleaseAsset `json:"assets"`
}

type RepoContent struct {
	Content    []*github.RepositoryContent
	SubContent map[string]RepoContent
}

type RepoSecurityPosture struct {
	// contains filtered or unexported fields
}

type RepositoryMetadata interface {
	IsActive() bool
	IsPublic() bool
	Homepage() string
	OrganizationBlogURL() *string
	IsDefaultBranchProtected() *bool
	DefaultBranchRequiresPRReviews() *bool
	IsDefaultBranchProtectedFromDeletion() *bool
	HasBranchRules() bool
	RequiredStatusCheckContexts() []string
	RulesetsObserved() bool
	ViewerCanAdminister() bool
}

type RestData struct {
	Config              *config.Config
	WorkflowsEnabled    bool
	WorkflowPermissions WorkflowPermissions
	// WorkflowPermissionsObserved is true only when both admin-only Actions
	// endpoints were fetched and parsed successfully. When false, WorkflowsEnabled
	// and WorkflowPermissions are unset defaults rather than observed values, and
	// callers must not read "Actions disabled" or "write default" into them.
	WorkflowPermissionsObserved bool
	Insights                    si.SecurityInsights
	InsightsError               bool
	PrivateVulnReporting        PrivateVulnReporting
	SecurityPolicy              SecurityPolicy
	Releases                    []ReleaseData

	HttpClient HttpClient `json:"-" yaml:"-"`
	// contains filtered or unexported fields
}

type SecurityPolicy struct {
	Present bool
	Content string
}

type SecurityPosture interface {
	// PreventsPushingSecrets and ScansForSecrets report the push-protection and
	// secret-scanning settings observed in GitHub's security_and_analysis block.
	// They are false when the block was not readable — check SecretScanningObservable.
	PreventsPushingSecrets() bool
	ScansForSecrets() bool
	DefinesPolicyForHandlingSecrets() bool
	// SecretScanningObservable reports whether GitHub's security_and_analysis block
	// was readable. GitHub returns it only to callers with admin access to the
	// repository, so for repositories we do not administer the observed settings
	// are unreadable — distinct from being disabled.
	SecretScanningObservable() bool
	// InsightsDeclaresSecretScanning reports a Security Insights self-declaration of
	// secret-scanning tooling, independent of (and possibly instead of) GitHub's
	// native settings.
	InsightsDeclaresSecretScanning() bool
}

type WorkflowBlob struct {
	Text        string
	IsTruncated bool
}

type WorkflowBlobObject struct {
	Blob WorkflowBlob `graphql:"... on Blob"`
}

type WorkflowFile struct {
	Name      string
	Path      string
	Content   string
	Truncated bool
}

type WorkflowPermissions struct {
	DefaultPermissions    string `json:"default_workflow_permissions"`
	CanApprovePullRequest bool   `json:"can_approve_pull_request_reviews"`
}

type WorkflowTreeEntry struct {
	Name   string
	Path   string
	Type   string
	Mode   int
	Object *WorkflowBlobObject `graphql:"object"`
}