v1alpha1

type ActionEnabledRepo struct {
	// Name of the repository
	// +crossplane:generate:reference:type=github.com/provider-github/provider-github/apis/cluster/organizations/v1alpha1.Repository
	Repo string `json:"repo,omitempty"`

	// RepoRef is a reference to the Repositories
	// +optional
	RepoRef *xpv2.Reference `json:"repoRef,omitempty"`

	// RepoSelector selects a reference to an Repositories
	// +optional
	RepoSelector *xpv2.Selector `json:"repoSelector,omitempty"`
}

type ActionEnabledRepoObservation struct {
	// Repo is the name of the repository.
	Repo string `json:"repo,omitempty"`
}

type ActionsConfiguration struct {
	// EnabledRepos is the set of repositories allowed to run GitHub
	// Actions at the organization level (equivalent to GitHub's
	// "selected_repository_ids" list when the org's Actions permission
	// policy is "selected"). The provider reconciles the org's enabled
	// list to match this field via a single atomic PUT.
	//
	// The field is tri-state:
	//   - omitted / nil: the provider does not manage the enabled list;
	//     whatever is already configured on GitHub is left untouched.
	//   - empty slice ([]): the provider sets the enabled list to empty,
	//     disabling Actions for every repository in the org.
	//   - non-empty: the provider sets the enabled list to exactly these
	//     repositories, adding any missing and removing any extras.
	//
	// To stop managing the list, remove the field. Setting it to [] is
	// an explicit "wipe" and will affect every repo in the org.
	// +optional
	EnabledRepos []ActionEnabledRepo `json:"enabledRepos"`
}

type ActionsConfigurationObservation struct {
	// EnabledRepos lists the repositories enabled to run GitHub Actions at
	// the organization level. GitHub is queried for the list only while
	// forProvider.actions.enabledRepos is set, so the field is empty otherwise.
	// +optional
	EnabledRepos []ActionEnabledRepoObservation `json:"enabledRepos"`
}

type ActionsSecretAccess struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ActionsSecretAccessSpec   `json:"spec"`
	Status ActionsSecretAccessStatus `json:"status,omitempty"`
}

type ActionsSecretAccessList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ActionsSecretAccess `json:"items"`
}

type ActionsSecretAccessObservation struct {
	// ID is the external name of the secret on GitHub.
	ID string `json:"id,omitempty"`

	// Org is the organization the secret was found under.
	Org string `json:"org,omitempty"`

	// Visibility is the visibility GitHub reports for the secret.
	Visibility string `json:"visibility,omitempty"`

	// SelectedRepositories lists the repositories that may use the secret on
	// GitHub. GitHub is queried for the list only while
	// forProvider.visibility is "selected", so the field is empty otherwise.
	// +optional
	SelectedRepositories []SecretSelectedRepoObservation `json:"selectedRepositories"`
}

type ActionsSecretAccessParameters struct {
	// Org is the name of the GitHub organization that owns this secret.
	// +crossplane:generate:reference:type=github.com/provider-github/provider-github/apis/cluster/organizations/v1alpha1.Organization
	Org string `json:"org,omitempty"`

	// OrgRef is a reference to an Organization.
	// +optional
	OrgRef *xpv2.Reference `json:"orgRef,omitempty"`

	// OrgSelector selects a reference to an Organization.
	// +optional
	OrgSelector *xpv2.Selector `json:"orgSelector,omitempty"`

	// Visibility declares which repositories may use the secret: all, private,
	// or the selected list. The provider enforces the list when visibility is
	// "selected" but cannot change visibility itself; a mismatch with GitHub
	// sets Ready=False with the reason.
	// +kubebuilder:validation:Enum=all;private;selected
	// +optional
	Visibility string `json:"visibility,omitempty"`

	// SelectedRepositories lists the repositories that may use the secret.
	// Only used (and required) when Visibility is "selected".
	// +optional
	SelectedRepositories []SecretSelectedRepo `json:"selectedRepositories"`
}

type ActionsSecretAccessSpec struct {
	xpv2.ClusterManagedResourceSpec `json:",inline"`
	ForProvider                     ActionsSecretAccessParameters `json:"forProvider"`

	// DriftDetection configures which forProvider fields are owned outside
	// Crossplane and how drift in those fields is detected and corrected.
	// Absent configuration means drift detection is enabled with no ignored
	// paths.
	// +optional
	DriftDetection *driftdetection.DriftDetection `json:"driftDetection,omitempty"`
}

type ActionsSecretAccessStatus struct {
	xpv2.ManagedResourceStatus `json:",inline"`
	AtProvider                 ActionsSecretAccessObservation `json:"atProvider,omitempty"`
}

type BranchProtectionRestrictions struct {
	// If set to true, will cause the restrictions setting to also block pushes which create new branches
	// unless initiated by a user, team, app with the ability to push.
	// Default: false
	// +optional
	BlockCreations *bool `json:"blockCreations,omitempty"`

	// Only people allowed to push will be able to create new branches matching this rule.
	// +optional
	Users []string `json:"users"`

	// Only teams allowed to push will be able to create new branches matching this rule.
	// +optional
	Teams []string `json:"teams"`

	// Only apps allowed to push will be able to create new branches matching this rule.
	// +optional
	Apps []string `json:"apps"`
}

type BranchProtectionRestrictionsObservation struct {
	// BlockCreations is whether pushes that create new branches are blocked
	// unless initiated by an actor allowed to push.
	BlockCreations *bool `json:"blockCreations,omitempty"`

	// Users lists the user logins allowed to push.
	// +optional
	Users []string `json:"users"`

	// Teams lists the team slugs allowed to push.
	// +optional
	Teams []string `json:"teams"`

	// Apps lists the app slugs allowed to push.
	// +optional
	Apps []string `json:"apps"`
}

type BranchProtectionRule struct {
	// The branch name to apply the protection rule to.
	Branch string `json:"branch"`

	// Require status checks to pass before merging.
	// When enabled, commits must first be pushed to another branch,
	// then merged or pushed directly to a branch that matches this rule after status checks have passed.
	// +optional
	RequiredStatusChecks *RequiredStatusChecks `json:"requiredStatusChecks,omitempty"`

	// Require a pull request before merging.
	// When enabled, all commits must be made to a non-protected branch and submitted via a pull request
	// before they can be merged into a branch that matches this rule.
	// +optional
	RequiredPullRequestReviews *RequiredPullRequestReviews `json:"requiredPullRequestReviews,omitempty"`

	// Restrict who can push to matching branches.
	// Specify people, teams, or apps allowed to push to matching branches.
	// Required status checks will still prevent these people, teams, and apps from merging if the checks fail.
	// +optional
	BranchProtectionRestrictions *BranchProtectionRestrictions `json:"branchProtectionRestrictions,omitempty"`

	// Enforce settings even for administrators and custom roles with the "bypass branch protections" permission.
	EnforceAdmins bool `json:"enforceAdmins"`

	// Prevent merge commits from being pushed to matching branches.
	// Default: false
	// +optional
	RequireLinearHistory *bool `json:"requireLinearHistory,omitempty"`

	// Permit force pushes for all users with push access.
	// Default: false
	// +optional
	AllowForcePushes *bool `json:"allowForcePushes,omitempty"`

	// Allow users with push access to delete matching branches.
	// Default: false
	// +optional
	AllowDeletions *bool `json:"allowDeletions,omitempty"`

	// When enabled, all conversations on code must be resolved before a pull request can be merged into a branch that matches this rule.
	// Default: false
	// +optional
	RequiredConversationResolution *bool `json:"requiredConversationResolution,omitempty"`

	// Branch is read-only. Users cannot push to the branch.
	// Default: false
	// +optional
	LockBranch *bool `json:"lockBranch,omitempty"`

	// Will allow users to pull changes from upstream when the branch is locked.
	// Default: false
	// +optional
	AllowForkSyncing *bool `json:"allowForkSyncing,omitempty"`

	// Commits pushed to matching branches must have verified signatures.
	// Default: false
	// +optional
	RequireSignedCommits *bool `json:"requireSignedCommits,omitempty"`
}

type BranchProtectionRuleObservation struct {
	// Branch is the name of the protected branch.
	Branch string `json:"branch,omitempty"`

	// RequiredStatusChecks is the observed status checks requirement.
	RequiredStatusChecks *RequiredStatusChecksObservation `json:"requiredStatusChecks,omitempty"`

	// RequiredPullRequestReviews is the observed pull request requirement.
	RequiredPullRequestReviews *RequiredPullRequestReviewsObservation `json:"requiredPullRequestReviews,omitempty"`

	// BranchProtectionRestrictions is the observed push restriction.
	BranchProtectionRestrictions *BranchProtectionRestrictionsObservation `json:"branchProtectionRestrictions,omitempty"`

	// EnforceAdmins is whether the rule is enforced for administrators.
	EnforceAdmins *bool `json:"enforceAdmins,omitempty"`

	// RequireLinearHistory is whether merge commits are prevented.
	RequireLinearHistory *bool `json:"requireLinearHistory,omitempty"`

	// AllowForcePushes is whether force pushes are permitted.
	AllowForcePushes *bool `json:"allowForcePushes,omitempty"`

	// AllowDeletions is whether the branch can be deleted.
	AllowDeletions *bool `json:"allowDeletions,omitempty"`

	// RequiredConversationResolution is whether conversations must be resolved before merging.
	RequiredConversationResolution *bool `json:"requiredConversationResolution,omitempty"`

	// LockBranch is whether the branch is read-only.
	LockBranch *bool `json:"lockBranch,omitempty"`

	// AllowForkSyncing is whether users can pull changes from upstream while the branch is locked.
	AllowForkSyncing *bool `json:"allowForkSyncing,omitempty"`

	// RequireSignedCommits is whether commits must have verified signatures.
	RequireSignedCommits *bool `json:"requireSignedCommits,omitempty"`
}

type BypassPullRequestAllowancesObservation struct {
	// Users lists the user logins.
	// +optional
	Users []string `json:"users"`

	// Teams lists the team slugs.
	// +optional
	Teams []string `json:"teams"`

	// Apps lists the app slugs.
	// +optional
	Apps []string `json:"apps"`
}

type BypassPullRequestAllowancesRequest struct {
	// The list of user logins allowed to bypass pull request requirements.
	// +optional
	Users []string `json:"users"`

	// The list of team slugs allowed to bypass pull request requirements.
	// +optional
	Teams []string `json:"teams"`

	// The list of app slugs allowed to bypass pull request requirements.
	// +optional
	Apps []string `json:"apps"`
}

type DependabotSecretAccess struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DependabotSecretAccessSpec   `json:"spec"`
	Status DependabotSecretAccessStatus `json:"status,omitempty"`
}

type DependabotSecretAccessList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DependabotSecretAccess `json:"items"`
}

type DependabotSecretAccessObservation struct {
	// ID is the external name of the secret on GitHub.
	ID string `json:"id,omitempty"`

	// Org is the organization the secret was found under.
	Org string `json:"org,omitempty"`

	// Visibility is the visibility GitHub reports for the secret.
	Visibility string `json:"visibility,omitempty"`

	// SelectedRepositories lists the repositories that may use the secret on
	// GitHub. GitHub is queried for the list only while
	// forProvider.visibility is "selected", so the field is empty otherwise.
	// +optional
	SelectedRepositories []SecretSelectedRepoObservation `json:"selectedRepositories"`
}

type DependabotSecretAccessParameters struct {
	// Org is the name of the GitHub organization that owns this secret.
	// +crossplane:generate:reference:type=github.com/provider-github/provider-github/apis/cluster/organizations/v1alpha1.Organization
	Org string `json:"org,omitempty"`

	// OrgRef is a reference to an Organization.
	// +optional
	OrgRef *xpv2.Reference `json:"orgRef,omitempty"`

	// OrgSelector selects a reference to an Organization.
	// +optional
	OrgSelector *xpv2.Selector `json:"orgSelector,omitempty"`

	// Visibility declares which repositories may use the secret: all, private,
	// or the selected list. The provider enforces the list when visibility is
	// "selected" but cannot change visibility itself; a mismatch with GitHub
	// sets Ready=False with the reason.
	// +kubebuilder:validation:Enum=all;private;selected
	// +optional
	Visibility string `json:"visibility,omitempty"`

	// SelectedRepositories lists the repositories that may use the secret.
	// Only used (and required) when Visibility is "selected".
	// +optional
	SelectedRepositories []SecretSelectedRepo `json:"selectedRepositories"`
}

type DependabotSecretAccessSpec struct {
	xpv2.ClusterManagedResourceSpec `json:",inline"`
	ForProvider                     DependabotSecretAccessParameters `json:"forProvider"`

	// DriftDetection configures which forProvider fields are owned outside
	// Crossplane and how drift in those fields is detected and corrected.
	// Absent configuration means drift detection is enabled with no ignored
	// paths.
	// +optional
	DriftDetection *driftdetection.DriftDetection `json:"driftDetection,omitempty"`
}

type DependabotSecretAccessStatus struct {
	xpv2.ManagedResourceStatus `json:",inline"`
	AtProvider                 DependabotSecretAccessObservation `json:"atProvider,omitempty"`
}

type DismissalRestrictionsObservation struct {
	// Users lists the user logins.
	// +optional
	Users []string `json:"users"`

	// Teams lists the team slugs.
	// +optional
	Teams []string `json:"teams"`

	// Apps lists the app slugs.
	// +optional
	Apps []string `json:"apps"`
}

type DismissalRestrictionsRequest struct {
	// The list of user logins with dismissal access.
	// +optional
	Users *[]string `json:"users"`

	// The list of team slugs with dismissal access.
	// +optional
	Teams *[]string `json:"teams"`

	// The list of app slugs with dismissal access.
	// +optional
	Apps *[]string `json:"apps"`
}

type Membership struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MembershipSpec   `json:"spec"`
	Status MembershipStatus `json:"status,omitempty"`
}

type MembershipList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Membership `json:"items"`
}

type MembershipObservation struct {
	// ID is the external name of the membership (the user's login) on GitHub.
	ID string `json:"id,omitempty"`

	// Role is the role GitHub reports for the membership.
	Role string `json:"role,omitempty"`

	// Org is the organization the membership was found under.
	Org string `json:"org,omitempty"`

	ObservableField string `json:"observableField,omitempty"`
}

type MembershipParameters struct {
	// +optional
	Role string `json:"role,omitempty"`

	// Org is the Organization for the Membership
	// +immutable
	// +crossplane:generate:reference:type=github.com/provider-github/provider-github/apis/cluster/organizations/v1alpha1.Organization
	Org string `json:"org,omitempty"`

	// OrgRef is a reference to an Organization
	// +optional
	OrgRef *xpv2.Reference `json:"orgRef,omitempty"`

	// OrgSlector selects a reference to an Organization
	// +optional
	OrgSelector *xpv2.Selector `json:"orgSelector,omitempty"`
}

type MembershipSpec struct {
	xpv2.ClusterManagedResourceSpec `json:",inline"`
	ForProvider                     MembershipParameters `json:"forProvider"`

	// DriftDetection configures which forProvider fields are owned outside
	// Crossplane and how drift in those fields is detected and corrected.
	// Absent configuration means drift detection is enabled with no ignored
	// paths.
	// +optional
	DriftDetection *driftdetection.DriftDetection `json:"driftDetection,omitempty"`
}

type MembershipStatus struct {
	xpv2.ManagedResourceStatus `json:",inline"`
	AtProvider                 MembershipObservation `json:"atProvider,omitempty"`
}

type OrgSecret struct {
	// Name of the GitHub secret
	Name string `json:"name"`

	// List of repositories that have access to the secret.
	// +optional
	RepositoryAccessList []SecretSelectedRepo `json:"repositoryAccessList"`
}

type OrgSecretObservation struct {
	// Name of the GitHub secret.
	Name string `json:"name,omitempty"`

	// RepositoryAccessList lists the repositories that have access to the secret.
	// +optional
	RepositoryAccessList []SecretSelectedRepoObservation `json:"repositoryAccessList"`
}

type Organization struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   OrganizationSpec   `json:"spec"`
	Status OrganizationStatus `json:"status,omitempty"`
}

type OrganizationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Organization `json:"items"`
}

type OrganizationObservation struct {
	// ID is the external name of the organization on GitHub.
	ID string `json:"id,omitempty"`

	Description string `json:"description,omitempty"`

	// Actions is the observed GitHub Actions configuration of the organization.
	Actions ActionsConfigurationObservation `json:"actions,omitempty"`

	// Secrets is the observed state of the organization secrets named in
	// forProvider.secrets. GitHub is queried for them only while that field is set.
	Secrets *SecretConfigurationObservation `json:"secrets,omitempty"`
}

type OrganizationParameters struct {
	// +optional
	Description string               `json:"description"`
	Actions     ActionsConfiguration `json:"actions,omitempty"`

	// Configuration for Organization Secrets.
	// +optional
	Secrets *SecretConfiguration `json:"secrets,omitempty"`
}

type OrganizationSpec struct {
	xpv2.ClusterManagedResourceSpec `json:",inline"`
	ForProvider                     OrganizationParameters `json:"forProvider"`

	// DriftDetection configures which forProvider fields are owned outside
	// Crossplane and how drift in those fields is detected and corrected.
	// Absent configuration means drift detection is enabled with no ignored
	// paths.
	// +optional
	DriftDetection *driftdetection.DriftDetection `json:"driftDetection,omitempty"`
}

type OrganizationStatus struct {
	xpv2.ManagedResourceStatus `json:",inline"`
	AtProvider                 OrganizationObservation `json:"atProvider,omitempty"`
}

type OrganizationVariable struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   OrganizationVariableSpec   `json:"spec"`
	Status OrganizationVariableStatus `json:"status,omitempty"`
}

type OrganizationVariableList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []OrganizationVariable `json:"items"`
}

type OrganizationVariableObservation struct {
	// ID is the external name of the variable on GitHub.
	ID string `json:"id,omitempty"`

	// Org is the organization the variable was found under.
	Org string `json:"org,omitempty"`

	// Value of the variable.
	Value string `json:"value,omitempty"`

	// Visibility is the visibility GitHub reports for the variable.
	Visibility string `json:"visibility,omitempty"`

	// SelectedRepositories lists the repositories that have access to the
	// variable on GitHub. GitHub is queried for the list only while
	// forProvider.visibility is "selected", so the field is empty otherwise.
	// +optional
	SelectedRepositories []VariableSelectedRepoObservation `json:"selectedRepositories"`
}

type OrganizationVariableParameters struct {
	// Org is the name of the GitHub organization that owns this variable.
	// +crossplane:generate:reference:type=github.com/provider-github/provider-github/apis/cluster/organizations/v1alpha1.Organization
	Org string `json:"org,omitempty"`

	// OrgRef is a reference to an Organization.
	// +optional
	OrgRef *xpv2.Reference `json:"orgRef,omitempty"`

	// OrgSelector selects a reference to an Organization.
	// +optional
	OrgSelector *xpv2.Selector `json:"orgSelector,omitempty"`

	// Value of the variable.
	// +optional
	Value string `json:"value"`

	// Visibility controls which repositories can access this variable.
	// +kubebuilder:validation:Enum=all;private;selected
	// +optional
	Visibility string `json:"visibility,omitempty"`

	// SelectedRepositories lists repositories that have access to the
	// variable. Only used (and required) when Visibility is "selected".
	// +optional
	SelectedRepositories []VariableSelectedRepo `json:"selectedRepositories"`
}

type OrganizationVariableSpec struct {
	xpv2.ClusterManagedResourceSpec `json:",inline"`
	ForProvider                     OrganizationVariableParameters `json:"forProvider"`

	// DriftDetection configures which forProvider fields are owned outside
	// Crossplane and how drift in those fields is detected and corrected.
	// Absent configuration means drift detection is enabled with no ignored
	// paths.
	// +optional
	DriftDetection *driftdetection.DriftDetection `json:"driftDetection,omitempty"`
}

type OrganizationVariableStatus struct {
	xpv2.ManagedResourceStatus `json:",inline"`
	AtProvider                 OrganizationVariableObservation `json:"atProvider,omitempty"`
}

type OrganizationWebhook struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   OrganizationWebhookSpec   `json:"spec"`
	Status OrganizationWebhookStatus `json:"status,omitempty"`
}

type OrganizationWebhookList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []OrganizationWebhook `json:"items"`
}

type OrganizationWebhookObservation struct {
	// ID is the GitHub webhook ID.
	ID int64 `json:"id,omitempty"`

	// Org is the organization the webhook was found under.
	Org string `json:"org,omitempty"`

	// URL is the URL to which GitHub delivers payloads.
	URL string `json:"url,omitempty"`

	// ContentType is the media type GitHub uses to serialize payloads.
	ContentType string `json:"contentType,omitempty"`

	// Events lists what the hook is triggered for.
	// +optional
	Events []string `json:"events"`

	// Active is whether notifications are sent when the webhook is triggered.
	Active *bool `json:"active,omitempty"`

	// InsecureSSL is whether GitHub skips verifying the SSL certificate of
	// the host for url.
	InsecureSSL *bool `json:"insecureSsl,omitempty"`
}

type OrganizationWebhookParameters struct {
	// Org is the name of the GitHub organization that owns this webhook.
	// +crossplane:generate:reference:type=github.com/provider-github/provider-github/apis/cluster/organizations/v1alpha1.Organization
	Org string `json:"org,omitempty"`

	// OrgRef is a reference to an Organization.
	// +optional
	OrgRef *xpv2.Reference `json:"orgRef,omitempty"`

	// OrgSelector selects a reference to an Organization.
	// +optional
	OrgSelector *xpv2.Selector `json:"orgSelector,omitempty"`

	// The URL to which the payloads will be delivered. An existing
	// webhook with this URL is adopted.
	// +optional
	URL string `json:"url,omitempty"`

	// The media type used to serialize the payloads. Supported values include json and form.
	// +kubebuilder:validation:Enum=json;form
	// +optional
	ContentType string `json:"contentType,omitempty"`

	// Determines what events the hook is triggered for. See https://docs.github.com/en/webhooks/webhook-events-and-payloads
	// +kubebuilder:validation:MinItems=1
	// +optional
	Events []string `json:"events"`

	// Determines if notifications are sent when the webhook is triggered.
	// Default: true
	// +optional
	Active *bool `json:"active,omitempty"`

	// Determines whether the SSL certificate of the host for url will be verified when delivering payloads.
	// We strongly recommend not setting this to true as you are subject to man-in-the-middle and other attacks.
	// Default: false
	// +optional
	InsecureSSL *bool `json:"insecureSsl,omitempty"`

	// Reference to a secret key containing the webhook secret.
	// You can use the webhook secret to limit incoming requests to only those originating from GitHub.
	// For more information, see https://docs.github.com/en/webhooks/using-webhooks/validating-webhook-deliveries
	// Requires spec.writeConnectionSecretToRef, where the applied secret is recorded.
	// +optional
	SecretKeyRef *xpv2.SecretKeySelector `json:"secretKeyRef,omitempty"`
}

type OrganizationWebhookSpec struct {
	xpv2.ClusterManagedResourceSpec `json:",inline"`
	ForProvider                     OrganizationWebhookParameters `json:"forProvider"`

	// DriftDetection configures which forProvider fields are owned outside
	// Crossplane and how drift in those fields is detected and corrected.
	// Absent configuration means drift detection is enabled with no ignored
	// paths.
	// +optional
	DriftDetection *driftdetection.DriftDetection `json:"driftDetection,omitempty"`
}

type OrganizationWebhookStatus struct {
	xpv2.ManagedResourceStatus `json:",inline"`
	AtProvider                 OrganizationWebhookObservation `json:"atProvider,omitempty"`
}

type RepoFork struct {
	// The account owner of the repository. The name is not case-sensitive.
	Owner string `json:"owner"`

	// The name of the repository without the .git extension. The name is not case-sensitive.
	Repo string `json:"repo"`

	// When forking from an existing repository, fork with only the default branch.
	DefaultBranchOnly bool `json:"defaultBranchOnly"`
}

type RepoForkObservation struct {
	// Owner is the account owner of the parent repository.
	Owner string `json:"owner,omitempty"`

	// Repo is the name of the parent repository.
	Repo string `json:"repo,omitempty"`
}

type Repository struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   RepositorySpec   `json:"spec"`
	Status RepositoryStatus `json:"status,omitempty"`
}

type RepositoryList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Repository `json:"items"`
}

type RepositoryObservation struct {
	// ID is the external name of the repository on GitHub.
	ID string `json:"id,omitempty"`

	// Description is the description GitHub reports for the repository.
	Description string `json:"description,omitempty"`

	// Permissions is the observed access to the repository. Collaborators
	// and teams are listed only while the repository is read for them.
	Permissions RepositoryPermissionsObservation `json:"permissions,omitempty"`

	// Webhooks lists the webhooks of the repository. GitHub is queried for
	// them only while forProvider.webhooks is set, so the field is empty otherwise.
	// +optional
	Webhooks []RepositoryWebhookObservation `json:"webhooks"`

	// BranchProtectionRules lists the protection of every protected branch.
	// GitHub is queried for it only while forProvider.branchProtectionRules
	// is set, so the field is empty otherwise.
	// +optional
	BranchProtectionRules []BranchProtectionRuleObservation `json:"branchProtectionRules"`

	// RepositoryRules lists the rulesets of the repository. GitHub is queried
	// for them only while forProvider.repositoryRules is set, so the field is
	// empty otherwise.
	// +optional
	RepositoryRules []RepositoryRulesetObservation `json:"repositoryRules,omitzero"`

	// CreateFromTemplate is the template the repository was created from, when
	// GitHub reports one. Whether all branches were included is not reported.
	CreateFromTemplate *TemplateRepoObservation `json:"createFromTemplate,omitempty"`

	// CreateFork is the repository this repository is a fork of, when GitHub
	// reports one. Whether only the default branch was forked is not reported.
	CreateFork *RepoForkObservation `json:"createFork,omitempty"`

	// Org is the organization that owns the repository.
	Org string `json:"org,omitempty"`

	// Archived is whether the repository is archived.
	Archived *bool `json:"archived,omitempty"`

	// ForceDelete is the provider-side deletion safeguard. GitHub has no such
	// setting and never returns it, so the field is not populated.
	ForceDelete *bool `json:"forceDelete,omitempty"`

	// Private is whether the repository is private.
	Private *bool `json:"private,omitempty"`

	// IsTemplate is whether the repository is a template repository.
	IsTemplate *bool `json:"isTemplate,omitempty"`

	// Topics is the list of topics of the repository.
	// +optional
	Topics []string `json:"topics"`

	// DefaultBranch is the name of the default branch.
	DefaultBranch *string `json:"defaultBranch,omitempty"`

	// AllowMergeCommit is whether merge commits are allowed.
	AllowMergeCommit *bool `json:"allowMergeCommit,omitempty"`

	// AllowSquashMerge is whether squash merging is allowed.
	AllowSquashMerge *bool `json:"allowSquashMerge,omitempty"`

	// AllowRebaseMerge is whether rebase merging is allowed.
	AllowRebaseMerge *bool `json:"allowRebaseMerge,omitempty"`

	// AllowAutoMerge is whether auto-merge is allowed.
	AllowAutoMerge *bool `json:"allowAutoMerge,omitempty"`

	// AllowUpdateBranch is whether users can update pull request branches from the base branch.
	AllowUpdateBranch *bool `json:"allowUpdateBranch,omitempty"`

	// DeleteBranchOnMerge is whether head branches are deleted when pull requests merge.
	DeleteBranchOnMerge *bool `json:"deleteBranchOnMerge,omitempty"`

	// HasIssues is whether the Issues feature is enabled.
	HasIssues *bool `json:"hasIssues,omitempty"`

	// HasProjects is whether the Projects feature is enabled.
	HasProjects *bool `json:"hasProjects,omitempty"`

	// HasWiki is whether the Wiki feature is enabled.
	HasWiki *bool `json:"hasWiki,omitempty"`

	// HasDiscussions is whether the Discussions feature is enabled.
	HasDiscussions *bool `json:"hasDiscussions,omitempty"`

	// MergeCommitTitle is the default title format for merge commits.
	MergeCommitTitle *string `json:"mergeCommitTitle,omitempty"`

	// MergeCommitMessage is the default body format for merge commits.
	MergeCommitMessage *string `json:"mergeCommitMessage,omitempty"`

	// SquashMergeCommitTitle is the default title format for squash-merge commits.
	SquashMergeCommitTitle *string `json:"squashMergeCommitTitle,omitempty"`

	// SquashMergeCommitMessage is the default body format for squash-merge commits.
	SquashMergeCommitMessage *string `json:"squashMergeCommitMessage,omitempty"`

	// Branch protection items GitHub did not apply on the last push, per declared rule.
	// +optional
	UnappliedBranchProtection []UnappliedBranchProtection `json:"unappliedBranchProtection"`

	// Repository settings GitHub did not apply on the last push, with the value that was declared.
	// +optional
	UnappliedSettings []UnappliedSetting `json:"unappliedSettings"`
}

type RepositoryParameters struct {
	Description string                `json:"description,omitempty"`
	Permissions RepositoryPermissions `json:"permissions,omitempty"`

	// +optional
	Webhooks []RepositoryWebhook `json:"webhooks"`

	// +optional
	BranchProtectionRules []BranchProtectionRule `json:"branchProtectionRules"`

	// RepositoryRules are the rulesets of the repository. When set, the list is
	// authoritative: the repository ends up with exactly the rulesets it names, and
	// an empty list ([]) deletes them all. When the field is absent, the rulesets
	// on GitHub stay as they are. GitHub allows at most 75 rulesets per repository.
	// +kubebuilder:validation:MaxItems=75
	// +kubebuilder:validation:XValidation:rule="self.all(x, self.exists_one(y, y.name == x.name))",message="each ruleset name may appear once in repositoryRules"
	// +optional
	RepositoryRules *[]RepositoryRuleset `json:"repositoryRules,omitzero"`

	// Creates a new repository using a repository template
	CreateFromTemplate *TemplateRepo `json:"createFromTemplate,omitempty"`

	// Creates a repository fork, it takes precedence over "CreateFromTemplate" setting.
	CreateFork *RepoFork `json:"createFork,omitempty"`

	// Org is the Organization for the Membership
	// +immutable
	// +crossplane:generate:reference:type=github.com/provider-github/provider-github/apis/cluster/organizations/v1alpha1.Organization
	Org string `json:"org,omitempty"`

	// OrgRef is a reference to an Organization
	// +optional
	OrgRef *xpv2.Reference `json:"orgRef,omitempty"`

	// OrgSlector selects a reference to an Organization
	// +optional
	OrgSelector *xpv2.Selector `json:"orgSelector,omitempty"`

	// Archived sets if a repository should be archived on delete
	// +optional
	Archived *bool `json:"archived,omitempty"`

	// Safeguard for accidental deletion
	ForceDelete *bool `json:"forceDelete,omitempty"`

	// Private sets the repository to private, if false it will be public
	Private *bool `json:"private,omitempty"`

	// Set to true to make this repo available as a template repository.
	// Default: false
	// +optional
	IsTemplate *bool `json:"isTemplate,omitempty"`

	// Topics is the list of topics for the repository.
	// Topics help categorize and discover repositories.
	// +optional
	// +kubebuilder:validation:MaxItems=20
	Topics []string `json:"topics"`

	// DefaultBranch is the name of the default branch.
	// +optional
	DefaultBranch *string `json:"defaultBranch,omitempty"`

	// AllowMergeCommit allows merge commits on the repository.
	// +optional
	AllowMergeCommit *bool `json:"allowMergeCommit,omitempty"`

	// AllowSquashMerge allows squash merging on the repository.
	// +optional
	AllowSquashMerge *bool `json:"allowSquashMerge,omitempty"`

	// AllowRebaseMerge allows rebase merging on the repository.
	// +optional
	AllowRebaseMerge *bool `json:"allowRebaseMerge,omitempty"`

	// AllowAutoMerge allows auto-merge on the repository.
	// Requires GitHub Pro/Team/Enterprise or a public repository; on a free-tier
	// org's private repo, GitHub silently rejects setting this to true, which
	// causes a reconcile loop.
	// +optional
	AllowAutoMerge *bool `json:"allowAutoMerge,omitempty"`

	// AllowUpdateBranch allows users to update pull request branches from the base branch.
	// +optional
	AllowUpdateBranch *bool `json:"allowUpdateBranch,omitempty"`

	// DeleteBranchOnMerge deletes head branches automatically when pull requests merge.
	// +optional
	DeleteBranchOnMerge *bool `json:"deleteBranchOnMerge,omitempty"`

	// HasIssues enables the Issues feature on the repository.
	// +optional
	HasIssues *bool `json:"hasIssues,omitempty"`

	// HasProjects enables the Projects feature on the repository.
	// +optional
	HasProjects *bool `json:"hasProjects,omitempty"`

	// HasWiki enables the Wiki feature on the repository.
	// +optional
	HasWiki *bool `json:"hasWiki,omitempty"`

	// HasDiscussions enables the Discussions feature on the repository.
	// +optional
	HasDiscussions *bool `json:"hasDiscussions,omitempty"`

	// MergeCommitTitle sets the default title format for merge commits.
	// Requires AllowMergeCommit to be true; GitHub rejects the request otherwise.
	// +optional
	// +kubebuilder:validation:Enum=PR_TITLE;MERGE_MESSAGE
	MergeCommitTitle *string `json:"mergeCommitTitle,omitempty"`

	// MergeCommitMessage sets the default body format for merge commits.
	// Requires AllowMergeCommit to be true; GitHub rejects the request otherwise.
	// +optional
	// +kubebuilder:validation:Enum=PR_BODY;PR_TITLE;BLANK
	MergeCommitMessage *string `json:"mergeCommitMessage,omitempty"`

	// SquashMergeCommitTitle sets the default title format for squash-merge commits.
	// Requires AllowSquashMerge to be true; GitHub rejects the request otherwise.
	// +optional
	// +kubebuilder:validation:Enum=PR_TITLE;COMMIT_OR_PR_TITLE
	SquashMergeCommitTitle *string `json:"squashMergeCommitTitle,omitempty"`

	// SquashMergeCommitMessage sets the default body format for squash-merge commits.
	// Requires AllowSquashMerge to be true; GitHub rejects the request otherwise.
	// +optional
	// +kubebuilder:validation:Enum=PR_BODY;COMMIT_MESSAGES;BLANK
	SquashMergeCommitMessage *string `json:"squashMergeCommitMessage,omitempty"`
}

type RepositoryPermissions struct {
	// +optional
	Users []RepositoryUser `json:"users"`
	// +optional
	Teams []RepositoryTeam `json:"teams"`
}

type RepositoryPermissionsObservation struct {
	// Users lists the direct collaborators of the repository.
	// +optional
	Users []RepositoryUserObservation `json:"users"`

	// Teams lists the teams with access to the repository.
	// +optional
	Teams []RepositoryTeamObservation `json:"teams"`
}

type RepositoryRuleset struct {
	// Name is the name of the ruleset
	// +kubebuilder:validation:MaxLength=255
	Name string `json:"name"`
	// Enforcement is the enforcement level of the ruleset, one of "disabled", "active" or
	// "evaluate" (GitHub Enterprise only). Defaults to "active".
	// +kubebuilder:validation:Enum=disabled;active;evaluate
	// +optional
	Enforcement *string `json:"enforcement,omitempty"`
	// Target is what the ruleset applies to, one of "branch", "tag" or "push". Defaults to "branch".
	// +kubebuilder:validation:Enum=branch;tag;push
	// +optional
	Target *string `json:"target,omitempty"`
	// BypassActors is the list of actors that can bypass the ruleset. An empty list
	// makes the ruleset apply to everyone. Each actor is listed once: an unset BypassMode
	// counts as "always", and OrganizationAdmin and DeployKey match on ActorType and BypassMode.
	// +optional
	BypassActors []*RulesetByPassActors `json:"bypassActors"`
	// Conditions is the conditions for the ruleset, which branches or tags are included or excluded from the ruleset.
	// Branch and tag rulesets only. A push ruleset applies to every push.
	// +optional
	Conditions *RulesetConditions `json:"conditions,omitempty"`
	// Rules is the rules for the ruleset
	// +optional
	Rules *Rules `json:"rules,omitempty"`
}

type RepositoryRulesetObservation struct {
	// Name is the name of the ruleset.
	Name string `json:"name,omitempty"`

	// Enforcement is the enforcement level of the ruleset.
	Enforcement *string `json:"enforcement,omitempty"`

	// Target is the target of the ruleset.
	Target *string `json:"target,omitempty"`

	// BypassActors lists the actors that can bypass the ruleset.
	// +optional
	BypassActors []RulesetByPassActorsObservation `json:"bypassActors"`

	// Conditions selects the branches or tags the ruleset applies to.
	Conditions *RulesetConditionsObservation `json:"conditions,omitempty"`

	// Rules is the observed rules of the ruleset.
	Rules *RulesObservation `json:"rules,omitempty"`
}

type RepositorySpec struct {
	xpv2.ClusterManagedResourceSpec `json:",inline"`
	ForProvider                     RepositoryParameters `json:"forProvider"`

	// DriftDetection configures which forProvider fields are owned outside
	// Crossplane and how drift in those fields is detected and corrected.
	// Absent configuration means drift detection is enabled with no ignored
	// paths.
	// +optional
	DriftDetection *driftdetection.DriftDetection `json:"driftDetection,omitempty"`
}

type RepositoryStatus struct {
	xpv2.ManagedResourceStatus `json:",inline"`
	AtProvider                 RepositoryObservation `json:"atProvider,omitempty"`
}

type RepositoryTeam struct {
	// Team is the name of the team
	// +crossplane:generate:reference:type=github.com/provider-github/provider-github/apis/cluster/organizations/v1alpha1.Team
	Team string `json:"team,omitempty"`

	// TeamRef is a reference to a Team
	// +optional
	TeamRef *xpv2.Reference `json:"teamRef,omitempty"`

	// TeamSelector selects a reference to a Team
	// +optional
	TeamSelector *xpv2.Selector `json:"teamSelector,omitempty"`

	// Role is the role of the team
	Role string `json:"role"`
}

type RepositoryTeamObservation struct {
	// Team is the slug of the team.
	Team string `json:"team,omitempty"`

	// Role is the role of the team.
	Role string `json:"role,omitempty"`
}

type RepositoryUser struct {
	// Name is the name of the user
	// +crossplane:generate:reference:type=github.com/provider-github/provider-github/apis/cluster/organizations/v1alpha1.Membership
	User string `json:"user,omitempty"`

	// Name is a reference to an Membership
	// +optional
	UserRef *xpv2.Reference `json:"userRef,omitempty"`

	// NameSelector selects a reference to an Organization
	// +optional
	UserSelector *xpv2.Selector `json:"userSelector,omitempty"`

	// Role is the role of the user
	Role string `json:"role"`
}

type RepositoryUserObservation struct {
	// User is the login of the collaborator.
	User string `json:"user,omitempty"`

	// Role is the role of the collaborator.
	Role string `json:"role,omitempty"`
}

type RepositoryWebhook struct {
	// The URL to which the payloads will be delivered.
	URL string `json:"url"`

	// Determines whether the SSL certificate of the host for url will be verified when delivering payloads.
	// We strongly recommend not setting this to true as you are subject to man-in-the-middle and other attacks.
	// Default: false
	// +optional
	InsecureSSL *bool `json:"insecureSsl,omitempty"`

	// The media type used to serialize the payloads. Supported values include json and form.
	// +kubebuilder:validation:Enum=json;form
	ContentType string `json:"contentType"`

	// Webhook secret, see https://docs.github.com/en/webhooks/using-webhooks/validating-webhook-deliveries
	// Internal field not exposed to Kubernetes API
	Secret *string `json:"-"`

	// Reference to a secret key containing the webhook secret.
	// You can use the webhook secret to limit incoming requests to only those originating from GitHub.
	// For more information, see https://docs.github.com/en/webhooks/using-webhooks/validating-webhook-deliveries
	// +optional
	SecretKeyRef *xpv2.SecretKeySelector `json:"secretKeyRef,omitempty"`

	// Determines what events the hook is triggered for. See https://docs.github.com/en/webhooks/webhook-events-and-payloads
	Events []string `json:"events"`

	// Determines if notifications are sent when the webhook is triggered.
	// Default: true
	// +optional
	Active *bool `json:"active,omitempty"`
}

type RepositoryWebhookObservation struct {
	// URL to which the payloads are delivered.
	URL string `json:"url,omitempty"`

	// InsecureSSL is whether the SSL certificate of the host for url is not verified.
	InsecureSSL *bool `json:"insecureSsl,omitempty"`

	// ContentType is the media type used to serialize the payloads.
	ContentType string `json:"contentType,omitempty"`

	// Events lists what the hook is triggered for.
	// +optional
	Events []string `json:"events"`

	// Active is whether notifications are sent when the webhook is triggered.
	Active *bool `json:"active,omitempty"`
}

type RequiredPullRequestReviews struct {
	// Set to true if you want to automatically dismiss approving reviews when someone pushes a new commit.
	DismissStaleReviews bool `json:"dismissStaleReviews"`

	// Blocks merging pull requests until code owners review them.
	RequireCodeOwnerReviews bool `json:"requireCodeOwnerReviews"`

	// Specify the number of reviewers required to approve pull requests. Use a number between 1 and 6 or 0 to not require reviewers.
	RequiredApprovingReviewCount int `json:"requiredApprovingReviewCount"`

	// Whether the most recent push must be approved by someone other than the person who pushed it.
	// Default: false
	// +optional
	RequireLastPushApproval *bool `json:"requireLastPushApproval,omitempty"`

	// Allow specific users, teams, or apps to bypass pull request requirements.
	// +optional
	BypassPullRequestAllowances *BypassPullRequestAllowancesRequest `json:"bypassPullRequestAllowances,omitempty"`

	// Specify which users, teams, and apps can dismiss pull request reviews.
	// +optional
	DismissalRestrictions *DismissalRestrictionsRequest `json:"dismissalRestrictions,omitempty"`
}

type RequiredPullRequestReviewsObservation struct {
	// DismissStaleReviews is whether approving reviews are dismissed on a new commit.
	DismissStaleReviews *bool `json:"dismissStaleReviews,omitempty"`

	// RequireCodeOwnerReviews is whether code owners must review.
	RequireCodeOwnerReviews *bool `json:"requireCodeOwnerReviews,omitempty"`

	// RequiredApprovingReviewCount is the number of approving reviews required.
	RequiredApprovingReviewCount *int `json:"requiredApprovingReviewCount,omitempty"`

	// RequireLastPushApproval is whether the most recent push must be approved by someone else.
	RequireLastPushApproval *bool `json:"requireLastPushApproval,omitempty"`

	// BypassPullRequestAllowances is who can bypass the pull request requirements.
	BypassPullRequestAllowances *BypassPullRequestAllowancesObservation `json:"bypassPullRequestAllowances,omitempty"`

	// DismissalRestrictions is who can dismiss pull request reviews.
	DismissalRestrictions *DismissalRestrictionsObservation `json:"dismissalRestrictions,omitempty"`
}

type RequiredStatusCheck struct {
	// The name of the required check.
	Context string `json:"context"`

	// The ID of the GitHub App that must provide this check.
	// Omit this field to explicitly allow any app to set the status.
	// +kubebuilder:validation:Minimum=2
	// +optional
	AppID *int64 `json:"appId,omitempty"`
}

type RequiredStatusCheckObservation struct {
	// Context is the name of the required check.
	Context string `json:"context,omitempty"`

	// AppID is the ID of the GitHub App that must provide the check.
	AppID *int64 `json:"appId,omitempty"`
}

type RequiredStatusChecks struct {
	// Require branches to be up-to-date before merging.
	Strict bool `json:"strict"`

	// The list of status checks to require in order to merge into this branch.
	Checks []*RequiredStatusCheck `json:"checks"`
}

type RequiredStatusChecksObservation struct {
	// Strict is whether branches must be up-to-date before merging.
	Strict *bool `json:"strict,omitempty"`

	// Checks lists the status checks required to merge.
	// +optional
	Checks []RequiredStatusCheckObservation `json:"checks"`
}

type Rules struct {
	// Creation restricts the creation of matching branches or tags that are set in Conditions
	// +optional
	Creation *bool `json:"creation,omitempty"`
	// Deletion restricts the deletion of matching branches or tags that are set in Conditions
	// +optional
	Deletion *bool `json:"deletion,omitempty"`
	// Update restricts the update of matching branches or tags that are set in Conditions
	// +optional
	Update *bool `json:"update,omitempty"`
	// UpdateAllowsFetchAndMerge lets the branch pull changes from its upstream repository
	// while Update is on. Defaults to false. It takes effect on forks only.
	// +optional
	UpdateAllowsFetchAndMerge *bool `json:"updateAllowsFetchAndMerge,omitempty"`
	// RequiredLinearHistory requires a linear commit history, which prevents merge commits.
	// +optional
	RequiredLinearHistory *bool `json:"requiredLinearHistory,omitempty"`
	// RequiredDeployments requires that deployment to specific environments are successful before merging.
	// +optional
	RequiredDeployments *RulesRequiredDeployments `json:"requiredDeployments,omitempty"`
	// RequiredSignatures requires signed commits.
	// +optional
	RequiredSignatures *bool `json:"requiredSignatures,omitempty"`
	// PullRequest is the rules for pull requests
	// +optional
	PullRequest *RulesPullRequest `json:"pullRequest,omitempty"`
	// RequiredStatusChecks requires status checks to pass before merging.
	// +optional
	RequiredStatusChecks *RulesRequiredStatusChecks `json:"requiredStatusChecks,omitempty"`
	// NonFastForward restricts force pushes to matching branches or tags that are set in Conditions
	// +optional
	NonFastForward *bool `json:"nonFastForward,omitempty"`
	// MergeQueue requires merges to go through a merge queue.
	// +optional
	MergeQueue *RulesMergeQueue `json:"mergeQueue,omitempty"`
	// CommitMessagePattern requires commit messages to match a pattern.
	// +optional
	CommitMessagePattern *RulesPattern `json:"commitMessagePattern,omitempty"`
	// CommitAuthorEmailPattern requires commit author emails to match a pattern.
	// +optional
	CommitAuthorEmailPattern *RulesPattern `json:"commitAuthorEmailPattern,omitempty"`
	// CommitterEmailPattern requires committer emails to match a pattern.
	// +optional
	CommitterEmailPattern *RulesPattern `json:"committerEmailPattern,omitempty"`
	// BranchNamePattern requires branch names to match a pattern.
	// +optional
	BranchNamePattern *RulesPattern `json:"branchNamePattern,omitempty"`
	// TagNamePattern requires tag names to match a pattern.
	// +optional
	TagNamePattern *RulesPattern `json:"tagNamePattern,omitempty"`
	// CodeScanning requires code scanning results before merging.
	// +optional
	CodeScanning *RulesCodeScanning `json:"codeScanning,omitempty"`
	// CodeQuality requires code quality results before merging.
	// +optional
	CodeQuality *RulesCodeQuality `json:"codeQuality,omitempty"`
	// CodeCoverage requires code coverage results before merging.
	// +optional
	CodeCoverage *RulesCodeCoverage `json:"codeCoverage,omitempty"`
	// LicenseComplianceScanning requires license compliance scanning results before merging.
	// It needs license compliance scanning enabled on GitHub, or GitHub answers 422.
	// +optional
	LicenseComplianceScanning *bool `json:"licenseComplianceScanning,omitempty"`
	// RequireSecretScanningAlertResolution blocks merging pull requests with unresolved secret
	// scanning alerts. {} turns it on for GitHub's default secret types. It needs GitHub Secret
	// Protection or Advanced Security enabled, or GitHub answers 422.
	// +optional
	RequireSecretScanningAlertResolution *RulesSecretScanningAlertResolution `json:"requireSecretScanningAlertResolution,omitempty"`
	// CopilotCodeReview requests a Copilot code review for new pull requests.
	// +optional
	CopilotCodeReview *RulesCopilotCodeReview `json:"copilotCodeReview,omitempty"`
	// FileExtensionRestriction prevents pushing files with the listed extensions. Push rulesets only.
	// +optional
	FileExtensionRestriction *RulesFileExtensionRestriction `json:"fileExtensionRestriction,omitempty"`
	// FilePathRestriction prevents pushing changes to the listed file paths. Push rulesets only.
	// +optional
	FilePathRestriction *RulesFilePathRestriction `json:"filePathRestriction,omitempty"`
	// MaxFilePathLength prevents pushing files with longer paths. Push rulesets only.
	// +optional
	MaxFilePathLength *RulesMaxFilePathLength `json:"maxFilePathLength,omitempty"`
	// MaxFileSize prevents pushing files larger than the limit. Push rulesets only.
	// +optional
	MaxFileSize *RulesMaxFileSize `json:"maxFileSize,omitempty"`
}

type RulesCodeCoverage struct {
	// MinimumCoverage is the lowest coverage percentage allowed, a decimal number from 0 to 100 such as "80" or "72.5".
	// Unset leaves the minimum open.
	// +kubebuilder:validation:Pattern=`^(100(\.0+)?|[0-9]{1,2}(\.[0-9]+)?)$`
	// +optional
	MinimumCoverage *string `json:"minimumCoverage,omitempty"`
	// MaxCoverageDrop is the largest drop in coverage percentage allowed, a decimal number from 0 to 100 such as "5" or "0.5".
	// Unset leaves the drop open.
	// +kubebuilder:validation:Pattern=`^(100(\.0+)?|[0-9]{1,2}(\.[0-9]+)?)$`
	// +optional
	MaxCoverageDrop *string `json:"maxCoverageDrop,omitempty"`
}

type RulesCodeCoverageObservation struct {
	// MinimumCoverage is the lowest coverage percentage allowed.
	MinimumCoverage *string `json:"minimumCoverage,omitempty"`

	// MaxCoverageDrop is the largest drop in coverage percentage allowed.
	MaxCoverageDrop *string `json:"maxCoverageDrop,omitempty"`
}

type RulesCodeQuality struct {
	// Severity is the lowest severity of code quality results that blocks a pull request.
	// +kubebuilder:validation:Enum=errors;warnings;notes;all
	Severity string `json:"severity"`
}

type RulesCodeQualityObservation struct {
	// Severity is the lowest severity of code quality results that blocks a pull request.
	Severity string `json:"severity,omitempty"`
}

type RulesCodeScanning struct {
	// CodeScanningTools is the list of tools that must provide code scanning results.
	CodeScanningTools []*RulesCodeScanningTool `json:"codeScanningTools"`
}

type RulesCodeScanningObservation struct {
	// CodeScanningTools lists the tools that must provide code scanning results.
	// +optional
	CodeScanningTools []RulesCodeScanningToolObservation `json:"codeScanningTools"`
}

type RulesCodeScanningTool struct {
	// Tool is the name of a code scanning tool.
	Tool string `json:"tool"`
	// AlertsThreshold is the severity level at which code scanning results that raise alerts block a reference update.
	// +kubebuilder:validation:Enum=none;errors;errors_and_warnings;all
	AlertsThreshold string `json:"alertsThreshold"`
	// SecurityAlertsThreshold is the severity level at which code scanning results that raise security alerts block a reference update.
	// +kubebuilder:validation:Enum=none;critical;high_or_higher;medium_or_higher;all
	SecurityAlertsThreshold string `json:"securityAlertsThreshold"`
}

type RulesCodeScanningToolObservation struct {
	// Tool is the name of the code scanning tool.
	Tool string `json:"tool,omitempty"`

	// AlertsThreshold is the severity at which alerts block a reference update.
	AlertsThreshold string `json:"alertsThreshold,omitempty"`

	// SecurityAlertsThreshold is the severity at which security alerts block a reference update.
	SecurityAlertsThreshold string `json:"securityAlertsThreshold,omitempty"`
}

type RulesCopilotCodeReview struct {
	// ReviewOnPush requests a new review on each push to the pull request.
	// +optional
	ReviewOnPush *bool `json:"reviewOnPush,omitempty"`
	// ReviewDraftPullRequests requests reviews on draft pull requests too.
	// +optional
	ReviewDraftPullRequests *bool `json:"reviewDraftPullRequests,omitempty"`
}

type RulesCopilotCodeReviewObservation struct {
	// ReviewOnPush is whether a new review is requested on each push.
	ReviewOnPush *bool `json:"reviewOnPush,omitempty"`

	// ReviewDraftPullRequests is whether draft pull requests are reviewed too.
	ReviewDraftPullRequests *bool `json:"reviewDraftPullRequests,omitempty"`
}

type RulesDismissalActor struct {
	// Id is the ID of the actor: the user ID, the team ID, the App's installation ID
	// for IntegrationInstallation, or the repository role ID.
	ID int64 `json:"id"`
	// Type is the type of the actor.
	// +kubebuilder:validation:Enum=User;Team;IntegrationInstallation;RepositoryRole
	Type string `json:"type"`
}

type RulesDismissalActorObservation struct {
	// ID is the ID of the actor.
	ID int64 `json:"id,omitempty"`

	// Type is the type of the actor.
	Type string `json:"type,omitempty"`
}

type RulesDismissalRestriction struct {
	// Enabled limits review dismissal to AllowedActors.
	Enabled bool `json:"enabled"`
	// AllowedActors are the actors who may dismiss reviews. Each must have write access
	// to the repository; of the repository roles, only admin is accepted.
	// +optional
	AllowedActors []*RulesDismissalActor `json:"allowedActors"`
}

type RulesDismissalRestrictionObservation struct {
	// Enabled is whether review dismissal is limited to AllowedActors.
	// +optional
	Enabled bool `json:"enabled"`

	// AllowedActors lists the actors who may dismiss reviews.
	// +optional
	AllowedActors []RulesDismissalActorObservation `json:"allowedActors"`
}

type RulesFileExtensionRestriction struct {
	// RestrictedFileExtensions is the list of file extensions GitHub rejects in a push, each starting with "*.", such as "*.exe".
	RestrictedFileExtensions []string `json:"restrictedFileExtensions"`
}

type RulesFileExtensionRestrictionObservation struct {
	// RestrictedFileExtensions lists the file extensions GitHub rejects in a push.
	// +optional
	RestrictedFileExtensions []string `json:"restrictedFileExtensions"`
}

type RulesFilePathRestriction struct {
	// RestrictedFilePaths is the list of file paths GitHub rejects changes to.
	RestrictedFilePaths []string `json:"restrictedFilePaths"`
	// IgnoredFilePaths are paths exempt from the rule. Unset means an empty list.
	// +optional
	IgnoredFilePaths []string `json:"ignoredFilePaths"`
}

type RulesFilePathRestrictionObservation struct {
	// RestrictedFilePaths lists the file paths GitHub rejects changes to.
	// +optional
	RestrictedFilePaths []string `json:"restrictedFilePaths"`

	// IgnoredFilePaths lists the paths exempt from the rule.
	// +optional
	IgnoredFilePaths []string `json:"ignoredFilePaths"`
}

type RulesMaxFilePathLength struct {
	// MaxFilePathLength is the maximum number of characters allowed in file paths.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=32767
	MaxFilePathLength int `json:"maxFilePathLength"`
}

type RulesMaxFilePathLengthObservation struct {
	// MaxFilePathLength is the maximum number of characters allowed in file paths.
	MaxFilePathLength int `json:"maxFilePathLength,omitempty"`
}

type RulesMaxFileSize struct {
	// MaxFileSize is the maximum file size allowed, in megabytes.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=100
	MaxFileSize int64 `json:"maxFileSize"`
	// IgnoredFilePaths are paths exempt from the rule. Unset means an empty list.
	// +optional
	IgnoredFilePaths []string `json:"ignoredFilePaths"`
}

type RulesMaxFileSizeObservation struct {
	// MaxFileSize is the maximum file size allowed, in megabytes.
	MaxFileSize int64 `json:"maxFileSize,omitempty"`

	// IgnoredFilePaths lists the paths exempt from the rule.
	// +optional
	IgnoredFilePaths []string `json:"ignoredFilePaths"`
}

type RulesMergeMethod string

type RulesMergeQueue struct {
	// CheckResponseTimeoutMinutes is the maximum time, in minutes, for a required status check to report a conclusion.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=360
	CheckResponseTimeoutMinutes int `json:"checkResponseTimeoutMinutes"`
	// GroupingStrategy decides which pull requests' checks must pass: all of them (ALLGREEN) or the head of the group (HEADGREEN).
	// +kubebuilder:validation:Enum=ALLGREEN;HEADGREEN
	GroupingStrategy string `json:"groupingStrategy"`
	// MaxEntriesToBuild is the maximum number of queued pull requests requesting checks and workflow runs at the same time.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=100
	MaxEntriesToBuild int `json:"maxEntriesToBuild"`
	// MaxEntriesToMerge is the maximum number of pull requests merged together in a group.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=100
	MaxEntriesToMerge int `json:"maxEntriesToMerge"`
	// MergeMethod is the method used to merge changes in queued pull requests.
	// +kubebuilder:validation:Enum=MERGE;SQUASH;REBASE
	MergeMethod string `json:"mergeMethod"`
	// MinEntriesToMerge is the minimum number of pull requests merged together in a group.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=100
	MinEntriesToMerge int `json:"minEntriesToMerge"`
	// MinEntriesToMergeWaitMinutes is the time, in minutes, the merge queue waits for MinEntriesToMerge pull requests.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=360
	MinEntriesToMergeWaitMinutes int `json:"minEntriesToMergeWaitMinutes"`
}

type RulesMergeQueueObservation struct {
	// CheckResponseTimeoutMinutes is the maximum time, in minutes, for a required status check to report a conclusion.
	// +optional
	CheckResponseTimeoutMinutes int `json:"checkResponseTimeoutMinutes"`

	// GroupingStrategy is whether all pull requests' checks (ALLGREEN) or the head of the group's (HEADGREEN) must pass.
	GroupingStrategy string `json:"groupingStrategy,omitempty"`

	// MaxEntriesToBuild is the maximum number of queued pull requests requesting checks at the same time.
	// +optional
	MaxEntriesToBuild int `json:"maxEntriesToBuild"`

	// MaxEntriesToMerge is the maximum number of pull requests merged together in a group.
	// +optional
	MaxEntriesToMerge int `json:"maxEntriesToMerge"`

	// MergeMethod is the method used to merge queued pull requests.
	MergeMethod string `json:"mergeMethod,omitempty"`

	// MinEntriesToMerge is the minimum number of pull requests merged together in a group.
	// +optional
	MinEntriesToMerge int `json:"minEntriesToMerge"`

	// MinEntriesToMergeWaitMinutes is the time, in minutes, the queue waits for MinEntriesToMerge pull requests.
	// +optional
	MinEntriesToMergeWaitMinutes int `json:"minEntriesToMergeWaitMinutes"`
}

type RulesObservation struct {
	// Creation is whether creating matching refs is restricted.
	Creation *bool `json:"creation,omitempty"`

	// Deletion is whether deleting matching refs is restricted.
	Deletion *bool `json:"deletion,omitempty"`

	// Update is whether updating matching refs is restricted.
	Update *bool `json:"update,omitempty"`

	// RequiredLinearHistory is whether a linear commit history is required.
	RequiredLinearHistory *bool `json:"requiredLinearHistory,omitempty"`

	// RequiredDeployments is the observed deployments requirement.
	RequiredDeployments *RulesRequiredDeploymentsObservation `json:"requiredDeployments,omitempty"`

	// RequiredSignatures is whether signed commits are required.
	RequiredSignatures *bool `json:"requiredSignatures,omitempty"`

	// PullRequest is the observed pull request rules.
	PullRequest *RulesPullRequestObservation `json:"pullRequest,omitempty"`

	// RequiredStatusChecks is the observed status checks requirement.
	RequiredStatusChecks *RulesStatusChecksObservation `json:"requiredStatusChecks,omitempty"`

	// NonFastForward is whether force pushes to matching refs are restricted.
	NonFastForward *bool `json:"nonFastForward,omitempty"`

	// UpdateAllowsFetchAndMerge is whether the branch may pull changes from its
	// upstream repository while updates are restricted. GitHub returns it on forks only.
	UpdateAllowsFetchAndMerge *bool `json:"updateAllowsFetchAndMerge,omitempty"`

	// MergeQueue is the observed merge queue requirement.
	MergeQueue *RulesMergeQueueObservation `json:"mergeQueue,omitempty"`

	// CommitMessagePattern is the observed commit message pattern.
	CommitMessagePattern *RulesPatternObservation `json:"commitMessagePattern,omitempty"`

	// CommitAuthorEmailPattern is the observed commit author email pattern.
	CommitAuthorEmailPattern *RulesPatternObservation `json:"commitAuthorEmailPattern,omitempty"`

	// CommitterEmailPattern is the observed committer email pattern.
	CommitterEmailPattern *RulesPatternObservation `json:"committerEmailPattern,omitempty"`

	// BranchNamePattern is the observed branch name pattern.
	BranchNamePattern *RulesPatternObservation `json:"branchNamePattern,omitempty"`

	// TagNamePattern is the observed tag name pattern.
	TagNamePattern *RulesPatternObservation `json:"tagNamePattern,omitempty"`

	// CodeScanning is the observed code scanning requirement.
	CodeScanning *RulesCodeScanningObservation `json:"codeScanning,omitempty"`

	// CodeQuality is the observed code quality requirement.
	CodeQuality *RulesCodeQualityObservation `json:"codeQuality,omitempty"`

	// CodeCoverage is the observed code coverage requirement.
	CodeCoverage *RulesCodeCoverageObservation `json:"codeCoverage,omitempty"`

	// LicenseComplianceScanning is whether license compliance scanning results are required.
	LicenseComplianceScanning *bool `json:"licenseComplianceScanning,omitempty"`

	// ScanningAlertResolution is the observed requirement that secret scanning alerts are
	// resolved before merging. It is requireSecretScanningAlertResolution in the spec.
	ScanningAlertResolution *RulesScanningAlertResolutionObservation `json:"requireSecretScanningAlertResolution,omitempty"`

	// CopilotCodeReview is the observed Copilot code review requirement.
	CopilotCodeReview *RulesCopilotCodeReviewObservation `json:"copilotCodeReview,omitempty"`

	// FileExtensionRestriction is the observed file extension restriction.
	FileExtensionRestriction *RulesFileExtensionRestrictionObservation `json:"fileExtensionRestriction,omitempty"`

	// FilePathRestriction is the observed file path restriction.
	FilePathRestriction *RulesFilePathRestrictionObservation `json:"filePathRestriction,omitempty"`

	// MaxFilePathLength is the observed file path length limit.
	MaxFilePathLength *RulesMaxFilePathLengthObservation `json:"maxFilePathLength,omitempty"`

	// MaxFileSize is the observed file size limit.
	MaxFileSize *RulesMaxFileSizeObservation `json:"maxFileSize,omitempty"`
}

type RulesPattern struct {
	// Name is how this rule appears to users.
	// +optional
	Name *string `json:"name,omitempty"`
	// Negate inverts the rule: matching the pattern fails it.
	// +optional
	Negate *bool `json:"negate,omitempty"`
	// Operator is how the pattern is matched.
	// +kubebuilder:validation:Enum=starts_with;ends_with;contains;regex
	Operator string `json:"operator"`
	// Pattern is the pattern to match with.
	Pattern string `json:"pattern"`
}

type RulesPatternObservation struct {
	// Name is how the rule appears to users.
	Name *string `json:"name,omitempty"`

	// Negate is whether matching the pattern fails the rule.
	Negate *bool `json:"negate,omitempty"`

	// Operator is how the pattern is matched.
	Operator string `json:"operator,omitempty"`

	// Pattern is the pattern to match with.
	Pattern string `json:"pattern,omitempty"`
}

type RulesPullRequest struct {
	// AllowedMergeMethods are the methods pull requests may be merged with, each listed once. Unset allows all three.
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=3
	// +kubebuilder:validation:XValidation:rule="self.all(x, self.exists_one(y, y == x))",message="each merge method may appear once in allowedMergeMethods"
	// +optional
	AllowedMergeMethods []RulesMergeMethod `json:"allowedMergeMethods"`
	// DismissalRestriction limits who can dismiss reviews. Unset lets everyone with write access dismiss them.
	// +optional
	DismissalRestriction *RulesDismissalRestriction `json:"dismissalRestriction,omitempty"`
	// DismissStaleReviewsOnPush automatically dismiss approving reviews when someone pushes a new commit.
	// +optional
	DismissStaleReviewsOnPush *bool `json:"dismissStaleReviewsOnPush,omitempty"`
	// RequireExtraApprovalForUnattributedChanges requires an additional approval for
	// pull requests containing unattributed changes, such as those Copilot makes. When
	// unset, the provider sends true, GitHub's default, once GitHub returns the field for
	// the rule, and sends the rule without it otherwise.
	// +optional
	RequireExtraApprovalForUnattributedChanges *bool `json:"requireExtraApprovalForUnattributedChanges,omitempty"`
	// RequiredReviewers requires approvals from specific teams for changes to matching files. Unset means an empty list.
	// +optional
	RequiredReviewers []*RulesRequiredReviewer `json:"requiredReviewers"`
	// RequireCodeOwnerReview requires the pull request to be approved by a code owner.
	// +optional
	RequireCodeOwnerReview *bool `json:"requireCodeOwnerReview,omitempty"`
	// RequireLastPushApproval requires the most recent push to be approved by someone other than the person who pushed it.
	// +optional
	RequireLastPushApproval *bool `json:"requireLastPushApproval,omitempty"`
	// RequiredApprovingReviewCount specifies the number of reviewers required to approve pull requests.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=10
	// +optional
	RequiredApprovingReviewCount *int `json:"requiredApprovingReviewCount,omitempty"`
	// RequiredReviewThreadResolution requires all conversations on code to be resolved before a pull request can be merged.
	// +optional
	RequiredReviewThreadResolution *bool `json:"requiredReviewThreadResolution,omitempty"`
}

type RulesPullRequestObservation struct {
	// DismissStaleReviewsOnPush is whether approving reviews are dismissed on a new commit.
	DismissStaleReviewsOnPush *bool `json:"dismissStaleReviewsOnPush,omitempty"`

	// RequireCodeOwnerReview is whether a code owner must approve.
	RequireCodeOwnerReview *bool `json:"requireCodeOwnerReview,omitempty"`

	// RequireLastPushApproval is whether the most recent push must be approved by someone else.
	RequireLastPushApproval *bool `json:"requireLastPushApproval,omitempty"`

	// RequiredApprovingReviewCount is the number of approving reviews required.
	RequiredApprovingReviewCount *int `json:"requiredApprovingReviewCount,omitempty"`

	// RequiredReviewThreadResolution is whether conversations must be resolved before merging.
	RequiredReviewThreadResolution *bool `json:"requiredReviewThreadResolution,omitempty"`

	// AllowedMergeMethods lists the methods pull requests may be merged with.
	// +optional
	AllowedMergeMethods []string `json:"allowedMergeMethods"`

	// DismissalRestriction is who may dismiss reviews.
	DismissalRestriction *RulesDismissalRestrictionObservation `json:"dismissalRestriction,omitempty"`

	// RequireExtraApprovalForUnattributedChanges is whether pull requests with
	// unattributed changes need an additional approval. GitHub returns it for some rules only.
	RequireExtraApprovalForUnattributedChanges *bool `json:"requireExtraApprovalForUnattributedChanges,omitempty"`

	// RequiredReviewers lists the teams whose approval is required for matching files.
	// +optional
	RequiredReviewers []RulesRequiredReviewerObservation `json:"requiredReviewers"`
}

type RulesRequiredDeployments struct {
	// Environments is the list of environments that are required to be deployed to before merging
	// +optional
	Environments []string `json:"environments"`
}

type RulesRequiredDeploymentsObservation struct {
	// Environments lists the required environments.
	// +optional
	Environments []string `json:"environments"`
}

type RulesRequiredReviewer struct {
	// FilePatterns are the file patterns whose changes need the reviewer's approval.
	FilePatterns []string `json:"filePatterns"`
	// MinimumApprovals is how many approvals the reviewer must give.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=10
	MinimumApprovals int `json:"minimumApprovals"`
	// Reviewer is the team that must approve.
	Reviewer RulesReviewer `json:"reviewer"`
}

type RulesRequiredReviewerObservation struct {
	// FilePatterns lists the file patterns whose changes need the reviewer's approval.
	// +optional
	FilePatterns []string `json:"filePatterns"`

	// MinimumApprovals is how many approvals the reviewer must give.
	// +optional
	MinimumApprovals int `json:"minimumApprovals"`

	// Reviewer is the team that must approve.
	Reviewer RulesReviewerObservation `json:"reviewer,omitempty"`
}