github

type API interface {
	// ListRepos returns all repos in the configured organization.
	// Implementations must page transparently — callers receive the
	// full list in one slice.
	ListRepos(ctx context.Context) ([]Repo, error)
	// ListOrgMembers returns all members of the configured org along
	// with their 2FA state and role. 2FA state requires admin scope.
	ListOrgMembers(ctx context.Context) ([]Member, error)
	// ListOutsideCollaborators returns users with access to org repos
	// who are not org members (external identities). 2FA state requires
	// admin scope; these users carry no org role.
	ListOutsideCollaborators(ctx context.Context) ([]Member, error)
	// GetOrgPolicy returns the configured org's governance settings.
	// The org-settings fields (2FA requirement, default permission)
	// require an org-admin-scoped token.
	GetOrgPolicy(ctx context.Context) (OrgPolicy, error)
	// ListDependabotAlerts returns the org's open Dependabot alerts.
	// Requires a token with security-events read access; when Dependabot
	// alerts are disabled for the org (403) the implementation returns an
	// empty slice rather than an error, so the per-repo enablement gap is
	// reported by the dependabot_alerts_enabled policy instead of failing
	// the run.
	ListDependabotAlerts(ctx context.Context) ([]DependabotAlert, error)
	// ListMergedPullRequests returns the org's pull requests merged into
	// each repository's default branch with a merge timestamp inside
	// [start, end]. GitHub's pulls listing has no date filter, so
	// implementations paginate newest-updated-first and stop once a page
	// predates start. A repository the token cannot read is skipped, not
	// an error — one inaccessible repo must not fail the whole run.
	ListMergedPullRequests(ctx context.Context, start, end time.Time) ([]PullRequest, error)
	// ListDeployments returns the org's deployments created inside
	// [start, end], including failed ones. Same pagination and
	// per-repository error tolerance as ListMergedPullRequests.
	ListDeployments(ctx context.Context, start, end time.Time) ([]Deployment, error)
}

type CheckRun struct {
	Status     string
	Conclusion string
}

type DependabotAlert struct {
	Number       int
	RepoFullName string
	PackageName  string
	Summary      string
	Severity     string
	State        string
	CVEID        string
	CVSSScore    float64
	// PatchAvailable is true when GitHub reports a first patched version.
	PatchAvailable bool
}

type Deployment struct {
	Repository string
	// ID is the vendor-native deployment identifier as a string.
	ID          string
	SHA         string
	Environment string
	// ProductionEnvironment is GitHub's production_environment flag. The
	// field is frequently absent from the API response; the adapter
	// treats absent as false and the plugin falls back to the
	// environment name when deriving is_production.
	ProductionEnvironment bool
	Creator               string
	CreatedAt             time.Time
	State                 string
}

type Member struct {
	Login       string
	TwoFactorOn bool
	Role        string
}

type Options struct {
	API API
	Org string
	// Now is injected so tests can produce deterministic CollectedAt
	// values. Production callers leave it nil → time.Now().UTC().
	Now func() time.Time
}

type OrgPolicy struct {
	// TwoFactorRequired is the org-wide MFA enforcement flag. GitHub
	// reports this as a tri-state (true/false/null when the caller lacks
	// admin scope); the adapter normalizes null to false.
	TwoFactorRequired bool
	// DefaultRepoPermission is the baseline member permission: one of
	// none/read/write/admin (GitHub's default_repository_permission).
	DefaultRepoPermission string

	MembersCanCreatePublicRepos bool
	WebCommitSignoffRequired    bool
	AdvancedSecurityNewRepos    bool
	SecretScanningNewRepos      bool
	DependabotAlertsNewRepos    bool
}

type Plugin struct {
	// contains filtered or unexported fields
}

type PullRequest struct {
	// Repository is the `org/repo` form, matching git_repository.name.
	Repository     string
	Number         int
	Author         string
	MergedBy       string
	TargetBranch   string
	MergeCommitSHA string
	MergedAt       time.Time
	Reviews        []Review
	CheckRuns      []CheckRun
}

type Repo struct {
	Name            string
	DefaultBranch   string
	ProtectionOn    bool
	RequiredReviews int

	// Branch-protection rule details (default branch).
	RequiresSignedCommits   bool
	RequiresLinearHistory   bool
	AllowsForcePush         bool
	DismissStaleReviews     bool
	RequireCodeOwnerReviews bool

	// Repository attributes.
	IsPrivate bool
	Archived  bool

	// Code-security and analysis features.
	SecretScanningEnabled   bool
	PushProtectionEnabled   bool
	DependabotAlertsEnabled bool
	CodeScanningEnabled     bool
}

type Review struct {
	User        string
	State       string
	SubmittedAt time.Time
}