v1beta1

type AuthProvider struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AuthProviderSpec   `json:"spec,omitempty"`
	Status AuthProviderStatus `json:"status,omitempty"`
}

type AuthProviderList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AuthProvider `json:"items"`
}

type AuthProviderSpec struct {
	// Type is the platform type.
	Type PlatformType `json:"type"`

	// Endpoint is the base URL of the Git platform.
	Endpoint string `json:"endpoint"`

	// ClientID is the OAuth2 client ID.
	ClientID string `json:"clientId"`

	// ClientSecret is a reference to the Secret containing the OAuth2 client secret.
	ClientSecret corev1.SecretKeySelector `json:"clientSecret"`

	// RedirectURL is the OAuth2 callback URL.
	RedirectURL string `json:"redirectUrl"`

	// ForgeURL is the API URL for the Git platform. Defaults to Endpoint.
	// +kubebuilder:validation:Optional
	ForgeURL string `json:"forgeUrl,omitempty"`

	// AuthURL is a custom OAuth2 authorization URL. Derived from Type and Endpoint if not specified.
	// +kubebuilder:validation:Optional
	AuthURL string `json:"authUrl,omitempty"`

	// Insecure disables TLS verification (not recommended for production).
	// +kubebuilder:validation:Optional
	Insecure bool `json:"insecure,omitempty"`

	// CABundleSecret is a reference to a Secret key containing a PEM-encoded
	// CA certificate bundle to trust when validating the platform TLS endpoint.
	// +kubebuilder:validation:Optional
	CABundleSecret *corev1.SecretKeySelector `json:"caBundleSecret,omitempty"`

	// DisplayName is a human-readable name shown in the login UI.
	// Derived from the Endpoint hostname when empty.
	// +kubebuilder:validation:Optional
	DisplayName string `json:"displayName,omitempty"`

	// IconURL is the URL of an icon shown next to the provider in the login UI.
	// Defaults to the Endpoint's favicon.ico when empty.
	// +kubebuilder:validation:Optional
	IconURL string `json:"iconUrl,omitempty"`
}

type AuthProviderStatus struct {
	// Conditions represent the latest available observations of the AuthProvider's state.
	// +kubebuilder:validation:Optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// Registered indicates whether the provider is currently registered with the auth manager.
	// +kubebuilder:validation:Optional
	Registered bool `json:"registered,omitempty"`

	// SecretResourceVersion tracks the resource version of the referenced secret.
	// This allows the controller to detect when the secret has been rotated.
	// +kubebuilder:validation:Optional
	SecretResourceVersion string `json:"secretResourceVersion,omitempty"`

	// CABundleSecretResourceVersion tracks the resource version of the referenced CA bundle secret.
	// This allows the controller to detect when the CA bundle has been rotated.
	// +kubebuilder:validation:Optional
	CABundleSecretResourceVersion string `json:"caBundleSecretResourceVersion,omitempty"`
}

type Discovery struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DiscoverySpec   `json:"spec,omitempty"`
	Status DiscoveryStatus `json:"status,omitempty"`
}

type DiscoveryList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Discovery `json:"items"`
}

type DiscoverySpec struct {
	ImageSpec `json:",inline"`

	// +kubebuilder:validation:Optional
	Logging *LoggingSpec `json:"logging,omitempty"`

	//+kubebuilder:validation:Optional
	ConfigRef string `json:"configRef,omitempty"`

	JobSpec `json:",inline"`

	PodSpec `json:",inline"`

	// +kubebuilder:validation:Optional
	Filter []string `json:"filter,omitempty"`

	// SkipForks excludes forked repositories from autodiscovery when set to true.
	// +kubebuilder:validation:Optional
	SkipForks *bool `json:"skipForks,omitempty"`

	// Topics filters autodiscovery to repositories matching all specified topics.
	// +kubebuilder:validation:Optional
	Topics []string `json:"topics,omitempty"`

	// GitLab configures GitLab-specific discovery options.
	// +kubebuilder:validation:Optional
	GitLab *GitLabOptions `json:"gitlab,omitempty"`

	// Webhooks configures webhook management for the repositories discovered
	// by this Discovery. Propagated to the child GitRepo resources.
	// +kubebuilder:validation:Optional
	Webhooks WebhooksSpec `json:"webhooks,omitempty"`

	// PodLabelTemplates are merged into Job pod labels. Values support
	// Go template variables: {{ .namespace }}, {{ .renovator }}, {{ .discovery }}.
	// +kubebuilder:validation:Optional
	PodLabelTemplates map[string]string `json:"podLabelTemplates,omitempty"`
}

type DiscoveryStatus struct {
	Conditions        []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
	LastScheduleTime  *metav1.Time       `json:"lastScheduleTime,omitempty"`
	LastDiscoveryTime *metav1.Time       `json:"lastDiscoveryTime,omitempty"`
}

type DryRun string

type GitLabOptions struct {
	// SkipPendingDeletion ensures repositories marked for deletion on the
	// platform (GitLab soft-delete) are excluded from discovery results.
	// +kubebuilder:validation:Optional
	SkipPendingDeletion *bool `json:"skipPendingDeletion,omitempty"`
}

type GitRepo struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   GitRepoSpec   `json:"spec,omitempty"`
	Status GitRepoStatus `json:"status,omitempty"`
}

type GitRepoList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []GitRepo `json:"items"`
}

type GitRepoSpec struct {
	Name string `json:"name"`

	//+kubebuilder:validation:Optional
	ConfigRef string `json:"configRef,omitempty"`

	// Webhooks configures webhook management for this repository. When set to
	// disabled, the operator will not create or maintain a webhook on the
	// remote Git provider, will not generate webhook secrets, and will remove
	// any previously managed webhook.
	// +kubebuilder:validation:Optional
	Webhooks WebhooksSpec `json:"webhooks,omitempty"`
}

type GitRepoStatus struct {
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`

	// LastRenovateTime is the creation timestamp of the most recently completed
	// renovate job for this GitRepo.
	// This field is managed by the operator and should not be set manually.
	// +kubebuilder:validation:Optional
	LastRenovateTime *metav1.Time `json:"lastRenovateTime,omitempty"`

	// WebhookID is the ID of the webhook registered on the remote Git provider.
	// This field is managed by the operator and should not be set manually.
	// +kubebuilder:validation:Optional
	WebhookID string `json:"webhookId,omitempty"`

	// Platform is the type of the Git provider.
	// This field is managed by the operator and should not be set manually.
	// +kubebuilder:validation:Optional
	Platform string `json:"platform,omitempty"`

	// RepoURL is the web-accessible URL for the repository.
	// This field is managed by the operator and should not be set manually.
	// +kubebuilder:validation:Optional
	RepoURL string `json:"repoUrl,omitempty"`
}

type ImageSpec struct {
	// Name of the container image, supporting both tags (`<image>:<tag>`)
	// and digests for deterministic and repeatable deployments
	// (`<image>:<tag>@sha256:<digestValue>`)
	// +kubebuilder:validation:Optional
	Image string `json:"image,omitempty"`

	// Image pull policy.
	// One of `Always`, `Never` or `IfNotPresent`.
	// If not defined, it defaults to `IfNotPresent`.
	// Cannot be updated.
	// More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
	// +kubebuilder:validation:Optional
	ImagePullPolicy corev1.PullPolicy `json:"imagePullPolicy,omitempty"`

	// ImagePullSecrets is a list of references to secrets in the same namespace to use for pulling the image.
	// More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
	// +kubebuilder:validation:Optional
	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`
}

type JobSpec struct {
	// Suspend specifies whether the job execution and scheduling should be paused.
	// +kubebuilder:validation:Optional
	Suspend *bool `json:"suspend,omitempty"`

	// Schedule specifies the cron-formatted schedule on which the job should run.
	// +kubebuilder:validation:Optional
	Schedule string `json:"schedule,omitempty"`

	// Timezone specifies the IANA timezone name (e.g., "America/New_York", "Europe/Berlin")
	// to use when evaluating the cron schedule. If not set, the operator's local timezone is used.
	// +kubebuilder:validation:Optional
	Timezone string `json:"timezone,omitempty"`

	// SuccessLimit specifies the number of successful finished jobs to retain for history.
	// +kubebuilder:validation:Optional
	SuccessLimit *int32 `json:"successLimit,omitempty"`

	// FailedLimit specifies the number of failed finished jobs to retain for history.
	// +kubebuilder:validation:Optional
	FailedLimit *int32 `json:"failedLimit,omitempty"`

	// BackoffLimit specifies the number of retries before marking this job as failed.
	// +kubebuilder:validation:Optional
	BackoffLimit *int32 `json:"backoffLimit,omitempty"`

	// TTLSecondsAfterFinished limits the lifetime of a Job that has finished execution
	// (either Complete or Failed). If this field is set, the job and its pods will be
	// automatically deleted after the specified number of seconds.
	// +kubebuilder:validation:Optional
	TTLSecondsAfterFinished *int32 `json:"ttlSecondsAfterFinished,omitempty"`
}

type LogLevel string

type LoggingSpec struct {
	Level LogLevel `json:"level"`
}

type PlatformSpec struct {
	Type     PlatformType        `json:"type"`
	Endpoint string              `json:"endpoint"`
	Token    corev1.EnvVarSource `json:"token"`
}

type PlatformType string

type PodSpec struct {
	// NodeSelector specifies the node selector for scheduling the renovate pod.
	// +kubebuilder:validation:Optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`

	// Affinity specifies the affinity settings for scheduling the renovate pod.
	// +kubebuilder:validation:Optional
	Affinity *corev1.Affinity `json:"affinity,omitempty"`

	// Tolerations specifies the tolerations for scheduling the renovate pod.
	// +kubebuilder:validation:Optional
	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`

	// TopologySpreadConstraints specifies the topology spread constraints for the renovate pod.
	// +kubebuilder:validation:Optional
	TopologySpreadConstraints []corev1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"`

	// Resources specifies the resource requirements for the renovate container.
	// +kubebuilder:validation:Optional
	Resources corev1.ResourceRequirements `json:"resources,omitempty"`

	// SecurityContext specifies the security context for the renovate container.
	// +kubebuilder:validation:Optional
	SecurityContext *corev1.SecurityContext `json:"securityContext,omitempty"`

	// ExtraEnv specifies additional environment variables for the renovate container.
	// +kubebuilder:validation:Optional
	ExtraEnv []corev1.EnvVar `json:"extraEnv,omitempty"`

	// ExtraVolumes specifies additional volumes for the renovate pod.
	// +kubebuilder:validation:Optional
	ExtraVolumes []corev1.Volume `json:"extraVolumes,omitempty"`

	// RuntimeClassName specifies the runtime class for the renovate pod.
	// +kubebuilder:validation:Optional
	RuntimeClassName *string `json:"runtimeClassName,omitempty"`

	// PodAnnotations specifies additional annotations for the renovate pod.
	// +kubebuilder:validation:Optional
	PodAnnotations map[string]string `json:"podAnnotations,omitempty"`

	// ScratchVolume configures a scratch volume for RENOVATE_BASE_DIR.
	// +kubebuilder:validation:Optional
	ScratchVolume *ScratchVolumeSpec `json:"scratchVolume,omitempty"`
}

type RenovateConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   RenovateConfigSpec   `json:"spec,omitempty"`
	Status RenovateConfigStatus `json:"status,omitempty"`
}

type RenovateConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []RenovateConfig `json:"items"`
}

type RenovateConfigSpec struct {
	ImageSpec `json:",inline"`

	// +kubebuilder:validation:Optional
	Logging *LoggingSpec `json:"logging,omitempty"`

	Platform PlatformSpec `json:"platform"`
	// +kubebuilder:validation:Optional
	DryRun DryRun `json:"dryRun,omitempty"`
	// +kubebuilder:validation:Optional
	Onboarding *bool `json:"onboarding,omitempty"`
	// OnBoardingConfig object `json:"onBoardingConfig,omitempty,inline"`
	// +kubebuilder:validation:Optional
	PrHourlyLimit int `json:"prHourlyLimit,omitempty"`
	// +kubebuilder:validation:Optional
	AddLabels []string `json:"addLabels,omitempty"`

	// +kubebuilder:validation:Optional
	GithubToken *corev1.EnvVarSource `json:"githubToken,omitempty"`

	// FailOnConfigValidationError controls whether Renovate should exit with a non-zero exit code
	// when configuration validation errors occur. When true, jobs will fail on config errors.
	// +kubebuilder:validation:Optional
	FailOnConfigValidationError *bool `json:"failOnConfigValidationError,omitempty"`
}

type RenovateConfigStatus struct {
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

type Renovator struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   RenovatorSpec   `json:"spec,omitempty"`
	Status RenovatorStatus `json:"status,omitempty"`
}

type RenovatorList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Renovator `json:"items"`
}

type RenovatorSpec struct {
	ImageSpec `json:",inline"`

	// +kubebuilder:validation:Optional
	Logging LoggingSpec `json:"logging,omitempty"`

	JobSpec `json:",inline"`

	PodSpec `json:",inline"`

	Discovery DiscoverySpec `json:"discovery"`

	// +kubebuilder:validation:Optional
	Runner RunnerSpec `json:"runner"`

	Renovate RenovateConfigSpec `json:"renovate,omitempty"`

	// AuthProviderRef is a reference to an AuthProvider resource in the same namespace.
	// When set, this Renovator will use the referenced AuthProvider for authentication.
	// Multiple Renovators can reference the same AuthProvider to share authentication configuration.
	// +kubebuilder:validation:Optional
	AuthProviderRef string `json:"authProviderRef,omitempty"`

	// Webhooks configures webhook management for the repositories discovered
	// by this Renovator. This setting is propagated to the child Discovery
	// and GitRepo resources.
	// +kubebuilder:validation:Optional
	Webhooks WebhooksSpec `json:"webhooks,omitempty"`
}

type RenovatorStatus struct {
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

type ResourceName string

type Runner struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   RunnerSpec   `json:"spec,omitempty"`
	Status RunnerStatus `json:"status,omitempty"`
}

type RunnerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Runner `json:"items"`
}

type RunnerSpec struct {
	ImageSpec `json:",inline"`

	// +kubebuilder:validation:Optional
	Logging *LoggingSpec `json:"logging,omitempty"`

	//+kubebuilder:validation:Optional
	ConfigRef string `json:"configRef,omitempty"`

	JobSpec `json:",inline"`

	PodSpec `json:",inline"`

	// MaxParallel specifies the maximum number of jobs that can run concurrently.
	// A value of 0 means no limit.
	// +kubebuilder:validation:Optional
	MaxParallel *int32 `json:"maxParallel,omitempty"`

	// PodLabelTemplates are merged into Job pod labels. Values support
	// Go template variables: {{ .namespace }}, {{ .renovator }}, {{ .runner }}, {{ .discovery }}, {{ .gitrepo }}.
	// +kubebuilder:validation:Optional
	PodLabelTemplates map[string]string `json:"podLabelTemplates,omitempty"`
}

type RunnerStatus struct {
	Conditions       []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
	LastScheduleTime *metav1.Time       `json:"lastScheduleTime,omitempty"`
}

type ScratchVolumeSpec struct {
	// Path is the mount path for the scratch volume (RENOVATE_BASE_DIR).
	// Must be an absolute path.
	Path string `json:"path,omitempty"`

	// Ephemeral uses a Kubernetes generic ephemeral volume for scratch (volume.ephemeral).
	// When set, Medium and SizeLimit are ignored.
	Ephemeral *corev1.EphemeralVolumeSource `json:"ephemeral,omitempty"`

	// Medium specifies the storage medium.
	Medium corev1.StorageMedium `json:"medium,omitempty"`

	// SizeLimit is the maximum size of the volume.
	SizeLimit *resource.Quantity `json:"sizeLimit,omitempty"`
}

type WebhooksSpec struct {
	// Enabled controls whether the operator manages webhooks on the remote Git
	// provider for discovered repositories. When set to false, no webhooks
	// will be created, no webhook secrets will be generated, and any existing
	// managed webhook will be removed.
	// Defaults to true.
	// +kubebuilder:validation:Optional
	Enabled *bool `json:"enabled,omitempty"`
}