autodeploy

type Checker interface {
	CheckApp(ctx context.Context, appID, delivery string) error
}

type Delivery struct {
	// Event is the X-GitHub-Event header: push, release, create or ping.
	Event string

	// Signature is the X-Hub-Signature-256 header: "sha256=" and the hex
	// HMAC-SHA256 of Body, keyed by the app's webhook secret.
	Signature string

	Body []byte
}

type Outcome struct {
	// Checking is whether the delivery started a check. It never deploys
	// directly; the check decides.
	Checking bool   `json:"checking"`
	Message  string `json:"message"`
}

type PolicyLoader interface {
	Load(ctx context.Context) (policy.Document, error)
}

type Saved struct {
	Changed  bool   `json:"changed"`
	Revision int    `json:"revision,omitempty"`
	SpecID   string `json:"spec_id,omitempty"`
}

type Secret struct {
	// contains filtered or unexported fields
}

type Service struct {
	Apps    *state.Apps
	Checks  *state.AutoDeployChecks
	Secrets *state.AutoDeploySecrets
	Policy  PolicyLoader

	// Authz is what the spec gate asks (R-158, R-184).
	Authz specgate.Authorizer

	// Checker is the auto-deploy job.
	Checker Checker

	// Sources holds the webhook secrets of source connections with a webhook
	// of their own: a GitHub App Pando created (DeliverForSource).
	Sources WebhookSecretReader

	Audit  func(ctx context.Context, e audit.Event)
	Logger *zap.Logger
}

type View struct {
	// Settings are the newest revision's: what the next deploy ships.
	Settings spec.AutoDeploy `json:"settings"`

	// Deployed are the pinned revision's: what is in effect now.
	Deployed spec.AutoDeploy `json:"deployed"`

	// Pending is whether Settings are saved and not yet deployed.
	Pending bool `json:"pending"`

	// Paused is whether approval now stops an app that auto-deploys (R-158).
	Paused bool `json:"paused"`

	// LastCheck is the last time auto-deploy looked, or nil if it has not.
	LastCheck *state.AutoDeployCheck `json:"last_check"`

	// WebhookSecretSet is whether the app has a webhook secret, and so
	// whether its webhook does anything. The secret itself is shown once,
	// when it is made.
	WebhookSecretSet bool `json:"webhook_secret_set"`

	// WebhookURL is where the git host sends webhooks. The HTTP layer fills
	// it in, since only it knows the address Pando is reached at.
	WebhookURL string `json:"webhook_url"`
}

type WebhookSecretReader interface {
	WebhookSecret(ctx context.Context, id string) (secret.Value, bool, error)
}