ghasetup

type Catalog struct {
	Version int    `json:"version"`
	Tools   []Tool `json:"tools"`
}

type Detect struct {
	// Always marks a tool that works on any repository: the SBOM producers,
	// the secret scanners, the multi-language SAST engines.
	Always bool `json:"always,omitempty"`

	// Files are basenames or directory names that must exist somewhere in the
	// tree. A match on any one of them selects the tool.
	Files []string `json:"files,omitempty"`

	// Extensions are file suffixes, matched the same way.
	Extensions []string `json:"extensions,omitempty"`

	// Manual keeps a tool out of --detect entirely. These are the ones that
	// need something the repository cannot supply: a licence key (Snyk), or a
	// live target the operator must nominate (ZAP, Nuclei). Selecting one by
	// name still works.
	Manual bool `json:"manual,omitempty"`
}

type Options struct {
	// SelfHostedLabels, when set, replaces `ubuntu-latest` on every job.
	SelfHostedLabels []string
	// OrgID is written into the publish job's env as a literal only when the
	// caller explicitly asks; otherwise the secret reference is used, which is
	// what almost every repository wants.
	OrgIDLiteral string

	// Triggers are the workflow's `on:` events. Empty means push +
	// workflow_dispatch, which is what this command has always written.
	//
	// It is worth choosing deliberately once a repository runs more than a
	// handful of scanners: a full detected set is twenty-odd jobs, and on a
	// small runner pool "on every push" turns a two-minute build into an hour
	// of queue for everyone else.
	Triggers []string

	// ScheduleCron is the five-field expression used when Triggers includes
	// "schedule". Stagger it across repositories; a fleet that all wakes at
	// 03:00 has one runner-shaped bottleneck, not a schedule.
	ScheduleCron string
}

type Remote struct {
	// URL is the raw origin URL, empty when there is no origin.
	URL string
	// Host is the parsed host ("github.com", "gitlab.com", …), empty when the
	// URL could not be parsed.
	Host string
	// Slug is "owner/repo" when the URL could be parsed.
	Slug string
	// IsGitHub reports whether this is github.com or a GitHub Enterprise host.
	IsGitHub bool
}

type RepoSignals struct {
	Files      map[string]bool
	Extensions map[string]bool
}

type Step struct {
	Name string            `json:"name,omitempty"`
	ID   string            `json:"id,omitempty"`
	Uses string            `json:"uses,omitempty"`
	Run  string            `json:"run,omitempty"`
	With map[string]any    `json:"with,omitempty"`
	Env  map[string]string `json:"env,omitempty"`
}

type Tool struct {
	ID          string   `json:"id"`
	Name        string   `json:"name"`
	JobName     string   `json:"jobName"`
	Category    string   `json:"category"`
	Description string   `json:"description"`
	Artifact    string   `json:"artifact"`
	Paths       []string `json:"paths"`
	Note        string   `json:"note,omitempty"`
	Detect      Detect   `json:"detect"`
	Steps       []Step   `json:"steps"`
}