parse

type Access string

type Environment struct {
	Name string
	Loc  Location
}

type Job struct {
	ID   string
	Name string
	Loc  Location

	// Steps are the job's steps, in order.
	Steps []Step

	// Environments lists the deployment environments whose secrets this job
	// can read. GitHub allows one environment per job; this stays a slice so
	// that a matrix over environments can be modelled later.
	Environments []Environment

	// EnvironmentDynamic is set when the environment name is an expression we
	// cannot resolve, for example environment: ${{ inputs.target }}. Secrets
	// for such a job cannot be verified.
	EnvironmentDynamic bool

	// Uses is set when the job calls a reusable workflow.
	Uses string

	// Permissions is the job's own permissions block, if it declares one.
	Permissions Permissions
}

type LoadError struct {
	Path string
	Err  error
}

type Location struct {
	File string
	Line int
	Col  int
}

type Permissions struct {
	// Declared is false when the workflow or job has no permissions block.
	Declared bool
	// Loc is where the block sits, meaningful only when Declared.
	Loc Location
	// Dynamic is set when the block is an expression we cannot resolve.
	Dynamic bool
	// contains filtered or unexported fields
}

type Reference struct {
	expr.Ref
	Loc   Location
	JobID string // empty when the reference sits outside any job
	Field string // dotted YAML path, e.g. jobs.deploy.steps[1].env.TOKEN
}

type Step struct {
	Loc  Location
	Name string
	// Uses is the action reference, e.g. actions/checkout@v4. Empty for a
	// `run:` step.
	Uses string

	// Run is the shell script of a `run:` step, empty for a `uses:` step.
	//
	// Controls must be careful with this: inferring intent from shell is where
	// false positives come from. Searching it for a specific literal command is
	// safe; deducing what a script "does" is not.
	Run string
	// contains filtered or unexported fields
}

type Unresolved struct {
	expr.Unresolved
	Loc   Location
	JobID string
	Field string
}

type Workflow struct {
	Path string // path as displayed, relative to the repository root
	Name string

	Jobs     map[string]*Job
	JobOrder []string

	References []Reference
	Unresolved []Unresolved

	// Reusable is true when the workflow declares on.workflow_call. Secrets in
	// a reusable workflow may be supplied by the caller, so they cannot be
	// verified against this repository alone.
	Reusable bool

	// CallSecrets holds the secret names declared under on.workflow_call.secrets.
	// They are parameters, not repository secrets.
	CallSecrets map[string]Environment

	// Permissions is the workflow-level permissions block, if it declares one.
	// It applies to every job that does not declare its own.
	Permissions Permissions

	Root *yaml.Node
	// contains filtered or unexported fields
}