mustflow 2.84.0 → 2.99.0

package/schemas/repo-manifest-lock-drift-report.schema.json

@@ -0,0 +1,202 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mustflow.github.io/schemas/repo-manifest-lock-drift-report.schema.json",
+  "title": "mustflow repo manifest-lock-drift report",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "command",
+    "pack_id",
+    "script_id",
+    "script_ref",
+    "action",
+    "status",
+    "ok",
+    "mustflow_root",
+    "input",
+    "policy",
+    "input_hash",
+    "lock",
+    "summary",
+    "entries",
+    "findings",
+    "issues"
+  ],
+  "properties": {
+    "schema_version": { "const": "1" },
+    "command": { "const": "script-pack" },
+    "pack_id": { "const": "repo" },
+    "script_id": { "const": "manifest-lock-drift" },
+    "script_ref": { "const": "repo/manifest-lock-drift" },
+    "action": { "const": "check" },
+    "status": { "enum": ["passed", "failed", "error"] },
+    "ok": { "type": "boolean" },
+    "mustflow_root": { "type": "string" },
+    "input": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["paths"],
+      "properties": {
+        "paths": {
+          "type": "array",
+          "items": { "type": "string" }
+        }
+      }
+    },
+    "policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["lock_path", "input_mode", "max_entries", "extra_manifest_file_detection"],
+      "properties": {
+        "lock_path": { "const": ".mustflow/config/manifest.lock.toml" },
+        "input_mode": { "enum": ["all_locked_files", "explicit_paths"] },
+        "max_entries": { "type": "integer", "minimum": 1 },
+        "extra_manifest_file_detection": { "const": "not_authoritative" }
+      }
+    },
+    "input_hash": { "$ref": "#/$defs/sha256" },
+    "lock": { "$ref": "#/$defs/lockMetadata" },
+    "summary": { "$ref": "#/$defs/summary" },
+    "entries": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/entry" }
+    },
+    "findings": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/finding" }
+    },
+    "issues": {
+      "type": "array",
+      "items": { "type": "string" }
+    }
+  },
+  "$defs": {
+    "sha256": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "nullableString": {
+      "type": ["string", "null"]
+    },
+    "nullableSha256": {
+      "anyOf": [
+        { "$ref": "#/$defs/sha256" },
+        { "type": "null" }
+      ]
+    },
+    "lockMetadata": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path",
+        "exists",
+        "schema_version",
+        "template_id",
+        "template_version",
+        "template_profile",
+        "template_locale",
+        "entries_total"
+      ],
+      "properties": {
+        "path": { "const": ".mustflow/config/manifest.lock.toml" },
+        "exists": { "type": "boolean" },
+        "schema_version": { "$ref": "#/$defs/nullableString" },
+        "template_id": { "$ref": "#/$defs/nullableString" },
+        "template_version": { "$ref": "#/$defs/nullableString" },
+        "template_profile": { "$ref": "#/$defs/nullableString" },
+        "template_locale": { "$ref": "#/$defs/nullableString" },
+        "entries_total": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "summary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "entries_total",
+        "entries_checked",
+        "clean_entries",
+        "missing_entries",
+        "hash_mismatches",
+        "unreadable_entries",
+        "unsafe_entries",
+        "skipped_entries",
+        "findings"
+      ],
+      "properties": {
+        "entries_total": { "type": "integer", "minimum": 0 },
+        "entries_checked": { "type": "integer", "minimum": 0 },
+        "clean_entries": { "type": "integer", "minimum": 0 },
+        "missing_entries": { "type": "integer", "minimum": 0 },
+        "hash_mismatches": { "type": "integer", "minimum": 0 },
+        "unreadable_entries": { "type": "integer", "minimum": 0 },
+        "unsafe_entries": { "type": "integer", "minimum": 0 },
+        "skipped_entries": { "type": "integer", "minimum": 0 },
+        "findings": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "entry": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path",
+        "source",
+        "last_action",
+        "lock_hash",
+        "actual_hash",
+        "exists",
+        "status"
+      ],
+      "properties": {
+        "path": { "type": "string" },
+        "source": { "$ref": "#/$defs/nullableString" },
+        "last_action": { "$ref": "#/$defs/nullableString" },
+        "lock_hash": { "$ref": "#/$defs/nullableString" },
+        "actual_hash": { "$ref": "#/$defs/nullableSha256" },
+        "exists": { "type": "boolean" },
+        "status": {
+          "enum": ["clean", "hash_mismatch", "missing", "unreadable", "unsafe_path", "skipped"]
+        }
+      }
+    },
+    "finding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "code",
+        "severity",
+        "message",
+        "path",
+        "expected_hash",
+        "actual_hash",
+        "json_pointer",
+        "metric",
+        "actual",
+        "expected"
+      ],
+      "properties": {
+        "code": {
+          "enum": [
+            "manifest_lock_missing",
+            "manifest_lock_invalid",
+            "manifest_lock_max_entries_exceeded",
+            "manifest_lock_entry_path_outside_root",
+            "manifest_lock_entry_missing",
+            "manifest_lock_entry_unreadable",
+            "manifest_lock_entry_invalid_hash",
+            "manifest_lock_hash_mismatch"
+          ]
+        },
+        "severity": { "enum": ["low", "medium", "high", "critical"] },
+        "message": { "type": "string" },
+        "path": { "type": "string" },
+        "expected_hash": { "$ref": "#/$defs/nullableString" },
+        "actual_hash": { "$ref": "#/$defs/nullableSha256" },
+        "json_pointer": { "type": ["string", "null"] },
+        "metric": { "type": ["string", "null"] },
+        "actual": { "type": ["number", "null"] },
+        "expected": { "type": ["number", "null"] }
+      }
+    }
+  }
+}

package/schemas/repo-merge-conflict-scan-report.schema.json

@@ -0,0 +1,169 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mustflow.github.io/schemas/repo-merge-conflict-scan-report.schema.json",
+  "title": "mustflow repo merge-conflict-scan report",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "command",
+    "pack_id",
+    "script_id",
+    "script_ref",
+    "action",
+    "status",
+    "ok",
+    "mustflow_root",
+    "input",
+    "policy",
+    "input_hash",
+    "summary",
+    "files",
+    "markers",
+    "findings",
+    "issues"
+  ],
+  "properties": {
+    "schema_version": { "const": "1" },
+    "command": { "const": "script-pack" },
+    "pack_id": { "const": "repo" },
+    "script_id": { "const": "merge-conflict-scan" },
+    "script_ref": { "const": "repo/merge-conflict-scan" },
+    "action": { "const": "check" },
+    "status": { "enum": ["passed", "failed", "error"] },
+    "ok": { "type": "boolean" },
+    "mustflow_root": { "type": "string" },
+    "input": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["paths"],
+      "properties": {
+        "paths": {
+          "type": "array",
+          "items": { "type": "string" }
+        }
+      }
+    },
+    "policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["input_mode", "marker_prefixes", "max_files", "max_file_bytes", "skipped_directories"],
+      "properties": {
+        "input_mode": { "enum": ["explicit_paths", "git_changed_files"] },
+        "marker_prefixes": {
+          "type": "array",
+          "items": { "enum": ["<<<<<<<", "|||||||", "=======", ">>>>>>>"] }
+        },
+        "max_files": { "type": "integer", "minimum": 1 },
+        "max_file_bytes": { "type": "integer", "minimum": 1 },
+        "skipped_directories": {
+          "type": "array",
+          "items": { "type": "string" }
+        }
+      }
+    },
+    "input_hash": { "$ref": "#/$defs/sha256" },
+    "summary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["files_checked", "markers_found", "files_with_markers", "issues"],
+      "properties": {
+        "files_checked": { "type": "integer", "minimum": 0 },
+        "markers_found": { "type": "integer", "minimum": 0 },
+        "files_with_markers": { "type": "integer", "minimum": 0 },
+        "issues": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "files": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/file" }
+    },
+    "markers": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/marker" }
+    },
+    "findings": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/finding" }
+    },
+    "issues": {
+      "type": "array",
+      "items": { "type": "string" }
+    }
+  },
+  "$defs": {
+    "sha256": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "markerKind": {
+      "enum": ["start", "base", "separator", "end"]
+    },
+    "file": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "sha256", "bytes", "markers"],
+      "properties": {
+        "path": { "type": "string" },
+        "sha256": { "$ref": "#/$defs/sha256" },
+        "bytes": { "type": "integer", "minimum": 0 },
+        "markers": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "marker": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "line", "column", "marker", "marker_length"],
+      "properties": {
+        "path": { "type": "string" },
+        "line": { "type": "integer", "minimum": 1 },
+        "column": { "type": "integer", "minimum": 1 },
+        "marker": { "$ref": "#/$defs/markerKind" },
+        "marker_length": { "type": "integer", "minimum": 1 }
+      }
+    },
+    "finding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "code",
+        "severity",
+        "message",
+        "path",
+        "line",
+        "marker",
+        "json_pointer",
+        "metric",
+        "actual",
+        "expected"
+      ],
+      "properties": {
+        "code": {
+          "enum": [
+            "merge_conflict_marker_detected",
+            "merge_conflict_scan_git_unavailable",
+            "merge_conflict_scan_no_input_files",
+            "merge_conflict_scan_max_files_exceeded",
+            "merge_conflict_scan_file_too_large",
+            "merge_conflict_scan_unreadable_path",
+            "merge_conflict_scan_path_outside_root"
+          ]
+        },
+        "severity": { "enum": ["low", "medium", "high", "critical"] },
+        "message": { "type": "string" },
+        "path": { "type": "string" },
+        "line": { "type": ["integer", "null"], "minimum": 1 },
+        "marker": {
+          "anyOf": [
+            { "$ref": "#/$defs/markerKind" },
+            { "type": "null" }
+          ]
+        },
+        "json_pointer": { "type": ["string", "null"] },
+        "metric": { "type": ["string", "null"] },
+        "actual": { "type": ["number", "null"] },
+        "expected": { "type": ["number", "null"] }
+      }
+    }
+  }
+}

package/schemas/repo-version-source-report.schema.json

@@ -0,0 +1,127 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mustflow.github.io/schemas/repo-version-source-report.schema.json",
+  "title": "mustflow repo version-source report",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "command",
+    "pack_id",
+    "script_id",
+    "script_ref",
+    "action",
+    "status",
+    "ok",
+    "mustflow_root",
+    "input",
+    "input_hash",
+    "versioning_enabled",
+    "counts",
+    "sources",
+    "findings",
+    "issues"
+  ],
+  "properties": {
+    "schema_version": { "const": "1" },
+    "command": { "const": "script-pack" },
+    "pack_id": { "const": "repo" },
+    "script_id": { "const": "version-source" },
+    "script_ref": { "const": "repo/version-source" },
+    "action": { "const": "inspect" },
+    "status": { "enum": ["passed", "failed", "error"] },
+    "ok": { "type": "boolean" },
+    "mustflow_root": { "type": "string" },
+    "input": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["preferences_path", "declared_sources_path"],
+      "properties": {
+        "preferences_path": { "const": ".mustflow/config/preferences.toml" },
+        "declared_sources_path": { "const": ".mustflow/config/versioning.toml" }
+      }
+    },
+    "input_hash": { "$ref": "#/$defs/sha256" },
+    "versioning_enabled": { "type": "boolean" },
+    "counts": { "$ref": "#/$defs/counts" },
+    "sources": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/versionSource" }
+    },
+    "findings": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/finding" }
+    },
+    "issues": {
+      "type": "array",
+      "items": { "type": "string" }
+    }
+  },
+  "$defs": {
+    "sha256": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "counts": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "sources",
+        "declared_sources",
+        "source_authority_sources",
+        "derived_authority_sources",
+        "unclassified_authority_sources"
+      ],
+      "properties": {
+        "sources": { "type": "integer", "minimum": 0 },
+        "declared_sources": { "type": "integer", "minimum": 0 },
+        "source_authority_sources": { "type": "integer", "minimum": 0 },
+        "derived_authority_sources": { "type": "integer", "minimum": 0 },
+        "unclassified_authority_sources": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "versionSource": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "kind"],
+      "properties": {
+        "path": { "type": "string" },
+        "kind": {
+          "enum": [
+            "template_lock",
+            "template_manifest",
+            "package_manifest"
+          ]
+        },
+        "declared": { "type": "boolean" },
+        "authority": {
+          "enum": ["source", "derived"]
+        }
+      }
+    },
+    "finding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "code",
+        "severity",
+        "message",
+        "path",
+        "json_pointer",
+        "metric",
+        "actual",
+        "expected"
+      ],
+      "properties": {
+        "code": { "const": "versioning_enabled_without_sources" },
+        "severity": { "enum": ["low", "medium", "high", "critical"] },
+        "message": { "type": "string" },
+        "path": { "type": "string" },
+        "json_pointer": { "type": ["string", "null"] },
+        "metric": { "type": ["string", "null"] },
+        "actual": { "type": ["number", "null"] },
+        "expected": { "type": ["number", "null"] }
+      }
+    }
+  }
+}

package/schemas/secret-risk-scan-report.schema.json

@@ -0,0 +1,152 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mustflow.github.io/schemas/secret-risk-scan-report.schema.json",
+  "title": "mustflow secret-risk-scan report",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "command",
+    "pack_id",
+    "script_id",
+    "script_ref",
+    "action",
+    "status",
+    "ok",
+    "mustflow_root",
+    "policy",
+    "input_hash",
+    "targets",
+    "summary",
+    "truncated",
+    "findings",
+    "issues"
+  ],
+  "properties": {
+    "schema_version": { "const": "1" },
+    "command": { "const": "script-pack" },
+    "pack_id": { "const": "repo" },
+    "script_id": { "const": "secret-risk-scan" },
+    "script_ref": { "const": "repo/secret-risk-scan" },
+    "action": { "const": "scan" },
+    "status": { "enum": ["passed", "failed", "error"] },
+    "ok": { "type": "boolean" },
+    "mustflow_root": { "type": "string" },
+    "policy": { "$ref": "#/$defs/policy" },
+    "input_hash": { "$ref": "#/$defs/sha256" },
+    "targets": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/target" }
+    },
+    "summary": { "$ref": "#/$defs/summary" },
+    "truncated": { "type": "boolean" },
+    "findings": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/finding" }
+    },
+    "issues": {
+      "type": "array",
+      "items": { "type": "string" }
+    }
+  },
+  "$defs": {
+    "sha256": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "fingerprint": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{16}$"
+    },
+    "stringArray": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "max_file_bytes",
+        "max_files",
+        "max_findings",
+        "extensions",
+        "skipped_secret_names",
+        "ignored_directories"
+      ],
+      "properties": {
+        "max_file_bytes": { "type": "integer", "minimum": 1 },
+        "max_files": { "type": "integer", "minimum": 1 },
+        "max_findings": { "type": "integer", "minimum": 1 },
+        "extensions": { "$ref": "#/$defs/stringArray" },
+        "skipped_secret_names": { "$ref": "#/$defs/stringArray" },
+        "ignored_directories": { "$ref": "#/$defs/stringArray" }
+      }
+    },
+    "target": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["input", "path", "exists", "kind"],
+      "properties": {
+        "input": { "type": "string" },
+        "path": { "type": "string" },
+        "exists": { "type": ["boolean", "null"] },
+        "kind": { "enum": ["file", "directory", "missing", "other", "unknown"] }
+      }
+    },
+    "summary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "target_count",
+        "file_count",
+        "finding_count",
+        "skipped_secret_file_count",
+        "high_or_critical_count"
+      ],
+      "properties": {
+        "target_count": { "type": "integer", "minimum": 0 },
+        "file_count": { "type": "integer", "minimum": 0 },
+        "finding_count": { "type": "integer", "minimum": 0 },
+        "skipped_secret_file_count": { "type": "integer", "minimum": 0 },
+        "high_or_critical_count": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "detector": {
+      "enum": [
+        "private_key_block",
+        "bearer_token",
+        "provider_token",
+        "generic_assignment",
+        "realistic_env_example",
+        "secret_file_skipped"
+      ]
+    },
+    "finding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["code", "severity", "message", "path"],
+      "properties": {
+        "code": {
+          "enum": [
+            "secret_risk_path_outside_root",
+            "secret_risk_unreadable_path",
+            "secret_risk_secret_file_skipped",
+            "secret_risk_max_files_exceeded",
+            "secret_risk_max_findings_exceeded",
+            "secret_risk_private_key_block",
+            "secret_risk_bearer_token",
+            "secret_risk_provider_token",
+            "secret_risk_generic_assignment",
+            "secret_risk_realistic_env_example"
+          ]
+        },
+        "severity": { "enum": ["low", "medium", "high", "critical"] },
+        "message": { "type": "string" },
+        "path": { "type": "string" },
+        "line": { "type": "integer", "minimum": 1 },
+        "detector": { "$ref": "#/$defs/detector" },
+        "fingerprint": { "$ref": "#/$defs/fingerprint" }
+      }
+    }
+  }
+}