{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://paulkov.github.io/dpone/schemas/gitops/airflow-runtime-init-fetch-plan.schema.json",
  "title": "dpone GitOps Airflow runtime init-fetch plan",
  "type": "object",
  "required": [
    "schema",
    "environment",
    "trust_tier",
    "release_id",
    "deployment_id",
    "runtime_image",
    "registry",
    "trust_policy",
    "identity",
    "release",
    "deployment",
    "binding_set",
    "connection_registry",
    "credential_runtime",
    "workload_pack",
    "execution",
    "verify"
  ],
  "additionalProperties": false,
  "properties": {
    "schema": {
      "const": "dpone.airflow-runtime-init-fetch-plan.v1"
    },
    "environment": {
      "type": "string",
      "pattern": "^[a-z0-9][a-z0-9_-]{0,62}$"
    },
    "trust_tier": {
      "enum": [
        "production",
        "non_production"
      ]
    },
    "release_id": {
      "$ref": "#/$defs/sha256"
    },
    "deployment_id": {
      "$ref": "#/$defs/sha256"
    },
    "runtime_image": {
      "type": "object",
      "required": [
        "ref",
        "digest"
      ],
      "additionalProperties": false,
      "properties": {
        "ref": {
          "type": "string",
          "pattern": "^(?!.*(?:\\s|://|\\?|#|=))[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?::(?!0+/)(?:[0-9]{1,4}|[0-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?/[a-z0-9]+(?:[._/-][a-z0-9]+)*@sha256:[0-9a-f]{64}$"
        },
        "digest": {
          "$ref": "#/$defs/sha256"
        }
      }
    },
    "registry": {
      "type": "object",
      "required": [
        "logical_ref",
        "configuration"
      ],
      "additionalProperties": false,
      "properties": {
        "logical_ref": {
          "type": "string",
          "pattern": "^(?!.*%)(?!(?:[Cc][Uu][Rr][Rr][Ee][Nn][Tt]|[Ll][Aa][Tt][Ee][Ss][Tt])(?:$|[/:@?#=&]))(?!.*[/:@?#=&](?:[Cc][Uu][Rr][Rr][Ee][Nn][Tt]|[Ll][Aa][Tt][Ee][Ss][Tt])(?:$|[/:@?#=&]))\\S+$"
        },
        "configuration": {
          "type": "object",
          "required": [
            "kind",
            "name",
            "key",
            "sha256"
          ],
          "additionalProperties": false,
          "properties": {
            "kind": {
              "const": "kubernetes_config_map"
            },
            "name": {
              "type": "string",
              "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
              "maxLength": 63
            },
            "key": {
              "type": "string",
              "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,252}$",
              "maxLength": 253
            },
            "sha256": {
              "type": "string",
              "pattern": "^sha256:[0-9a-f]{64}$"
            }
          }
        }
      }
    },
    "trust_policy": {
      "anyOf": [
        {
          "type": "object",
          "required": [
            "kind",
            "name",
            "key",
            "sha256"
          ],
          "additionalProperties": false,
          "properties": {
            "kind": {
              "const": "kubernetes_config_map"
            },
            "name": {
              "type": "string",
              "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
              "maxLength": 63
            },
            "key": {
              "type": "string",
              "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,252}$",
              "maxLength": 253
            },
            "sha256": {
              "type": "string",
              "pattern": "^sha256:[0-9a-f]{64}$"
            }
          }
        },
        {
          "type": "null"
        }
      ]
    },
    "identity": {
      "type": "object",
      "required": [
        "method",
        "service_account",
        "namespace"
      ],
      "additionalProperties": false,
      "properties": {
        "method": {
          "enum": [
            "kubernetes_workload_identity"
          ]
        },
        "service_account": {
          "type": "string",
          "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
          "maxLength": 63
        },
        "namespace": {
          "type": "string",
          "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
          "maxLength": 63
        }
      }
    },
    "release": {
      "$ref": "#/$defs/exactArtifact"
    },
    "deployment": {
      "$ref": "#/$defs/exactArtifact"
    },
    "binding_set": {
      "allOf": [
        {
          "$ref": "#/$defs/exactArtifact"
        },
        {
          "properties": {
            "artifact_ref": {
              "pattern": "^cache://runtime-connection-contexts/sha256-[0-9a-f]{64}/binding-set[.]json$"
            }
          }
        }
      ]
    },
    "connection_registry": {
      "allOf": [
        {
          "$ref": "#/$defs/exactArtifact"
        },
        {
          "properties": {
            "artifact_ref": {
              "pattern": "^cache://runtime-connection-contexts/sha256-[0-9a-f]{64}/connection-registry[.]json$"
            }
          }
        }
      ]
    },
    "credential_runtime": {
      "allOf": [
        {
          "$ref": "#/$defs/exactArtifact"
        },
        {
          "properties": {
            "artifact_ref": {
              "pattern": "^cache://runtime-connection-contexts/sha256-[0-9a-f]{64}/credential-runtime[.]json$"
            }
          }
        }
      ]
    },
    "workload_pack": {
      "$ref": "#/$defs/workloadPack"
    },
    "execution": {
      "type": "object",
      "required": [
        "kind",
        "selector",
        "hook_name"
      ],
      "additionalProperties": false,
      "properties": {
        "kind": {
          "enum": [
            "runtime",
            "pre_hook"
          ]
        },
        "selector": {
          "type": "string",
          "pattern": "^[A-Za-z0-9_.:-]{1,256}$",
          "maxLength": 256
        },
        "hook_name": {
          "anyOf": [
            {
              "type": "string",
              "pattern": "^[A-Za-z0-9_.:-]{1,256}$",
              "maxLength": 256
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "allOf": [
        {
          "if": {
            "properties": {
              "kind": {
                "const": "runtime"
              }
            },
            "required": [
              "kind"
            ]
          },
          "then": {
            "properties": {
              "hook_name": {
                "type": "null"
              }
            }
          }
        },
        {
          "if": {
            "properties": {
              "kind": {
                "const": "pre_hook"
              }
            },
            "required": [
              "kind"
            ]
          },
          "then": {
            "properties": {
              "hook_name": {
                "type": "string",
                "pattern": "^[A-Za-z0-9_.:-]{1,256}$",
                "maxLength": 256
              }
            }
          }
        }
      ]
    },
    "verify": {
      "type": "object",
      "required": [
        "checksums",
        "attestations"
      ],
      "additionalProperties": false,
      "properties": {
        "checksums": {
          "const": "required"
        },
        "attestations": {
          "enum": [
            "optional",
            "required_for_prod"
          ]
        }
      }
    }
  },
  "$defs": {
    "sha256": {
      "type": "string",
      "pattern": "^sha256:[0-9a-f]{64}$"
    },
    "exactArtifact": {
      "type": "object",
      "required": [
        "artifact_ref",
        "sha256",
        "bytes"
      ],
      "additionalProperties": false,
      "properties": {
        "artifact_ref": {
          "type": "string",
          "pattern": "^cache://(?!(?:[^/\\\\\\s?#%]+/)*(?:[Cc][Uu][Rr][Rr][Ee][Nn][Tt]|[Ll][Aa][Tt][Ee][Ss][Tt])(?:/|$))(?!(?:[^/\\\\\\s?#%]+/)*(?:\\.|\\.\\.)(?:/|$))[^/\\\\\\s?#%]+(?:/[^/\\\\\\s?#%]+)*$"
        },
        "sha256": {
          "$ref": "#/$defs/sha256"
        },
        "bytes": {
          "type": "integer",
          "minimum": 1
        }
      }
    },
    "workloadPack": {
      "type": "object",
      "required": [
        "id",
        "artifact_ref",
        "sha256",
        "bytes",
        "pack_fingerprint"
      ],
      "additionalProperties": false,
      "properties": {
        "id": {
          "type": "string",
          "pattern": "^[A-Za-z0-9_.:-]{1,256}$",
          "maxLength": 256
        },
        "artifact_ref": {
          "type": "string",
          "pattern": "^cache://(?!(?:[^/\\\\\\s?#%]+/)*(?:[Cc][Uu][Rr][Rr][Ee][Nn][Tt]|[Ll][Aa][Tt][Ee][Ss][Tt])(?:/|$))(?!(?:[^/\\\\\\s?#%]+/)*(?:\\.|\\.\\.)(?:/|$))[^/\\\\\\s?#%]+(?:/[^/\\\\\\s?#%]+)*$"
        },
        "sha256": {
          "$ref": "#/$defs/sha256"
        },
        "bytes": {
          "type": "integer",
          "minimum": 1
        },
        "pack_fingerprint": {
          "$ref": "#/$defs/sha256"
        }
      }
    }
  },
  "allOf": [
    {
      "if": {
        "properties": {
          "trust_tier": {
            "const": "production"
          }
        },
        "required": [
          "trust_tier"
        ]
      },
      "then": {
        "properties": {
          "trust_policy": {
            "not": {
              "type": "null"
            }
          },
          "verify": {
            "properties": {
              "attestations": {
                "const": "required_for_prod"
              }
            }
          }
        }
      }
    }
  ]
}