{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://paulkov.github.io/dpone/schemas/gitops/deployment-set-v2.schema.json",
  "title": "dpone GitOps executable deployment-set v2",
  "type": "object",
  "required": [
    "schema",
    "deployment_id",
    "deployment_type",
    "runnable",
    "environment",
    "trust_tier",
    "release_ref",
    "binding_set_ref",
    "connection_registry_ref",
    "credential_runtime_ref",
    "binding_set",
    "connection_registry",
    "credential_runtime",
    "runtime_image_ref",
    "runtime_image_digest",
    "airflow_bundle_ref",
    "runtime_artifact_delivery",
    "workloads"
  ],
  "additionalProperties": false,
  "properties": {
    "schema": {
      "const": "dpone.deployment-set.v2"
    },
    "deployment_id": {
      "$ref": "#/$defs/identity"
    },
    "deployment_type": {
      "const": "environment"
    },
    "runnable": {
      "const": true
    },
    "environment": {
      "type": "string",
      "minLength": 1
    },
    "trust_tier": {
      "enum": [
        "production",
        "non_production"
      ]
    },
    "release_ref": {
      "$ref": "#/$defs/identity"
    },
    "binding_set_ref": {
      "$ref": "#/$defs/identity"
    },
    "connection_registry_ref": {
      "$ref": "#/$defs/identity"
    },
    "credential_runtime_ref": {
      "$ref": "#/$defs/identity"
    },
    "binding_set": {
      "allOf": [
        {
          "$ref": "#/$defs/exactArtifact"
        },
        {
          "properties": {
            "artifact_ref": {
              "pattern": "^cache://runtime-connection-contexts/sha256-[0-9a-f]{64}/binding-set[.]json$"
            }
          }
        }
      ]
    },
    "connection_registry": {
      "allOf": [
        {
          "$ref": "#/$defs/exactArtifact"
        },
        {
          "properties": {
            "artifact_ref": {
              "pattern": "^cache://runtime-connection-contexts/sha256-[0-9a-f]{64}/connection-registry[.]json$"
            }
          }
        }
      ]
    },
    "credential_runtime": {
      "allOf": [
        {
          "$ref": "#/$defs/exactArtifact"
        },
        {
          "properties": {
            "artifact_ref": {
              "pattern": "^cache://runtime-connection-contexts/sha256-[0-9a-f]{64}/credential-runtime[.]json$"
            }
          }
        }
      ]
    },
    "runtime_image_ref": {
      "type": "string",
      "pattern": "^(?!.*(?:\\s|://|\\?|#|=))[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?::(?!0+/)(?:[0-9]{1,4}|[0-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?/[a-z0-9]+(?:[._/-][a-z0-9]+)*@sha256:[0-9a-f]{64}$"
    },
    "runtime_image_digest": {
      "$ref": "#/$defs/identity"
    },
    "airflow_bundle_ref": {
      "type": [
        "string",
        "null"
      ]
    },
    "runtime_artifact_delivery": {
      "type": "object",
      "required": [
        "mode",
        "trust_tier",
        "artifact_registry_ref",
        "identity",
        "registry_config_ref",
        "source",
        "verify"
      ],
      "additionalProperties": false,
      "properties": {
        "mode": {
          "const": "init_fetch"
        },
        "trust_tier": {
          "enum": [
            "production",
            "non_production"
          ]
        },
        "artifact_registry_ref": {
          "type": "string",
          "pattern": "^(?=.{1,128}$)(?!(?:[Cc][Uu][Rr][Rr][Ee][Nn][Tt]|[Ll][Aa][Tt][Ee][Ss][Tt])$)(?!(?:sk_(?:live|test|prod)_[A-Za-z0-9_-]{8,}|sk-(?:proj|svcacct)-[A-Za-z0-9_-]{8,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{16,})$)[A-Za-z0-9][A-Za-z0-9_.-]*$",
          "maxLength": 128
        },
        "identity": {
          "type": "object",
          "required": [
            "method",
            "service_account",
            "namespace"
          ],
          "additionalProperties": false,
          "properties": {
            "method": {
              "enum": [
                "kubernetes_workload_identity"
              ]
            },
            "service_account": {
              "type": "string",
              "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
              "maxLength": 63
            },
            "namespace": {
              "type": "string",
              "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
              "maxLength": 63
            }
          }
        },
        "registry_config_ref": {
          "type": "object",
          "required": [
            "kind",
            "name",
            "key",
            "sha256"
          ],
          "additionalProperties": false,
          "properties": {
            "kind": {
              "const": "kubernetes_config_map"
            },
            "name": {
              "type": "string",
              "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
              "maxLength": 63
            },
            "key": {
              "type": "string",
              "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,252}$",
              "maxLength": 253
            },
            "sha256": {
              "type": "string",
              "pattern": "^sha256:[0-9a-f]{64}$"
            }
          }
        },
        "source": {
          "type": "object",
          "required": [
            "artifact_registry_ref"
          ],
          "additionalProperties": false,
          "properties": {
            "artifact_registry_ref": {
              "type": "string",
              "pattern": "^(?=.{1,128}$)(?!(?:[Cc][Uu][Rr][Rr][Ee][Nn][Tt]|[Ll][Aa][Tt][Ee][Ss][Tt])$)(?!(?:sk_(?:live|test|prod)_[A-Za-z0-9_-]{8,}|sk-(?:proj|svcacct)-[A-Za-z0-9_-]{8,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{16,})$)[A-Za-z0-9][A-Za-z0-9_.-]*$",
              "maxLength": 128
            }
          }
        },
        "trust_policy_ref": {
          "type": "object",
          "required": [
            "kind",
            "name",
            "key",
            "sha256"
          ],
          "additionalProperties": false,
          "properties": {
            "kind": {
              "const": "kubernetes_config_map"
            },
            "name": {
              "type": "string",
              "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
              "maxLength": 63
            },
            "key": {
              "type": "string",
              "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,252}$",
              "maxLength": 253
            },
            "sha256": {
              "type": "string",
              "pattern": "^sha256:[0-9a-f]{64}$"
            }
          }
        },
        "verify": {
          "type": "object",
          "required": [
            "checksums",
            "attestations"
          ],
          "additionalProperties": false,
          "properties": {
            "checksums": {
              "enum": [
                "required"
              ]
            },
            "attestations": {
              "enum": [
                "optional",
                "required_for_prod"
              ]
            }
          }
        }
      },
      "allOf": [
        {
          "if": {
            "properties": {
              "trust_tier": {
                "const": "production"
              }
            },
            "required": [
              "trust_tier"
            ]
          },
          "then": {
            "properties": {
              "verify": {
                "properties": {
                  "attestations": {
                    "const": "required_for_prod"
                  }
                }
              }
            },
            "required": [
              "trust_policy_ref"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "trust_tier": {
                "const": "non_production"
              }
            },
            "required": [
              "trust_tier"
            ]
          },
          "then": {
            "properties": {
              "verify": {
                "properties": {
                  "attestations": {
                    "const": "optional"
                  }
                }
              }
            }
          }
        }
      ]
    },
    "workloads": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "object",
        "required": [
          "id",
          "sha256",
          "pack_fingerprint"
        ],
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string",
            "minLength": 1
          },
          "sha256": {
            "$ref": "#/$defs/identity"
          },
          "pack_fingerprint": {
            "$ref": "#/$defs/identity"
          }
        }
      }
    }
  },
  "$defs": {
    "identity": {
      "type": "string",
      "pattern": "^sha256:[0-9a-f]{64}$"
    },
    "sha256": {
      "type": "string",
      "pattern": "^sha256:[0-9a-f]{64}$"
    },
    "exactArtifact": {
      "type": "object",
      "required": [
        "artifact_ref",
        "sha256",
        "bytes"
      ],
      "additionalProperties": false,
      "properties": {
        "artifact_ref": {
          "type": "string",
          "pattern": "^cache://(?!(?:[Cc][Uu][Rr][Rr][Ee][Nn][Tt]|[Ll][Aa][Tt][Ee][Ss][Tt])(?:/|$))(?![^\\s]*/(?:[Cc][Uu][Rr][Rr][Ee][Nn][Tt]|[Ll][Aa][Tt][Ee][Ss][Tt])(?:/|$))[^\\s]+$"
        },
        "sha256": {
          "$ref": "#/$defs/sha256"
        },
        "bytes": {
          "type": "integer",
          "minimum": 1
        }
      }
    }
  },
  "allOf": [
    {
      "if": {
        "properties": {
          "trust_tier": {
            "const": "production"
          }
        },
        "required": [
          "trust_tier"
        ]
      },
      "then": {
        "properties": {
          "runtime_artifact_delivery": {
            "properties": {
              "trust_tier": {
                "const": "production"
              }
            }
          }
        }
      }
    },
    {
      "if": {
        "properties": {
          "trust_tier": {
            "const": "non_production"
          }
        },
        "required": [
          "trust_tier"
        ]
      },
      "then": {
        "properties": {
          "runtime_artifact_delivery": {
            "properties": {
              "trust_tier": {
                "const": "non_production"
              }
            }
          }
        }
      }
    }
  ]
}