{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://paulkov.github.io/dpone/schemas/gitops/safe-sample-execution-plan.schema.json",
  "title": "dpone GitOps safe sample execution plan",
  "type": "object",
  "required": [
    "schema",
    "sample_rows",
    "environment",
    "runnable",
    "policy_result",
    "artifact_pinning",
    "blockers"
  ],
  "additionalProperties": true,
  "properties": {
    "schema": {
      "const": "dpone.safe-sample-execution-plan.v1"
    },
    "sample_rows": {
      "type": "integer",
      "minimum": 0
    },
    "environment": {
      "type": "string",
      "minLength": 1
    },
    "runnable": {
      "type": "boolean"
    },
    "source_snapshot": {
      "type": [
        "object",
        "null"
      ],
      "required": [
        "pipeline_id",
        "path",
        "sha256"
      ],
      "additionalProperties": false,
      "properties": {
        "pipeline_id": {
          "type": "string",
          "pattern": "^[a-z0-9][a-z0-9_-]{1,127}$"
        },
        "path": {
          "type": "string",
          "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$))(?!.*\\\\)\\S+$"
        },
        "sha256": {
          "type": "string",
          "pattern": "^sha256:[0-9a-f]{64}$"
        }
      }
    },
    "policy_result": {
      "type": "object",
      "required": [
        "passed",
        "request",
        "policy",
        "capabilities",
        "errors"
      ],
      "additionalProperties": true,
      "properties": {
        "passed": {
          "type": "boolean"
        },
        "request": {
          "type": "object"
        },
        "policy": {
          "type": "object"
        },
        "capabilities": {
          "type": "object"
        },
        "errors": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/error"
          }
        }
      }
    },
    "temporary_target_plan": {
      "type": [
        "object",
        "null"
      ],
      "additionalProperties": true
    },
    "deployment_context": {
      "type": [
        "object",
        "null"
      ],
      "additionalProperties": true,
      "properties": {
        "schema": {
          "const": "dpone.safe-sample-airflow-deployment-context.v1"
        },
        "release_id": {
          "$ref": "#/$defs/sha256"
        },
        "deployment_id": {
          "$ref": "#/$defs/sha256"
        },
        "environment": {
          "type": [
            "string",
            "null"
          ]
        },
        "deployment_type": {
          "type": "string",
          "minLength": 1
        },
        "runnable": {
          "type": "boolean"
        },
        "runtime_artifact_delivery": {
          "type": "object",
          "additionalProperties": true,
          "properties": {
            "mode": {
              "enum": [
                "local_preview",
                "init_fetch",
                "shared_pvc",
                "embedded_bundle",
                "csi_volume",
                "inline"
              ]
            },
            "artifact_registry_ref": {
              "type": "string",
              "pattern": "^(?!.*%)(?!(?:[Cc][Uu][Rr][Rr][Ee][Nn][Tt]|[Ll][Aa][Tt][Ee][Ss][Tt])(?:$|[/:@?#=&]))(?!.*[/:@?#=&](?:[Cc][Uu][Rr][Rr][Ee][Nn][Tt]|[Ll][Aa][Tt][Ee][Ss][Tt])(?:$|[/:@?#=&]))\\S+$"
            },
            "identity": {
              "type": "object",
              "required": [
                "method",
                "service_account"
              ],
              "additionalProperties": true,
              "properties": {
                "method": {
                  "enum": [
                    "kubernetes_workload_identity"
                  ]
                },
                "service_account": {
                  "type": "string",
                  "minLength": 1
                }
              }
            },
            "source": {
              "type": "object",
              "required": [
                "artifact_registry_ref"
              ],
              "additionalProperties": true,
              "properties": {
                "artifact_registry_ref": {
                  "type": "string",
                  "pattern": "^(?!.*%)(?!(?:[Cc][Uu][Rr][Rr][Ee][Nn][Tt]|[Ll][Aa][Tt][Ee][Ss][Tt])(?:$|[/:@?#=&]))(?!.*[/:@?#=&](?:[Cc][Uu][Rr][Rr][Ee][Nn][Tt]|[Ll][Aa][Tt][Ee][Ss][Tt])(?:$|[/:@?#=&]))\\S+$"
                }
              }
            },
            "verify": {
              "type": "object",
              "required": [
                "checksums",
                "attestations"
              ],
              "additionalProperties": true,
              "properties": {
                "checksums": {
                  "enum": [
                    "required"
                  ]
                },
                "attestations": {
                  "enum": [
                    "optional",
                    "required_for_prod"
                  ]
                }
              }
            }
          },
          "allOf": [
            {
              "if": {
                "properties": {
                  "mode": {
                    "const": "init_fetch"
                  }
                },
                "required": [
                  "mode"
                ]
              },
              "then": {
                "required": [
                  "artifact_registry_ref",
                  "identity",
                  "source",
                  "verify"
                ]
              }
            }
          ],
          "required": [
            "mode"
          ]
        },
        "workload_packs": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/artifact"
          }
        },
        "binding_set_ref": {
          "anyOf": [
            {
              "$ref": "#/$defs/sha256"
            },
            {
              "type": "null"
            }
          ]
        },
        "connection_registry_ref": {
          "anyOf": [
            {
              "$ref": "#/$defs/sha256"
            },
            {
              "type": "null"
            }
          ]
        },
        "credential_runtime_ref": {
          "anyOf": [
            {
              "$ref": "#/$defs/sha256"
            },
            {
              "type": "null"
            }
          ]
        },
        "runtime_image_digest": {
          "anyOf": [
            {
              "$ref": "#/$defs/sha256"
            },
            {
              "type": "null"
            }
          ]
        },
        "airflow_bundle_ref": {
          "type": [
            "string",
            "null"
          ]
        },
        "index_path": {
          "type": "string",
          "minLength": 1
        },
        "deployment_path": {
          "type": [
            "string",
            "null"
          ]
        },
        "parse_side_effects": {
          "type": "object",
          "additionalProperties": {
            "type": "boolean"
          }
        }
      }
    },
    "artifact_pinning": {
      "type": [
        "object",
        "null"
      ],
      "additionalProperties": true,
      "properties": {
        "release_id": {
          "$ref": "#/$defs/sha256"
        },
        "deployment_id": {
          "$ref": "#/$defs/sha256"
        },
        "pinned_workload_uri": {
          "type": "string",
          "pattern": "^cached://deployments/sha256:[0-9a-f]{64}/workloads/[^\\s/?]+$"
        },
        "workload_packs": {
          "type": "array",
          "items": {
            "type": "object",
            "required": [
              "id",
              "sha256"
            ],
            "additionalProperties": true,
            "properties": {
              "id": {
                "type": "string"
              },
              "sha256": {
                "type": "string"
              }
            }
          }
        }
      }
    },
    "blockers": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/error"
      }
    }
  },
  "$defs": {
    "sha256": {
      "type": "string",
      "pattern": "^sha256:[0-9a-f]{64}$"
    },
    "artifact": {
      "type": "object",
      "required": [
        "id",
        "artifact_ref",
        "sha256",
        "bytes"
      ],
      "additionalProperties": true,
      "properties": {
        "id": {
          "type": "string",
          "minLength": 1
        },
        "artifact_ref": {
          "type": "string",
          "pattern": "^cache://(?!(?:[Cc][Uu][Rr][Rr][Ee][Nn][Tt]|[Ll][Aa][Tt][Ee][Ss][Tt])(?:/|$))(?![^\\s]*/(?:[Cc][Uu][Rr][Rr][Ee][Nn][Tt]|[Ll][Aa][Tt][Ee][Ss][Tt])(?:/|$))[^\\s]+$"
        },
        "sha256": {
          "$ref": "#/$defs/sha256"
        },
        "bytes": {
          "type": "integer",
          "minimum": 1
        }
      }
    },
    "error": {
      "type": "object",
      "required": [
        "schema",
        "code",
        "stage",
        "severity",
        "message"
      ],
      "additionalProperties": true,
      "properties": {
        "schema": {
          "const": "dpone.error.v1"
        },
        "code": {
          "type": "string",
          "pattern": "^DPONE_[A-Z0-9_]+$"
        },
        "stage": {
          "type": "string",
          "minLength": 1
        },
        "severity": {
          "enum": [
            "info",
            "warning",
            "error"
          ]
        },
        "message": {
          "type": "string",
          "minLength": 1
        },
        "fixes": {
          "type": "array"
        }
      }
    }
  }
}