{
	"$schema": "https://json-schema.org/draft/2020-12/schema",
	"$id": "https://reckon.dev/schemas/release-attestation-v1.schema.json",
	"title": "Reckon Graph release attestation",
	"type": "object",
	"additionalProperties": false,
	"required": [
		"schemaVersion",
		"status",
		"version",
		"tag",
		"sourceCommit",
		"generatedAt",
		"build",
		"artifact",
		"provenance",
		"sbom",
		"channels",
		"rollback",
		"failures"
	],
	"properties": {
		"schemaVersion": { "const": 1 },
		"status": { "enum": ["verified", "incomplete", "quarantined"] },
		"version": { "$ref": "#/$defs/semver" },
		"tag": { "type": "string", "pattern": "^v[0-9]", "maxLength": 129 },
		"sourceCommit": { "$ref": "#/$defs/commit" },
		"generatedAt": { "$ref": "#/$defs/instant" },
		"build": { "$ref": "#/$defs/build" },
		"artifact": { "$ref": "#/$defs/artifact" },
		"provenance": { "$ref": "#/$defs/provenance" },
		"sbom": { "$ref": "#/$defs/sbom" },
		"channels": {
			"type": "object",
			"additionalProperties": false,
			"required": ["public-npm", "docusign-artifactory", "github-saas", "homebrew", "ghes"],
			"properties": {
				"public-npm": { "$ref": "#/$defs/channel" },
				"docusign-artifactory": { "$ref": "#/$defs/channel" },
				"github-saas": { "$ref": "#/$defs/channel" },
				"homebrew": { "$ref": "#/$defs/channel" },
				"ghes": { "$ref": "#/$defs/channel" }
			}
		},
		"rollback": {
			"type": "object",
			"additionalProperties": false,
			"required": ["version", "targetPath", "artifactSha256"],
			"properties": {
				"version": { "$ref": "#/$defs/semver" },
				"targetPath": { "$ref": "#/$defs/file" },
				"artifactSha256": { "$ref": "#/$defs/sha256" }
			}
		},
		"failures": {
			"type": "array",
			"maxItems": 100,
			"items": { "type": "string", "minLength": 1, "maxLength": 512 }
		}
	},
	"$defs": {
		"semver": {
			"type": "string",
			"maxLength": 128,
			"pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$"
		},
		"commit": {
			"type": "string",
			"pattern": "^(?:[a-f0-9]{40}|[a-f0-9]{64})$"
		},
		"instant": {
			"type": "string",
			"maxLength": 64,
			"pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\\.[0-9]{3}Z$"
		},
		"sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
		"sha512": { "type": "string", "pattern": "^[a-f0-9]{128}$" },
		"file": {
			"type": "string",
			"minLength": 1,
			"maxLength": 256,
			"pattern": "^[A-Za-z0-9][A-Za-z0-9._+-]{0,255}$"
		},
		"https": {
			"type": "string",
			"minLength": 1,
			"maxLength": 2048,
			"pattern": "^https://"
		},
		"build": {
			"type": "object",
			"additionalProperties": false,
			"required": ["repository", "workflow", "workflowRef", "runId", "runAttempt"],
			"properties": {
				"repository": {
					"type": "string",
					"pattern": "^[A-Za-z0-9_.-]{1,100}/[A-Za-z0-9_.-]{1,100}$"
				},
				"workflow": {
					"type": "string",
					"pattern": "^\\.github/workflows/[A-Za-z0-9][A-Za-z0-9._-]{0,127}\\.ya?ml$"
				},
				"workflowRef": { "type": "string", "pattern": "^refs/tags/v", "maxLength": 256 },
				"runId": { "type": "string", "pattern": "^[0-9]{1,32}$" },
				"runAttempt": { "type": "integer", "minimum": 1, "maximum": 1000 }
			}
		},
		"artifact": {
			"type": "object",
			"additionalProperties": false,
			"required": ["name", "length", "sha256", "sha512", "npmIntegrity"],
			"properties": {
				"name": { "$ref": "#/$defs/file" },
				"length": { "type": "integer", "minimum": 1, "maximum": 536870912 },
				"sha256": { "$ref": "#/$defs/sha256" },
				"sha512": { "$ref": "#/$defs/sha512" },
				"npmIntegrity": { "type": "string", "pattern": "^sha512-[A-Za-z0-9+/]+={0,2}$" }
			}
		},
		"verification": {
			"type": "object",
			"additionalProperties": false,
			"required": [
				"verified",
				"attestationId",
				"attestationUrl",
				"issuer",
				"identity",
				"verifiedAt"
			],
			"properties": {
				"verified": { "type": "boolean" },
				"attestationId": { "type": "string", "minLength": 1, "maxLength": 256 },
				"attestationUrl": { "$ref": "#/$defs/https" },
				"issuer": { "const": "https://token.actions.githubusercontent.com" },
				"identity": { "$ref": "#/$defs/https" },
				"verifiedAt": { "$ref": "#/$defs/instant" }
			}
		},
		"provenance": {
			"type": "object",
			"additionalProperties": false,
			"required": ["path", "length", "sha256", "verification"],
			"properties": {
				"path": { "$ref": "#/$defs/file" },
				"length": { "type": "integer", "minimum": 1, "maximum": 16777216 },
				"sha256": { "$ref": "#/$defs/sha256" },
				"verification": { "$ref": "#/$defs/verification" }
			}
		},
		"sbom": {
			"type": "object",
			"additionalProperties": false,
			"required": [
				"format",
				"specVersion",
				"path",
				"length",
				"sha256",
				"attestationPath",
				"attestationLength",
				"attestationSha256",
				"verification"
			],
			"properties": {
				"format": { "const": "CycloneDX" },
				"specVersion": { "type": "string", "minLength": 1, "maxLength": 16 },
				"path": { "$ref": "#/$defs/file" },
				"length": { "type": "integer", "minimum": 1, "maximum": 16777216 },
				"sha256": { "$ref": "#/$defs/sha256" },
				"attestationPath": { "$ref": "#/$defs/file" },
				"attestationLength": { "type": "integer", "minimum": 1, "maximum": 16777216 },
				"attestationSha256": { "$ref": "#/$defs/sha256" },
				"verification": { "$ref": "#/$defs/verification" }
			}
		},
		"channel": {
			"oneOf": [
				{
					"type": "object",
					"additionalProperties": false,
					"required": ["status"],
					"properties": { "status": { "const": "missing" } }
				},
				{
					"type": "object",
					"additionalProperties": false,
					"required": [
						"status",
						"artifactLength",
						"artifactSha256",
						"version",
						"sourceCommit",
						"publishedAt",
						"location"
					],
					"properties": {
						"status": { "enum": ["verified", "mismatch"] },
						"artifactLength": { "type": "integer", "minimum": 1, "maximum": 536870912 },
						"artifactSha256": { "$ref": "#/$defs/sha256" },
						"version": { "$ref": "#/$defs/semver" },
						"sourceCommit": { "$ref": "#/$defs/commit" },
						"publishedAt": { "$ref": "#/$defs/instant" },
						"location": { "$ref": "#/$defs/https" }
					}
				}
			]
		}
	}
}