/**
 * A `permissions`/`secrets` declaration: GitHub allows either a map of scopes
 * or a bare scalar (`write-all`, `read-all`, `inherit`); `null` means the block
 * was not declared at all, which is itself load-bearing evidence.
 */
export type WorkflowBlock = Record<string, unknown> | string | null;
/**
 * A workflow's `on:` trigger block, normalized across its three legal spellings
 * (scalar, list, map). The trigger is load-bearing for readiness: it decides
 * whether the *absence* of an in-file validating job proves a bypass or merely
 * means the proof lives somewhere this parser cannot see.
 */
export interface ParsedWorkflowTrigger {
    /** Declared event names, e.g. `push`, `workflow_call`, `workflow_run`. */
    readonly events: readonly string[];
    /** Branch filters on a `push` trigger (empty when unfiltered or absent). */
    readonly pushBranches: readonly string[];
    /** Tag filters on a `push` trigger (empty when unfiltered or absent). */
    readonly pushTags: readonly string[];
}
/** One step inside a parsed workflow job. */
export interface ParsedWorkflowStep {
    readonly name: string;
    /** The shell command the step runs, or `""` for an action step. */
    readonly run: string;
    /** The action the step uses, or `""` for a `run` step. */
    readonly uses: string;
    /** Raw serialized step-level `env` text, used for target evidence. */
    readonly env: string;
    /** Raw serialized `env` + `with` text, used for credential evidence. */
    readonly inputs: string;
    /**
     * The step's `if:` condition, or `""` when it always runs. Load-bearing for
     * the B1/B4 producers: a conditional step is a step somebody deliberately
     * gated, which is exactly what those blockers ask about.
     */
    readonly ifCondition: string;
}
/** One job inside a parsed workflow. */
export interface ParsedWorkflowJob {
    readonly id: string;
    /** Repo-relative path of the workflow file declaring this job. */
    readonly workflow: string;
    readonly needs: readonly string[];
    readonly steps: readonly ParsedWorkflowStep[];
    /** The reusable workflow this job calls, or `""` when it runs steps. */
    readonly uses: string;
    /** Job-level `permissions`: a map, a scalar such as `write-all`, or null. */
    readonly permissions: WorkflowBlock;
    /** Job-level `secrets`: a map, the scalar `inherit`, or null. */
    readonly secrets: WorkflowBlock;
    /** Declared deployment environments (a scalar or list, normalized). */
    readonly environment: readonly string[];
    /** The job's `if:` condition, or `""` when it always runs. */
    readonly ifCondition: string;
    /**
     * The job-level `env:` block, flattened to `key: value` lines. The B1
     * producer resolves a command's target through it: `psql "$DATABASE_URL"`
     * says nothing on its own, while the `DATABASE_URL` it expands to may name
     * `127.0.0.1` and settle the question.
     */
    readonly env: string;
    /**
     * The job-level `with:` block for reusable workflow calls, flattened to
     * `key: value` lines. Reusable calls often map deployment credentials here
     * rather than inside ordinary step inputs.
     */
    readonly inputs: string;
    /**
     * Ids of the `services:` containers the job starts. A job that boots its own
     * database is operating on throwaway state by construction.
     */
    readonly services: readonly string[];
}
/** One parsed `.github/workflows/*.yml` file. */
export interface ParsedWorkflow {
    /** Repo-relative path, always with forward slashes. */
    readonly file: string;
    readonly name: string;
    /** Workflow-level `permissions`: a map, a scalar, or null. */
    readonly permissions: WorkflowBlock;
    /** The normalized `on:` trigger block. */
    readonly on: ParsedWorkflowTrigger;
    readonly jobs: readonly ParsedWorkflowJob[];
}
/**
 * Read and parse every `.github/workflows/*.yml` file in a repository, offline.
 * @param root - Repository root
 * @returns Parsed workflows in stable file-name order (empty when there are none)
 */
export declare function parseRepositoryWorkflows(root: string): Promise<readonly ParsedWorkflow[]>;
//# sourceMappingURL=doctor-readiness-workflows.d.ts.map