feat: support cue exp gengotypes

.github/workflows/ci.yml

@@ -8,22 +8,17 @@ permissions:
   contents: read
 
 jobs:
-  main:
-    name: Validate Template with Schema
+  ci:
+    name: CI checks
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4.2.2
 
       - name: Setup Cue
         uses: cue-lang/setup-cue@v1.0.0
-        with:
-          cue-version: 0.11.0
-
-      - name: Validate our security-insights.yml
-        run: cue vet .github/security-insights.yml schema.cue
 
-      - name: Validate template-full.yml
-        run: cue vet template-full.yml schema.cue
+      - name: Validate schema.cue
+        run: make lintcue
 
-      - name: Validate template-minimum.yml
-        run: cue vet template-minimum.yml schema.cue
+      - name: Validate example files against schema
+        run: make lintyml

.gitignore

@@ -0,0 +1 @@
+cue_types_gen.go

Makefile

@@ -0,0 +1,22 @@
+lintcue:
+	@echo "  >  Linting CUE schema ..."
+	@cue eval schema.cue --all-errors --verbose
+
+lintyml:
+	@echo "  >  Linting YAML files ..."
+	@echo "  >  Linting .github/security-insights.yml ..."
+	@cue vet .github/security-insights.yml schema.cue
+	@echo "  >  Linting template-full.yml ..."
+	cue vet template-full.yml schema.cue
+	@echo "  >  Linting template-minimum.yml ..."
+	cue vet template-minimum.yml schema.cue
+	@echo "  >  Linting template-multi-repository-project-reuse.yml ..."
+	cue vet template-multi-repository-project-reuse.yml schema.cue
+	@echo "  >  Linting template-multi-repository-project.yml ..."
+	cue vet template-multi-repository-project.yml schema.cue
+
+cuegen:
+	@echo "  >  Generating types from cue schema ..."
+	@cue exp gengotypes schema.cue
+
+PHONY: lintcue lintyml cuegen

docs/versioning-policy.md

@@ -16,6 +16,8 @@ The Security Insights Specification uses a semantic versioning (SemVer) scheme t
 
 ## 3. Version Release Process
 
+Whenever a new version of the specification is released, a new version of the ossf/si-tooling project should also be released.
+
 ### 3.1. Major Releases
 
 A major release (e.g., from `1.X.X` to `2.X.X`) signifies significant changes that may require a substantial update to the Security Insights specification. Major releases may include: