schema.json

{
  "$schema": "https://json-schema.org/draft-07/schema",
  "additionalProperties": false,
  "definitions": {
    "rule": {
      "additionalProperties": false,
      "description": "Defines a single matching rule.",
      "oneOf": [
        {
          "not": {
            "required": ["anyOf", "match", "matchRegex", "not", "oneOf"]
          },
          "required": ["allOf"]
        },
        {
          "not": {
            "required": ["allOf", "match", "matchRegex", "not", "oneOf"]
          },
          "required": ["anyOf"]
        },
        {
          "not": {
            "required": ["allOf", "anyOf", "matchRegex", "not", "oneOf"]
          },
          "required": ["match"]
        },
        {
          "not": { "required": ["allOf", "anyOf", "match", "not", "oneOf"] },
          "required": ["matchRegex"]
        },
        {
          "not": {
            "required": ["allOf", "anyOf", "match", "matchRegex", "oneOf"]
          },
          "required": ["not"]
        },
        {
          "not": {
            "required": ["allOf", "anyOf", "match", "matchRegex", "not"]
          },
          "required": ["oneOf"]
        }
      ],
      "properties": {
        "allOf": {
          "$ref": "#/definitions/rules",
          "description": "Asserts that all of the nested rules match."
        },
        "description": {
          "description": "Rule description displayed as context to the user.",
          "type": "string"
        },
        "anyOf": {
          "$ref": "#/definitions/rules",
          "description": "Asserts that at least one of the nested rules matches."
        },
        "match": {
          "description": "Specifies a trust anchor that has to match exactly.",
          "type": "string"
        },
        "matchRegex": {
          "description": "Defines a regular expression to match trust anchors against.",
          "type": "string"
        },
        "not": {
          "$ref": "#/definitions/rule",
          "description": "Inverts the matching behaviour of a rule."
        },
        "oneOf": {
          "$ref": "#/definitions/rules",
          "description": "Asserts that exactly one of the nested rules matches."
        },
        "url": {
          "description": "URL to documentation of the rule.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "rules": {
      "items": {
        "$ref": "#/definitions/rule"
      },
      "type": "array"
    }
  },
  "description": "Schema of the sops-check configuration file",
  "properties": {
    "allowUnmatched": {
      "default": false,
      "description": "Allow SOPS files to contain trust anchors that are not matched by any rule.",
      "type": "boolean"
    },
    "rules": {
      "$ref": "#/definitions/rules",
      "description": "A list of matching rules."
    }
  },
  "title": "sops-check configuration",
  "type": "object"
}