version: 2.1

parameters:
  min_rust_version:
    type: string
    default: "1.88"

orbs:
  toolkit: jerus-org/circleci-toolkit@4.9.6

workflows:
  validation:
    jobs:
      - toolkit/verify_commit_signatures:
          name: verify_commit_signatures_trusted
          context: bot-check
          post_comment: true
          update_pcu: false
          filters:
            branches:
              ignore:
                - main
                - /pull\/[0-9]+/

      - toolkit/verify_commit_signatures:
          name: verify_commit_signatures_forked
          post_comment: false
          update_pcu: false
          filters:
            branches:
              only:
                - /pull\/[0-9]+/

      - toolkit/required_builds_rolling:
          min_rust_version: << pipeline.parameters.min_rust_version >>

      - toolkit/optional_builds:
          min_rust_version: << pipeline.parameters.min_rust_version >>
          filters:
            branches:
              ignore: main

      - toolkit/test_doc_build:
          min_rust_version: << pipeline.parameters.min_rust_version >>
          filters:
            branches:
              ignore: main

      - toolkit/idiomatic_rust:
          min_rust_version: << pipeline.parameters.min_rust_version >>
          filters:
            branches:
              ignore: main

      - toolkit/common_tests_rolling:
          min_rust_version: << pipeline.parameters.min_rust_version >>

      - toolkit/security:
          name: security audit only
          sonarcloud: false
          # RUSTSEC-2025-0066: google-apis-common unmaintained — core transitive
          # dependency of google-gmail1; no maintained Gmail API alternative exists.
          ignore_advisories: RUSTSEC-2025-0066
          filters:
            branches:
              only:
                - main
                - /pull\/[0-9]+/

      - toolkit/security:
          name: security with sonarcloud
          context: SonarCloud
          # RUSTSEC-2025-0066: google-apis-common unmaintained — core transitive
          # dependency of google-gmail1; no maintained Gmail API alternative exists.
          ignore_advisories: RUSTSEC-2025-0066
          filters:
            branches:
              ignore:
                - /pull\/[0-9]+/
                - main

      - toolkit/code_coverage:
          min_rust_version: << pipeline.parameters.min_rust_version >>
          package: cull-gmail
          context: SonarCloud
          filters:
            branches:
              ignore:
                - /pull\/[0-9]+/
                - main