stages:
  - release-gates

default:
  image: node:20.20.1-bookworm
  interruptible: true

variables:
  GIT_SUBMODULE_STRATEGY: recursive
  SOURCE_DATE_EPOCH: "0"
  FOUNDRY_VERSION: "v1.3.1"
  FOUNDRY_FUZZ_RUNS: "1000"
  PIP_DISABLE_PIP_VERSION_CHECK: "1"

.release-gate-environment:
  before_script:
    - apt-get update
    - apt-get install --yes --no-install-recommends ca-certificates curl git python3-pip
    - python3 -m pip install --break-system-packages "slither-analyzer==0.11.6"
    - curl --fail --location --silent --show-error "https://github.com/foundry-rs/foundry/releases/download/${FOUNDRY_VERSION}/foundry_${FOUNDRY_VERSION}_linux_amd64.tar.gz" -o /tmp/foundry.tar.gz
    - tar -xzf /tmp/foundry.tar.gz -C /usr/local/bin forge cast anvil chisel
    - forge --version
    - slither --version

release-gates:
  stage: release-gates
  extends: .release-gate-environment
  script:
    - ci/release-gates.sh
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH'

# Fork checks are deliberately not part of the ordinary pipeline. They require
# a protected RPC credential and must be explicitly requested. When requested,
# the script fails closed if BASE_RPC_URL is missing or the fork test suite is
# absent; a skipped job is never reported as a successful fork test.
fork-release-gates:
  stage: release-gates
  extends: .release-gate-environment
  script:
    - ci/release-gates.sh --fork
  rules:
    - if: '$RUN_FORK_TESTS == "1"'
      when: manual
      allow_failure: false
    - when: never
