# Current repository CI controls. This file lists only mechanisms and jobs that exist in this
# checkout. Build/release supply-chain, image, signing, provenance, SBOM, and tag-release jobs are
# intentionally absent until their later bounded reconstruction.
#
# Fields:
#   release_blocking: true, false, or conditional
#   mechanism: gradle-custom-task, gradle-plugin-task, contract-test, workflow-job,
#              or delegated-pending
#   ref: task, plugin@task, repository-relative test path below src/, or workflow job id
#   workflow/job: canonical workflow and job that execute or represent the control
#   execution: check (through Gradle check), explicit (named in the job), or job
gates:
  - id: format-lint
    release_blocking: true
    mechanism: gradle-plugin-task
    ref: com.diffplug.spotless@spotlessCheck
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: unit-and-contract-tests
    release_blocking: true
    mechanism: gradle-plugin-task
    ref: java@test
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: clean-architecture-dependencies
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyCleanArchitectureDependencies
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: environment-contract
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyEnvKeys
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: one-type-per-file
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyOneTypePerFile
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: readme-command-drift
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyReadmeCommands
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: trivy-suppression-governance
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyTrivyignore
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: quarantine-sunset
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyQuarantineSunset
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: public-path-snapshot
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyPublicPathSnapshot
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: explicit
  - id: dependency-locks
    release_blocking: true
    mechanism: gradle-custom-task
    ref: verifyDependencyLocks
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: explicit
  - id: architecture-contract-test
    release_blocking: true
    mechanism: contract-test
    ref: app-bootstrap/src/test/java/dev/caskeleton/bootstrap/architecture/CleanArchitectureTest.java
    workflow: ci-quality-gates.yml
    job: quality-gates
    execution: check
  - id: sample-off
    release_blocking: true
    mechanism: gradle-custom-task
    ref: sampleOffTest
    workflow: ci-quality-gates.yml
    job: sample-off
    execution: explicit
  - id: gate-matrix-lint
    release_blocking: true
    mechanism: workflow-job
    ref: gate-matrix-lint
    workflow: ci-quality-gates.yml
    job: gate-matrix-lint
    execution: job
  - id: redis-standalone
    release_blocking: true
    mechanism: workflow-job
    ref: redis-standalone
    workflow: ci-quality-gates.yml
    job: redis-standalone
    execution: job
  - id: quality-release-gate
    release_blocking: true
    mechanism: workflow-job
    ref: release-gate
    workflow: ci-quality-gates.yml
    job: release-gate
    execution: job
  - id: flaky-quarantine
    release_blocking: false
    mechanism: workflow-job
    ref: quarantine
    workflow: ci-quality-gates.yml
    job: quarantine
    execution: job
  - id: dependency-review
    release_blocking: conditional
    mechanism: workflow-job
    ref: dependency-review
    workflow: dependency-vulnerability.yml
    job: dependency-review
    execution: job
  - id: dependency-submission
    release_blocking: false
    mechanism: workflow-job
    ref: dependency-submission
    workflow: dependency-vulnerability.yml
    job: dependency-submission
    execution: job
  - id: filesystem-vulnerability-scan
    release_blocking: true
    mechanism: workflow-job
    ref: trivy-fs
    workflow: dependency-vulnerability.yml
    job: trivy-fs
    execution: job
  - id: documentation-links
    release_blocking: conditional
    mechanism: workflow-job
    ref: lychee
    workflow: link-check.yml
    job: lychee
    execution: job