chore(ci): harden github actions #34

	name: CI

	"on":
	merge_group: {}
	push:
	branches:
	- stable
	- main

	permissions:
	contents: read

	concurrency:
	group: "push-${{ github.ref }}"

	jobs:
	##
	## Job: Multi-platform Build
	##
	build:
	name: "Build"
	uses: ./.github/workflows/job.build.yml
	secrets: inherit
	permissions:
	actions: "read"
	contents: "write"
	id-token: "write"
	checks: "write"
	packages: "write"
	pull-requests: "write"
	deployments: "write"
	statuses: "write"
	security-events: "write"
	with:
	provenance: true

	##
	## Job: Multi-platform Test
	##
	test:
	name: "Build"
	uses: ./.github/workflows/job.test.yml
	secrets: inherit
	permissions:
	actions: "read"
	contents: "write"
	id-token: "write"
	checks: "write"
	packages: "write"
	pull-requests: "write"
	deployments: "write"
	statuses: "write"
	security-events: "write"

	##
	## Job: Checks for Models
	##
	publish-model:
	name: "Publish"
	uses: ./.github/workflows/job.deploy-model.yml
	secrets:
	BUF_TOKEN: ${{ secrets.BUF_TOKEN }}
	permissions:
	contents: "read"

	##
	## Job: Check for Wrapper
	##
	check-wrapper:
	name: "Checks"
	uses: ./.github/workflows/checks.gradle-wrapper.yml
	permissions:
	contents: "read"

	##
	## Job: Checks with Sonar
	##
	check-sonar:
	name: "Checks"
	uses: ./.github/workflows/checks.sonar.yml
	needs: [build]
	secrets:
	SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
	BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
	permissions:
	contents: "read"

	##
	## Job: Checks with CodeQL
	##
	check-codeql:
	name: "Checks"
	uses: ./.github/workflows/checks.codeql.yml
	needs: [build]
	secrets:
	BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
	permissions:
	actions: "read"
	contents: "read"
	security-events: "write"

Provide feedback