on.push.yml

#
# Copyright (c) 2024 Elide Technologies, Inc.
#
# Licensed under the MIT license (the "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# https://opensource.org/license/mit/
#
# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
# an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations under the License.
#

name: CI

"on":
  merge_group: {}
  push:
    branches:
      - stable
      - main

permissions:
  contents: read

concurrency:
  group: "push-${{ github.ref }}"

jobs:
  ##
  ## Job: Multi-platform Build
  ##
  build:
    name: "Build"
    uses: ./.github/workflows/job.build.yml
    secrets: inherit
    permissions:
      actions: "read"
      checks: "write"
      contents: "write"
      id-token: "write"
      packages: "read"
      pull-requests: "write"
      security-events: "write"
    with:
      provenance: true

  ##
  ## Job: Multi-platform Test
  ##
  test:
    name: "Build"
    uses: ./.github/workflows/job.test.yml
    secrets: inherit
    permissions:
      checks: "write"
      contents: "read"
      id-token: "write"
      packages: "read"
      pull-requests: "write"

  ##
  ## Job: Checks for Models
  ##
  publish-model:
    name: "Publish"
    uses: ./.github/workflows/job.deploy-model.yml
    secrets:
      BUF_TOKEN: ${{ secrets.BUF_TOKEN }}
    permissions:
      contents: "read"

  ##
  ## Job: Checks with Scorecard
  ##
  check-scorecard:
    name: "Checks"
    uses: ./.github/workflows/checks.scorecards.yml
    permissions:
      actions: "read"
      contents: "read"
      checks: "read"
      deployments: "read"
      discussions: "read"
      id-token: "write"
      issues: "read"
      packages: "read"
      pages: "read"
      pull-requests: "read"
      repository-projects: "read"
      security-events: "write"
      statuses: "read"

  ##
  ## Job: Check for Wrapper
  ##
  check-wrapper:
    name: "Checks"
    uses: ./.github/workflows/checks.gradle-wrapper.yml
    permissions:
      contents: "read"

  ##
  ## Job: Checks with Sonar
  ##
  check-sonar:
    name: "Checks"
    uses: ./.github/workflows/checks.sonar.yml
    needs: [build]
    secrets:
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
    permissions:
      contents: "read"

  ##
  ## Job: Checks with CodeQL
  ##
  check-codeql:
    name: "Checks"
    uses: ./.github/workflows/checks.codeql.yml
    needs: [build]
    secrets:
      BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
    permissions:
      actions: "read"
      contents: "read"
      security-events: "write"