on.push.yml

name: CI

"on":
  merge_group: {}
  push:
    branches:
      - stable
      - main

permissions:
  contents: read

concurrency:
  group: "push-${{ github.ref }}"

jobs:
  ##
  ## Job: Multi-platform Build
  ##
  build:
    name: "Build"
    uses: ./.github/workflows/job.build.yml
    secrets: inherit
    permissions:
      actions: "read"
      contents: "write"
      id-token: "write"
      checks: "write"
      packages: "write"
      pull-requests: "write"
      deployments: "write"
      statuses: "write"
      security-events: "write"
    with:
      provenance: true

  ##
  ## Job: Multi-platform Test
  ##
  test:
    name: "Build"
    uses: ./.github/workflows/job.test.yml
    secrets: inherit
    permissions:
      actions: "read"
      contents: "write"
      id-token: "write"
      checks: "write"
      packages: "write"
      pull-requests: "write"
      deployments: "write"
      statuses: "write"
      security-events: "write"

  ##
  ## Job: Checks for Models
  ##
  publish-model:
    name: "Publish"
    uses: ./.github/workflows/job.deploy-model.yml
    secrets:
      BUF_TOKEN: ${{ secrets.BUF_TOKEN }}
    permissions:
      contents: "read"

  ##
  ## Job: Check for Wrapper
  ##
  check-wrapper:
    name: "Checks"
    uses: ./.github/workflows/checks.gradle-wrapper.yml
    permissions:
      contents: "read"

  ##
  ## Job: Checks with Sonar
  ##
  check-sonar:
    name: "Checks"
    uses: ./.github/workflows/checks.sonar.yml
    needs: [build]
    secrets:
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
    permissions:
      contents: "read"

  ##
  ## Job: Checks with CodeQL
  ##
  check-codeql:
    name: "Checks"
    uses: ./.github/workflows/checks.codeql.yml
    needs: [build]
    secrets:
      BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
    permissions:
      actions: "read"
      contents: "read"
      security-events: "write"