-
Notifications
You must be signed in to change notification settings - Fork 1
84 lines (76 loc) · 1.7 KB
/
on.push.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
name: "CI"
on:
## Releases
release:
types:
- created
## CI
push:
branches:
- main
permissions:
actions: read
contents: read
jobs:
## Build Library
build-library:
name: "Build"
uses: ./.github/workflows/module.build.yml
secrets: inherit
permissions:
actions: read
contents: write
id-token: write
checks: write
pull-requests: read
with:
graph: generate-and-submit
signing: true
provenance: true
## Checks: CodeQL
checks-codeql:
name: "Checks"
uses: ./.github/workflows/module.codeql.yml
secrets: inherit
permissions:
actions: read
contents: read
security-events: write
with: {}
## Checks CodeQL
checks-detekt:
name: "Checks"
uses: ./.github/workflows/module.detekt.yml
secrets: inherit
permissions:
actions: read
contents: read
security-events: write
with: {}
## Stage: Check Scorecard
checks-scorecard:
name: "Checks"
uses: ./.github/workflows/module.scorecards.yml
secrets: inherit
permissions:
security-events: write
id-token: write
contents: read
actions: read
with: {}
## Deploy: Snapshots
publish:
name: "Publish"
uses: ./.github/workflows/module.publish.yml
needs: ['build-library', 'checks-codeql', 'checks-detekt', 'checks-scorecard']
secrets:
BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
PUBLISH_TOKEN: ${{ secrets.PUBLISH_TOKEN }}
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
permissions:
id-token: write
contents: read
packages: write
with:
snapshot: true
live: ${{ github.event_name == 'release' }}