-
Notifications
You must be signed in to change notification settings - Fork 1
104 lines (94 loc) · 2.24 KB
/
on.pr.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
name: "PR"
on:
## Event: Merge group checks
merge_group:
types: [checks_requested]
## Event: PR
pull_request:
paths:
## Trigger: Global changes/release
- ".version"
- ".release"
- "gradle.properties"
- "*.kts"
- "**/*.kts"
- "**/*.kt"
- "**/*.java"
- "**/*.properties"
- "gradle/**"
- ".github/workflows/*.yml"
env:
CI: true
BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
permissions:
actions: read
contents: read
jobs:
## Stage: Build Library
build-library:
name: "Build"
uses: ./.github/workflows/module.build.yml
secrets: inherit
permissions:
actions: read
contents: write
id-token: write
checks: write
pull-requests: read
with: {}
## Stage: Check CodeQL
checks-codeql:
name: "Checks"
uses: ./.github/workflows/module.codeql.yml
secrets: inherit
permissions:
actions: read
contents: read
security-events: write
with: {}
## Stage: Check CodeQL
checks-detekt:
name: "Checks"
uses: ./.github/workflows/module.detekt.yml
secrets: inherit
permissions:
actions: read
contents: read
security-events: write
with: {}
## Stage: Check Dependencies
checks-dependencies:
name: "Checks"
uses: ./.github/workflows/module.dependency-review.yml
secrets: inherit
permissions:
contents: read
security-events: write
with: {}
## Stage: Check Scorecard
checks-scorecard:
name: "Checks"
uses: ./.github/workflows/module.scorecards.yml
secrets: inherit
permissions:
security-events: write
id-token: write
contents: read
actions: read
with: {}
## Deploy: Snapshots
deploy-snapshot:
name: "Publish"
uses: ./.github/workflows/module.publish.yml
if: false # TODO: enable with label
needs: ['build-library', 'checks-codeql', 'checks-detekt', 'checks-dependencies', 'checks-scorecard']
secrets:
BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
PUBLISH_TOKEN: ${{ secrets.PUBLISH_TOKEN }}
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
permissions:
id-token: write
contents: read
packages: write
with:
snapshot: true