on-push-main.yaml

name: Push to main
on:
  push:
    branches: [main]

jobs:
  test:
    name: Run tests
    uses: ./.github/workflows/test.yaml

  snyk:
    name: Scan dependencies
    uses: ./.github/workflows/snyk.yaml
    with:
      severity-treshold: low
    secrets: inherit
    permissions:
      contents: read
      security-events: write

  semgrep:
    name: Scan source code
    uses: ./.github/workflows/semgrep.yaml
    secrets: inherit
    permissions:
      contents: read
      security-events: write

  release-please:
    name: Create release-please PR
    uses: ./.github/workflows/release-please.yaml
    secrets: inherit
    permissions:
      contents: write
      pull-requests: write