on-push.yaml

name: on_push

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions:
  contents: read

jobs:

  conf:
    env:
      ERR_VULNERABILITY_SEV: "CRITICAL,HIGH,MEDIUM"
      GO_VERSION: "1.20.1"

    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      err_on_vulnerability_sev: ${{ steps.conf.outputs.err_on_vulnerability_sev }}
      go_version: ${{ steps.conf.outputs.go_version }}
    steps:

    - name: Export Config
      id: conf
      run: |
        echo "err_on_vulnerability_sev=${{ env.ERR_VULNERABILITY_SEV }}" >> $GITHUB_OUTPUT
        echo "go_version=${{ env.GO_VERSION }}" >> $GITHUB_OUTPUT

  test:
    needs:
    - conf
    permissions:
      contents: read
      security-events: write
      id-token: write
    uses: ./.github/workflows/test.yaml
    with:
      go_version: ${{ needs.conf.outputs.go_version }}
      scan_severity: ${{ needs.conf.outputs.err_on_vulnerability_sev }}

  meter:
    needs:
    - test
    permissions:
      contents: read
      id-token: write
    uses: ./.github/workflows/meter.yaml
    with:
      metric: "push-tests"
      value: 1

  print:
    needs:
    - meter
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
    - name: Print Output
      run: |
        echo "metric: ${{ needs.meter.outputs.metric }}"
        echo "value: ${{ needs.meter.outputs.value }}"