ci.yaml

name: "CI"
on:
  workflow_dispatch:
    inputs:
      debug_enabled:
        description: "Run the workflow with tmate.io debugging enabled"
        required: true
        type: boolean
        default: false
  push:
    branches: [ main ]
  pull_request:
    types: [ opened, reopened, synchronize ]

jobs:
  scan:
    name: gitguardian
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # fetch all history so multiple commits can be scanned
      - name: GitGuardian scan
        uses: GitGuardian/ggshield-action@v1.18.1
        env:
          GITHUB_PUSH_BEFORE_SHA: ${{ github.event.before }}
          GITHUB_PUSH_BASE_SHA: ${{ github.event.base }}
          GITHUB_PULL_BASE_SHA:  ${{ github.event.pull_request.base.sha }}
          GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}

  scidev:
    needs: scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Tag Build and Push Testing Container
        uses: ./.github/actions/tag-build-push-container
        with:
          registry: ghcr.io
          image-name: ${{ github.repository_owner }}/${{ github.job }}
          containerfile-path: "containers/Containerfile.${{ github.job }}"
          push-condition: ${{ github.event_name != 'pull_request' }}
          github-token: ${{ secrets.GITHUB_TOKEN }}