on-pull-request.yaml

name: Pull Request
on:
  pull_request:
    types: [opened, synchronize, edited, reopened]

jobs:
  lint:
    name: Check code quality
    uses: ./.github/workflows/lint.yaml

  conventional-commits:
    name: Check for conventional commits compliance
    uses: ./.github/workflows/conventional-commits.yaml

  snyk:
    name: Scan dependencies
    uses: ./.github/workflows/snyk.yaml
    with:
      severity-treshold: low
    secrets: inherit
    permissions:
      contents: read
      security-events: write

  semgrep:
    name: Scan source code
    uses: ./.github/workflows/semgrep.yaml
    secrets: inherit
    permissions:
      contents: read
      security-events: write