name: Pull Request

on:
  workflow_dispatch: {}
  pull_request:
    branches: [main]
    paths:
      - internal/**
      - pkg/**
      - shoutrrr/**
      - go.mod
      - go.sum
      - shoutrrr.go

jobs:
  lint:
    uses: ./.github/workflows/lint-go.yaml
    permissions:
      contents: read

  test:
    uses: ./.github/workflows/test.yaml
    permissions:
      contents: read

  gosec:
    name: Golang Security Checker
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: read
      pull-requests: read
      security-events: write
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
      - name: Checkout main branch
        if: github.event_name == 'pull_request'
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
        with:
          ref: "main"
          fetch-depth: 0
          path: "main"
      - name: Run gosec on main
        if: github.event_name == 'pull_request'
        uses: securego/gosec@6be2b51fd78feca86af91f5186b7964d76cb1256 # v2.22.10
        with:
          args: '-no-fail -fmt sarif -out results.sarif -tests -ai-api-provider="none" ./...'
      - name: Run gosec on PR
        if: github.event_name == 'pull_request'
        uses: securego/gosec@6be2b51fd78feca86af91f5186b7964d76cb1256 # v2.22.10
        with:
          args: '-no-fail -fmt sarif -out results.sarif -tests -ai-api-provider="none" ./...'
      - name: Run gosec on push
        if: github.event_name != 'pull_request'
        uses: securego/gosec@6be2b51fd78feca86af91f5186b7964d76cb1256 # v2.22.10
        with:
          args: '-no-fail -fmt sarif -out results.sarif -tests -ai-api-provider="none" ./...'
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4
        with:
          sarif_file: results.sarif

  govulncheck:
    name: govulncheck
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: read
      pull-requests: read
      security-events: write
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
      - uses: ./.github/actions/govulncheck
        with:
          go-version: 1.25.x
