donutbrowser/.github/workflows/pr-checks.yml

name: Pull Request Checks

on:
  pull_request:
    branches: ["main"]
  merge_group:
    branches: ["main"]

permissions:
  security-events: write
  contents: read
  actions: read

jobs:
  lint-js:
    name: Lint JavaScript/TypeScript
    uses: ./.github/workflows/lint-js.yml
    secrets: inherit
    permissions:
      contents: read

  lint-rust:
    name: Lint Rust
    uses: ./.github/workflows/lint-rs.yml
    secrets: inherit
    permissions:
      contents: read

  security-scan:
    name: Security Vulnerability Scan
    if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@b77c075a1235514558f0eb88dbd31e22c45e0cd2" # v2.3.0
    with:
      scan-args: |-
        -r
        --skip-git
        --lockfile=pnpm-lock.yaml
        --lockfile=nodecar/pnpm-lock.yaml
        --lockfile=src-tauri/Cargo.lock
        ./

  pr-status:
    name: PR Status Check
    runs-on: ubuntu-latest
    needs: [lint-js, lint-rust, security-scan]
    if: always()
    steps:
      - name: Check all jobs succeeded
        run: |
          if [[ "${{ needs.lint-js.result }}" != "success" || "${{ needs.lint-rust.result }}" != "success" || "${{ needs.security-scan.result }}" != "success" ]]; then
            echo "One or more checks failed"
            exit 1
          fi
          echo "All checks passed!"