update WF structure

Author: Måns Thörnvik

…/workflows/callable-static-analysis.yaml .github/workflows/code-scanning.yaml.github/workflows/callable-static-analysis.yaml renamed to .github/workflows/code-scanning.yaml .github/workflows/callable-static-analysis.yaml renamed to .github/workflows/code-scanning.yaml

@@ -1,14 +1,21 @@
-name: Static analysis
+name: Code scanning
+
+run-name: Code scanning - ${{ github.event.pull_request.title || github.event.head_commit.message }}
 
 on:
-  workflow_call:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
 
 permissions:
   contents: read
   security-events: write
 
 jobs:
-  lint:
+  golangci-lint:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -22,11 +29,11 @@ jobs:
             --output.sarif.path golangci-lint-report.sarif
 
       - name: Upload linting SARIF
-        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
         with:
           sarif_file: golangci-lint-report.sarif
 
-  vulncheck:
+  govulncheck:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -39,10 +46,10 @@ jobs:
           cache-dependency-path: tools/go.sum
 
       - name: Run vulnerability scan
-        continue-on-error: true
         run: make vulncheck-sarif
 
       - name: Upload vulnerability SARIF
-        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        if: always()
+        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
         with:
           sarif_file: build/govulncheck-report.sarif

.github/workflows/codeql.yml

@@ -1,28 +1,22 @@
 name: Main branch protection
 
+run-name: "Main branch protection: ${{ github.event.head_commit.message }}"
+
 on:
+  workflow_dispatch:
   push:
     branches:
       - main
-  pull_request:
-    branches:
-      - main
 
 # Should prevent concurrency on a per-branch basis.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
-  cancel-in-progress: ${{ github.ref_name != 'main' }}
+  cancel-in-progress: false
 
 permissions:
-  checks: write
   contents: read
-  security-events: write
 
 jobs:
-  static-analysis:
-    uses: ./.github/workflows/callable-static-analysis.yaml
-    secrets: inherit
-
   test:
     uses: ./.github/workflows/callable-test.yaml
     secrets: inherit

.github/workflows/main-protection.yaml .github/workflows/main.yaml.github/workflows/main-protection.yaml renamed to .github/workflows/main.yaml

@@ -0,0 +1,24 @@
+name: Pull request validation
+
+run-name: "Pull request validation: ${{ github.event.pull_request.title }}"
+
+on:
+  pull_request:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    uses: ./.github/workflows/callable-test.yaml
+    secrets: inherit
+
+  build:
+    uses: ./.github/workflows/callable-build.yaml
+    secrets: inherit