ci: consolidate workflows

Author: jippi

.github/workflows/codeql.yml

@@ -1,4 +1,4 @@
-name: golangci-lint
+name: Lint
 
 on:
   push:
@@ -22,7 +22,7 @@ jobs:
   # ------------------------------
 
   golangci-lint:
-    name: lint
+    name: golangci-lint
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -48,3 +48,25 @@ jobs:
           args: --timeout=5m
 
   # ------------------------------
+
+  codeql-analyze:
+    name: codeql-analyze
+    runs-on: ubuntu-latest
+
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - uses: github/codeql-action/init@v3
+
+      - uses: github/codeql-action/autobuild@v3
+
+      - uses: github/codeql-action/analyze@v3

.github/workflows/gitleaks.yml

@@ -15,6 +15,7 @@ permissions:
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
+    name: goreleaser
     env:
       DOCKER_CLI_EXPERIMENTAL: "enabled"
     steps:

.github/workflows/grype.yml

@@ -16,6 +16,7 @@ jobs:
 
   govulncheck:
     runs-on: ubuntu-latest
+    name: govulncheck
     steps:
       - uses: actions/checkout@v4
         with:
@@ -43,6 +44,7 @@ jobs:
 
   semgrep:
     runs-on: ubuntu-latest
+    name: semgrep
     container:
       image: returntocorp/semgrep
     steps:
@@ -61,3 +63,41 @@ jobs:
 
       - name: semgrep
         run: semgrep scan --error --enable-nosem -f ./rules .
+
+  # ------------------------------
+
+  gitleaks:
+    runs-on: ubuntu-latest
+    name: gitleaks
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}}
+        if: ${{ env.GITLEAKS_LICENSE != '' }}
+
+  # -----------------------------
+
+  grype-scan:
+    runs-on: ubuntu-latest
+    name: grype-scan
+
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - uses: anchore/scan-action@v3
+        with:
+          path: "."
+          fail-build: true

.github/workflows/lint.yml

@@ -14,6 +14,7 @@ permissions:
 jobs:
   test:
     runs-on: ubuntu-latest
+    name: go test
     steps:
       - uses: actions/checkout@v4
         with: