chore(ci): improvements to gha workflows #19

	name: PR

	on:
	pull_request:
	branches:
	- master

	permissions:
	contents: read

	jobs:
	## Build the library and provenance material, but don't publish
	build:
	name: "Build"
	uses: ./.github/workflows/ci.build.yml
	permissions:
	actions: write
	contents: write
	id-token: write
	with:
	provenance: true
	provenance_publish: false
	snapshot: false

	## Run main CI build and tests.
	test:
	name: "Tests"
	uses: ./.github/workflows/ci.test.yml
	permissions:
	actions: write
	contents: write
	id-token: write

	## Validate the Gradle Wrapper binary
	checks-gradle-wrapper:
	name: "Checks"
	uses: ./.github/workflows/gradle-wrapper-validation.yml

	## Publish and check the dependency graph.
	checks-dependency-graph:
	name: "Checks"
	uses: ./.github/workflows/dependency-review.yml
	permissions:
	contents: write
	id-token: write

	## Run CodeQL checks
	checks-codeql:
	name: "Checks"
	uses: ./.github/workflows/codeql.yml
	permissions:
	actions: read
	contents: read
	security-events: write

Provide feedback