security: pin github actions to commit SHAs across workflows #180

	name: CI

	on:
	push:
	branches: ["master", "main", "develop"]
	pull_request:
	branches: ["master", "main", "develop"]

	jobs:
	test:
	name: Setup and Run Tests
	runs-on: ubuntu-latest
	strategy:
	matrix:
	python-version: ["3.12"]

	steps:
	- name: Checkout repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

	- name: Set up Python ${{ matrix.python-version }}
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.3.0
	with:
	python-version: ${{ matrix.python-version }}

	- name: Install uv
	uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.1

	- name: Install project and dependencies
	run: \|
	uv sync --all-extras --dev
	uv pip install -e . --no-deps

	- name: Set up Git user
	run: \|
	git config --global user.name "GitHub Actions"
	git config --global user.email "actions@github.com"

	- name: Run tests
	run: uv run pytest tests --cov --cov-branch --cov-report=xml

	- name: Upload coverage reports to Codecov
	uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.3.1
	with:
	token: ${{ secrets.CODECOV_TOKEN }}

Provide feedback