sec: Unpinned tag for a non-immutable Action in workflow #44

	name: Test (linter/formatter/coverage)

	on: [push]

	permissions:
	contents: read

	jobs:
	build:
	runs-on: ubuntu-latest
	strategy:
	matrix:
	python-version: ["3.13"]

	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Set up Python ${{ matrix.python-version }}
	uses: actions/setup-python@v5
	with:
	python-version: ${{ matrix.python-version }}

	- name: Install dependencies
	run: \|
	pip install --upgrade uv
	uv pip sync --system --break-system-packages requirements.lock

	- name: Install package
	run: \|
	pip install -e .

	- name: Run all linters and formatters
	run: \|
	pre-commit run --all-files

	- name: Run tests with coverage
	run: \|
	pytest --cov=irrexplorer_cli --cov-branch --cov-report=xml

	- name: Upload coverage to Codecov
	uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303
	with:
	token: ${{ secrets.CODECOV_TOKEN }}
	slug: kiraum/irrexplorer-cli

Provide feedback