chore(deps): Bump actions/checkout in the actions-updates group (#145) #275

	name: GitHub Actions Security Analysis

	on:
	push:
	branches: ["main"]
	pull_request:
	branches: ["**"]

	permissions:
	contents: read # Default token to read

	jobs:
	zizmor:
	name: zizmor latest via PyPI
	runs-on: ubuntu-latest
	permissions:
	security-events: write # Needed to write security events to github
	contents: read # Needed to read clone repo
	actions: read # Needed to read actions
	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
	with:
	egress-policy: audit

	- name: Checkout repository
	uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
	with:
	persist-credentials: false

	- name: Install the latest version of uv
	uses: astral-sh/setup-uv@85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41 # v7.1.2

	- name: Run zizmor
	run: uvx zizmor --pedantic --format sarif . > results.sarif
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Upload SARIF file
	uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
	with:
	sarif_file: results.sarif
	category: zizmor

Provide feedback