build(deps): Bump github/codeql-action from 3.28.17 to 4.30.8 #155

	name: Go CI
	permissions:
	contents: read
	security-events: write

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	jobs:
	test:
	name: Test on Go ${{ matrix.go-version }}
	runs-on: ubuntu-latest
	strategy:
	matrix:
	go-version: [ '1.24' ]
	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
	with:
	egress-policy: audit

	- name: Checkout code
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	fetch-depth: 2

	- name: Set up Go
	uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
	with:
	go-version: ${{ matrix.go-version }}

	- name: Install Go tools
	run: \|
	go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
	go install github.com/mattn/goveralls@latest

	- name: Download Go modules
	run: \|
	go mod download
	go mod verify

	- name: Run govulncheck
	uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4

	- name: Lint source
	run: golangci-lint run ./...

	- name: Run tests with coverage
	run: go test -v ./... -race -coverprofile=coverage.out -covermode=atomic

	- name: Upload coverage to Coveralls
	if: matrix.go-version == '1.24' # Only upload from one Go version
	env:
	COVERALLS_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}
	run: \|
	goveralls -coverprofile=coverage.out -service=github -repotoken $COVERALLS_TOKEN

Provide feedback