Bump actions/create-github-app-token from 2 to 3 in the actions group… #222

	name: Security

	on:
	push: { branches-ignore: [production] }
	schedule:
	- cron: "19 7 * * 0"

	permissions:
	contents: read
	security-events: write

	concurrency:
	group: ${{ github.workflow }}-${{ github.head_ref \|\| github.run_id }}
	cancel-in-progress: true

	jobs:
	gosec:
	name: 👮‍♀️ GoSec
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@v6

	- name: Run GoSec Security Scanner
	uses: securego/gosec@master
	with:
	args: "-severity=medium -no-fail -fmt sarif -out gosec-results.sarif ./..."

	- name: Upload GoSec scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v4
	with:
	sarif_file: "gosec-results.sarif"

Provide feedback