Harden GitHub Actions: pin actions to SHAs and set explicit permissions #135

	name: Steampipe Acceptance Tests
	on:
	push:
	branches:
	- main
	pull_request:

	permissions:
	contents: read

	jobs:
	goreleaser:
	name: Build
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

	- name: Unshallow
	run: git fetch

	- name: Set up Go
	uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
	with:
	go-version: 1.21

	- name: Fetching Go Cache Paths
	id: go-cache-paths
	run: \|
	echo "go-build=$(go env GOCACHE)" >> $GITHUB_OUTPUT
	echo "go-mod=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT

	# used to speedup go test
	- name: Go Build Cache
	id: build-cache
	uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
	with:
	path: ${{ steps.go-cache-paths.outputs.go-build }}
	key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}

	# Cache go mod cache, used to speedup builds
	- name: Go Mod Cache
	id: mod-cache
	uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
	with:
	path: ${{ steps.go-cache-paths.outputs.go-mod }}
	key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}

	- name: Run Unit Tests
	run: \|
	go clean -testcache
	go test -timeout 30s ./...

Provide feedback