fix(security): harden supply chain and resolve dependency alerts #65

	---
	name: CI

	on:
	pull_request:
	branches: [main]

	permissions:
	contents: read

	jobs:
	validate:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

	- name: Setup Go
	uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
	with:
	go-version-file: go.mod

	- name: Setup Node.js
	uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238
	with:
	node-version: '22'

	- name: Setup Hugo
	uses: peaceiris/actions-hugo@75d2e84710de30f6ff7268e08f310b60ef14033f
	with:
	hugo-version: '0.155.1'
	extended: true

	- name: Install Node dependencies
	run: npm ci

	- name: Run tests
	run: go test -race ./cmd/sync-content/...

	- name: Sync content
	run: go run ./cmd/sync-content --org complytime --config sync-config.yaml --lock .content-lock.json --write
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Build site
	run: hugo --minify --gc

Provide feedback