ci: use official zizmor action with PR annotations #668

	---
	name: ci

	on:
	pull_request:
	branches:
	- main

	permissions: {}

	jobs:
	build:
	runs-on: ubuntu-latest

	permissions:
	contents: read

	strategy:
	matrix:
	node-version: [20.x, 22.x, 24.x]

	steps:
	- name: Checkout Repository
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	fetch-depth: 1
	persist-credentials: false

	- name: Setup pnpm
	uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6.0.5

	- name: Setup Node ${{ matrix.node-version }}
	uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
	with:
	always-auth: false
	node-version: ${{ matrix.node-version }}
	cache: 'pnpm'

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	- name: Start Docker
	run: pnpm run docker:start

	- name: Build
	run: pnpm -r --include-workspace-root run build

	- name: Run Tests
	run: pnpm run test:coverage

	# @layered-loader/sqs uses fauxqs as a test fixture, which requires Node >= 22.5
	- name: Run @layered-loader/sqs Tests
	if: matrix.node-version != '20.x'
	run: pnpm --filter @layered-loader/sqs test

	- name: Stop Docker
	run: pnpm run docker:stop

	- name: Run Linting
	run: pnpm -r --include-workspace-root run lint

	automerge:
	needs: build
	runs-on: ubuntu-latest
	permissions:
	pull-requests: write
	contents: write
	steps:
	- uses: fastify/github-action-merge-dependabot@30c3f8f14a4f7b315ba38dbc1b793d27128fef82 # v3.12.0
	with:
	github-token: ${{ secrets.GITHUB_TOKEN }}

Provide feedback