Add pinact and zizmor workflow checks #63

	name: Run Tests

	on: [push]

	jobs:

	test:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

	- uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
	with:
	terraform_version: 1.5.7
	terraform_wrapper: false

	- name: Set up Go
	uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
	with:
	go-version-file: go.mod
	cache: false

	- name: golangci-lint
	continue-on-error: true
	uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2
	with:
	args: --issues-exit-code=0 --timeout=5m

	- name: Run tests
	run: go test -race -coverprofile=coverage.out -covermode=atomic -coverpkg=./... -v ./...
	env:
	TF_ACC: 1

	- name: build binary
	uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
	with:
	args: build --snapshot --clean --single-target
	env:
	GOPATH: ${{ env.GOPATH }}

	changie:
	runs-on: ubuntu-latest
	needs: test
	if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
	permissions:
	contents: write
	pull-requests: write
	actions: write
	steps:
	- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
	with:
	fetch-depth: 0

	- name: Prepare release
	uses: labd/changie-release-action@851d6ab1849a152c0aabc79d54e5b0bb85b4f669 # v0.3.1
	with:
	github-token: ${{ secrets.GITHUB_TOKEN }}
	release-workflow: 'release.yaml'

Provide feedback