Add pinact and zizmor workflow checks #212

	name: Run Tests

	on: [ push ]

	jobs:

	test:
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

	- name: Set up Go
	uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
	with:
	go-version-file: 'go.mod'

	- name: golangci-lint
	continue-on-error: true
	uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
	with:
	args: --issues-exit-code=0 --timeout=5m

	- name: Run tests
	# Run sequentially to avoid conflicts with shared resources in Contentful.
	run: go test -p 1 -race -coverprofile=coverage.out -covermode=atomic -coverpkg=./... -v ./...
	env:
	TF_ACC: 1
	CONTENTFUL_MANAGEMENT_TOKEN: ${{secrets.CONTENTFUL_MANAGEMENT_TOKEN}}
	CONTENTFUL_ORGANIZATION_ID: ${{vars.CONTENTFUL_ORGANIZATION_ID}}
	CONTENTFUL_SPACE_ID: ${{vars.CONTENTFUL_SPACE_ID}}

	- name: Upload to codecov
	uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 # v3.1.6
	with:
	verbose: true

	changie:
	runs-on: ubuntu-latest
	needs: test
	if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
	permissions:
	contents: write
	pull-requests: write
	actions: write
	steps:
	- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
	with:
	fetch-depth: 0

	- name: Prepare release
	uses: labd/changie-release-action@cabe11e8578d5867ea0695351fd37e85ecb32aa6 # v0.3.2
	with:
	github-token: ${{ secrets.GITHUB_TOKEN }}
	release-workflow: 'release.yaml'

Provide feedback