ci: pin GitHub Actions to full commit SHAs to prevent supply-chain attacks #854

	name: CI

	on:
	push:
	branches: ["main"]

	pull_request:
	branches: ["main"]

	jobs:
	test:
	runs-on: ubuntu-latest

	name: "Test Python ${{ matrix.python-version }}"

	env:
	REPLICATE_API_TOKEN: ${{ secrets.REPLICATE_API_TOKEN }}

	timeout-minutes: 10

	strategy:
	fail-fast: false
	matrix:
	python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]

	defaults:
	run:
	shell: bash

	steps:
	- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	- uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
	with:
	enable-cache: true

	- name: Setup
	run: ./script/setup

	- name: Test
	run: ./script/test

	- name: Lint
	run: ./script/lint

Provide feedback