chore(deps): Bump the github-actions group across 1 directory with 12 updates #316

	name: Functional Tests

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	workflow_dispatch:

	permissions:
	contents: read
	id-token: write

	jobs:
	test:
	runs-on: ubuntu-latest
	# Secrets are not available on fork PRs — tests skip gracefully
	if: github.event_name == 'push' \|\| github.event_name == 'workflow_dispatch' \|\| github.event.pull_request.head.repo.full_name == github.repository
	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
	with:
	egress-policy: audit

	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

	- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
	with:
	node-version: 24
	cache: 'npm'

	- run: npm ci

	- name: Audit dependencies (npm)
	run: npm audit --audit-level=high

	- name: Scan dependencies (OSV)
	uses: google/osv-scanner-action/osv-scanner-action@c51854704019a247608d928f370c98740469d4b5 # v2.3.5
	with:
	scan-args: \|-
	--recursive
	./

	- name: Build
	run: npm run build

	- name: Type-check
	run: npm run type-check

	- name: Run functional tests
	run: npm run test:coverage
	env:
	TEST_BOOKSTACK_URL: ${{ secrets.TEST_BOOKSTACK_URL }}
	TEST_BOOKSTACK_TOKEN_ID: ${{ secrets.TEST_BOOKSTACK_TOKEN_ID }}
	TEST_BOOKSTACK_TOKEN_SECRET: ${{ secrets.TEST_BOOKSTACK_TOKEN_SECRET }}

	- name: Upload coverage to Codecov
	uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
	with:
	files: packages/core/coverage/lcov.info
	env:
	CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

Provide feedback