use signed hashes for github actions #42

	---
	name: Lint and Build
	on:
	push:
	tags-ignore:
	- '*'
	branches:
	- '*'

	pull_request:
	branches: ['main']

	jobs:
	lint:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout repository
	uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3

	- name: Run golangci-lint
	uses: reviewdog/action-golangci-lint@f9bba13753278f6a73b27a56a3ffb1bfda90ed71 # v2
	with:
	go_version: "1.25.4"

	- name: Run hadolint
	uses: reviewdog/action-hadolint@921946a7ebaaf08ac72607bad67209f4e52b5407 # v1
	build:
	runs-on: ubuntu-latest
	needs: lint
	steps:
	- name: Checkout source code
	uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3

	- name: Setup Go
	uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
	with:
	go-version: '1.24.3'

	- name: Install dependencies
	run: go get .

	- name: Test
	run: go test -v ./... --race

	- name: Build
	run: go build -v ./...

	- name: Build an image from Dockerfile
	run: \|
	docker build -t controlplane/netassertv2-l4-client:${{ github.sha }} .

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: 'controlplane/netassertv2-l4-client:${{ github.sha }}'
	format: 'table'
	ignore-unfixed: true
	exit-code: '1'
	vuln-type: 'os,library'
	severity: 'CRITICAL,HIGH,MEDIUM'

Provide feedback