ci(deps): bump actions/checkout from 5.0.0 to 6.0.1 #150

	name: Security Scan

	on:
	push:
	branches: [ "main" ]
	pull_request:
	branches: [ "main" ]
	schedule:
	- cron: '0 6 * * 1' # Weekly on Monday at 6 AM UTC

	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	security:
	name: Security Scan
	runs-on: ubuntu-latest
	# Skip job for merge commits (they were already tested in PR) except for scheduled runs
	if: github.event_name == 'schedule' \|\| github.event_name == 'pull_request' \|\| !startsWith(github.event.head_commit.message, 'Merge pull request')
	permissions:
	contents: read
	security-events: write

	steps:
	- name: Checkout code
	uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

	- name: Setup Node.js
	uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
	with:
	node-version: '22'
	cache: 'npm'

	- name: Install dependencies
	run: npm ci

	- name: Run npm audit
	run: npm audit --audit-level=moderate

	- name: Run security scan with npm audit signatures
	run: npm audit signatures

	- name: Initialize CodeQL
	uses: github/codeql-action/init@16df4fbc19aea13d921737861d6c622bf3cefe23 # v2.23.0
	with:
	languages: javascript

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@16df4fbc19aea13d921737861d6c622bf3cefe23 # v2.23.0
	with:
	category: "/language:javascript"

Provide feedback