ci: applying security recommendations: Pinned-Dependencies #35

	name: Check build

	on:
	pull_request:
	types:
	- opened
	- synchronize
	- reopened

	permissions:
	contents: read

	jobs:
	build-test:
	runs-on: 'ubuntu-latest'

	permissions:
	contents: read

	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
	with:
	egress-policy: audit

	- name: Checkout
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

	- name: Set Up Python
	uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
	with:
	cache: 'pip'
	cache-dependency-path: './docs/requirements.txt'
	python-version: '3.12.10'

	- name: Install Dependencies
	shell: bash
	run: \|
	python -m pip install --upgrade pip==24.0 --no-deps
	# Use pip to install from requirements.txt with hash checking
	pip install -r requirements.txt
	# Pin the build package
	pip install build==1.1.1 --no-deps

	- name: Build
	shell: python
	run: \|
	import os
	import subprocess

	def build_wheel():
	if not os.path.exists('dist'):
	os.makedirs('dist')
	subprocess.check_call([ 'python', '-m', 'build', '--wheel' ])

	build_wheel()

Provide feedback