chore(deps): lock file maintenance #2786

	name: ci
	on:
	push:
	branches:
	- "**"
	workflow_dispatch:
	workflow_run:
	workflows: [ "update-snapshots" ]
	types:
	- completed

	defaults:
	run:
	# NOTE: A bit stricter than the default bash options used by GitHub Actions
	# (bash --noprofile --norc -e -o pipefail {0})
	shell: bash --noprofile --norc -euo pipefail {0}

	# NOTE: Set concurrency for the current workflow to 1
	concurrency: ci-${{ github.ref }}-${{ github.workflow }}

	jobs:
	build-and-release:
	timeout-minutes: 60
	runs-on: ubuntu-24.04
	permissions:
	id-token: write # Required for OIDC
	contents: write
	pull-requests: write
	issues: write
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

	- uses: capralifecycle/actions-lib/check-runtime-dependencies@0ce63296cc44accd75acd8d0c56e73014b937e83 # v1.6.3

	- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
	with:
	node-version-file: ".node-version"
	cache: "npm"

	- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
	id: setup-python
	with:
	python-version-file: ".python-version"

	- name: python - setup uv
	uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
	with:
	enable-cache: true

	- name: build and verify
	run: make ci

	- name: conditionally semantic release
	if: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: npm run semantic-release

Provide feedback