chore(ci): SHA-pin actions, tighten permissions, add SPDX headers #138

	# SPDX-License-Identifier: PMPL-1.0-or-later
	name: Haskell CI

	on:
	push:
	branches: [ "main" ]
	pull_request:
	branches: [ "main" ]

	permissions:
	contents: read

	jobs:
	build:
	runs-on: ubuntu-latest
	permissions:
	contents: read

	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	- uses: actions/setup-haskell@28c8ff1d6cbeaed15ce310b1952dc19352a0a07d # v1.1.5
	with:
	ghc-version: '8.10.3'
	cabal-version: '3.2'

	- name: Cache
	uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
	env:
	cache-name: cache-cabal
	with:
	path: ~/.cabal
	key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('*/.cabal') }}-${{ hashFiles('**/cabal.project') }}
	restore-keys: \|
	${{ runner.os }}-build-${{ env.cache-name }}-
	${{ runner.os }}-build-
	${{ runner.os }}-

	- name: Install dependencies
	run: \|
	cabal update
	cabal build --only-dependencies --enable-tests --enable-benchmarks
	- name: Build
	run: cabal build --enable-tests --enable-benchmarks all
	- name: Run tests
	run: cabal test all

Provide feedback