refactor: clone over public HTTPS, make token optional #2

	name: CI

	on:
	push:
	pull_request:

	jobs:
	test:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: "3.12"
	- name: Install dependencies
	run: \|
	python -m pip install --upgrade pip
	pip install pytest pytest-cov ruff bandit
	pip install -e .
	- name: Lint (ruff, informational)
	run: ruff check .
	continue-on-error: true
	- name: Security gate (bandit, fails on high severity, e.g. shell=True)
	run: bandit -r sofahutils --severity-level high
	- name: Tests
	run: pytest -q

Provide feedback