diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..7664278
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      go-dependencies:
+        patterns:
+          - "*"
diff --git a/.github/workflows/container-scan.yml b/.github/workflows/container-scan.yml
index d863a05..c8013b5 100644
--- a/.github/workflows/container-scan.yml
+++ b/.github/workflows/container-scan.yml
@@ -23,7 +23,7 @@ jobs:
           echo "version=$(cat VERSION)" >> $GITHUB_OUTPUT
 
       - name: Run Trivy
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@8f28faec26515256b6d22074d1d2a8986f4cbd87 # master
         env:
           TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
         with:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index f11f202..ce9fc13 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,10 +1,20 @@
 name: Test
 
 on:
+  push:
+    branches:
+      - master
   pull_request:
     branches:
       - master
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -18,10 +28,72 @@ jobs:
           go-version-file: 'go.mod'
 
       - name: Install dependencies
-        run: go get .
+        run: go mod download
 
       - name: Build
         run: go build -v ./...
 
       - name: Test
-        run: go test -v ./...
+        run: go test -v -race ./...
+
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Setup Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Check go.mod and go.sum are tidy
+        run: go mod tidy -diff
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.15.0
+
+  image:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Setup Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+          cache: false
+
+      # Matches the Go version selected by release-version.sh
+      - name: Get Go Version
+        id: get-go-version
+        run: |
+          echo "version=$(go mod edit -json | jq -r '.Toolchain // .Go' | sed 's/go//')" >> $GITHUB_OUTPUT
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/amd64
+          load: true
+          tags: github-exporter:ci
+          build-args: |
+            GOLANG_VERSION=${{ steps.get-go-version.outputs.version }}
+
+      - name: Run Trivy
+        uses: aquasecurity/trivy-action@8f28faec26515256b6d22074d1d2a8986f4cbd87 # master
+        env:
+          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
+        with:
+          scan-type: image
+          image-ref: github-exporter:ci
+          format: table
+          exit-code: '1'
+          ignore-unfixed: true
+          severity: CRITICAL,HIGH
diff --git a/exporter/prometheus_test.go b/exporter/prometheus_test.go
index dc00b03..5db24bd 100644
--- a/exporter/prometheus_test.go
+++ b/exporter/prometheus_test.go
@@ -6,6 +6,7 @@ import (
 	"crypto/x509"
 	"encoding/pem"
 	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/githubexporter/github-exporter/config"
@@ -22,19 +23,14 @@ func writeTempRSAKey(t *testing.T) string {
 	key, err := rsa.GenerateKey(rand.Reader, 2048)
 	require.NoError(t, err)
 
-	f, err := os.CreateTemp("", "test-github-app-key-*.pem")
-	require.NoError(t, err)
-	defer f.Close()
-
-	err = pem.Encode(f, &pem.Block{
+	path := filepath.Join(t.TempDir(), "test-github-app-key.pem")
+	keyPEM := pem.EncodeToMemory(&pem.Block{
 		Type:  "RSA PRIVATE KEY",
 		Bytes: x509.MarshalPKCS1PrivateKey(key),
 	})
-	require.NoError(t, err)
-
-	t.Cleanup(func() { os.Remove(f.Name()) })
+	require.NoError(t, os.WriteFile(path, keyPEM, 0o600))
 
-	return f.Name()
+	return path
 }
 
 func newTestExporter(cfg config.Config) *Exporter {