diff --git a/.github/workflows/go_build.yaml b/.github/workflows/go_build.yaml
index 89dcc19..42b5760 100644
--- a/.github/workflows/go_build.yaml
+++ b/.github/workflows/go_build.yaml
@@ -12,8 +12,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-name: go_test
-on: [push, pull_request]
+name: CQL Testing and Analysis
+on: [push, pull_request, workflow_dispatch]
+permissions:
+  contents: read
 jobs:
 
   go_test:
@@ -24,10 +26,12 @@ jobs:
     steps:
 
     - name: Check out code
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      with:
+        persist-credentials: false
 
     - name: Set up Go
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
         go-version-file: 'go.mod'
       id: go
@@ -51,10 +55,12 @@ jobs:
     steps:
 
     - name: Check out code
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      with:
+        persist-credentials: false
 
     - name: Set up Go
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
         go-version-file: 'go.mod'
       id: go
@@ -68,4 +74,11 @@ jobs:
 
     - name: Spec Test Coverage
       run: |
-            go run tests/spectests/cmd/analyzer/analyzer.go
\ No newline at end of file
+            set -o pipefail
+            go run tests/spectests/cmd/analyzer/analyzer.go 2>&1 | tee analyzer-output.txt
+            {
+              echo '## CQL Test Analyzer Results'
+              echo '```'
+              cat analyzer-output.txt
+              echo '```'
+            } >> "$GITHUB_STEP_SUMMARY"