Don't use nox.session.create_tmp.

It's basically a footgun, in that it:

    * doesn't create a pseudorandom temporary directory, it just gives you
      the path 'tmp/'
    * thereby then doesn't create separate directories if you call it multiple
      times
    * mutates the global (shell) environment state by setting TMPDIR to this
      'new' directory so other processes can now 'accidentally' end up
      sticking things in it

(In particular I was really confused how/why non-distribution files were being
plopped into my python -m build's outdir, but it was because TMPDIR was
sticking around)

noxfile.py

@@ -1,4 +1,6 @@
 from pathlib import Path
+from tempfile import TemporaryDirectory
+import os
 
 import nox
 
@@ -22,17 +24,40 @@ def _session(fn):
 @session(python=["3.8", "3.9", "3.10", "3.11", "pypy3"])
 def tests(session):
     session.install(ROOT, "-r", TESTS / "requirements.txt")
-    if session.posargs == ["coverage"]:
+
+    if session.posargs and session.posargs[0] == "coverage":
+        if len(session.posargs) > 1 and session.posargs[1] == "github":
+            github = os.environ["GITHUB_STEP_SUMMARY"]
+        else:
+            github = None
+
         session.install("coverage[toml]")
-        session.run("coverage", "run", "-m", "pytest")
-        session.run("coverage", "report")
+        session.run("coverage", "run", "-m", "pytest", TESTS)
+        if github is None:
+            session.run("coverage", "report")
+        else:
+            with open(github, "a") as summary:
+                summary.write("### Coverage\n\n")
+                summary.flush()  # without a flush, output seems out of order.
+                session.run(
+                    "coverage",
+                    "report",
+                    "--format=markdown",
+                    stdout=summary,
+                )
     else:
         session.run("pytest", *session.posargs, TESTS)
 
 
-@session(tags=["style"])
-def readme(session):
+@session()
+def audit(session):
+    session.install("pip-audit", ROOT)
+    session.run("python", "-m", "pip_audit")
+
+
+@session(tags=["build"])
+def build(session):
     session.install("build", "twine")
-    tmpdir = session.create_tmp()
-    session.run("python", "-m", "build", ROOT, "--outdir", tmpdir)
-    session.run("python", "-m", "twine", "check", tmpdir + "/*")
+    with TemporaryDirectory() as tmpdir:
+        session.run("python", "-m", "build", ROOT, "--outdir", tmpdir)
+        session.run("twine", "check", "--strict", tmpdir + "/*")