Skip to content

Commit a0b652f

Browse files
paulbalandanpaulbalandan
committed
Security harden the workflows
1 parent 929ee6b commit a0b652f

File tree

5 files changed

+40
-47
lines changed

5 files changed

+40
-47
lines changed

‎.github/dependabot.yml‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,4 @@ updates:
1111
directory: '/'
1212
schedule:
1313
interval: 'daily'
14-
ignore:
15-
- dependency-name: '*'
16-
update-types:
17-
- 'version-update:semver-minor'
18-
- 'version-update:semver-patch'
14+
open-pull-requests-limit: 10

‎.github/workflows/release.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,16 @@ on:
88
jobs:
99
build:
1010
name: Create a release
11-
runs-on: ubuntu-latest
11+
runs-on: ubuntu-24.04
1212
steps:
1313
- name: Checkout code
14-
uses: actions/checkout@v6
14+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1515

1616
- name: Create release
17-
uses: crazy-max/ghaction-github-release@v2
17+
run: |
18+
gh release create "${{ github.ref_name }}" \
19+
--title "${{ github.ref_name }} Coding Standard" \
20+
--draft \
21+
--generate-notes
1822
env:
1923
GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
20-
with:
21-
name: ${{ github.ref_name }} Coding Standard
22-
draft: true
23-
prerelease: false

‎.github/workflows/test-coding-standards.yml‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,23 +17,23 @@ on:
1717
jobs:
1818
coding-standards:
1919
name: Coding Standards [PHP ${{ matrix.php-version }}]
20-
runs-on: ubuntu-latest
20+
runs-on: ubuntu-24.04
2121

2222
strategy:
2323
fail-fast: false
2424
matrix:
2525
php-version:
2626
- '8.2'
27-
- '8.3'
28-
- '8.4'
2927
- '8.5'
3028

3129
steps:
3230
- name: Checkout repository
33-
uses: actions/checkout@v6
31+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
32+
with:
33+
persist-credentials: false
3434

3535
- name: Setup PHP
36-
uses: shivammathur/setup-php@v2
36+
uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0
3737
with:
3838
php-version: ${{ matrix.php-version }}
3939
extensions: tokenizer
@@ -44,7 +44,7 @@ jobs:
4444
run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
4545

4646
- name: Cache composer dependencies
47-
uses: actions/cache@v5
47+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
4848
with:
4949
path: ${{ steps.composer-cache.outputs.COMPOSER_CACHE_FILES_DIR }}
5050
key: composer-${{ matrix.php-version }}-${{ hashFiles('**/composer.*') }}
@@ -56,7 +56,9 @@ jobs:
5656
run: composer config --global github-oauth.github.com ${{ secrets.GITHUB_TOKEN }}
5757

5858
- name: Install dependencies on tools
59-
run: composer update --ansi
59+
run: |
60+
composer update --ansi
61+
composer audit --ansi
6062
6163
- name: Run PHP CS Fixer
6264
run: vendor/bin/php-cs-fixer check --verbose --ansi --diff

‎.github/workflows/test-phpstan.yml‎

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -19,23 +19,21 @@ on:
1919
jobs:
2020
static-analyses:
2121
name: PHPStan Static Analysis [PHP ${{ matrix.php-version }}]
22-
runs-on: ubuntu-latest
22+
runs-on: ubuntu-24.04
2323

2424
strategy:
2525
fail-fast: false
2626
matrix:
2727
php-version:
2828
- '8.2'
29-
- '8.3'
30-
- '8.4'
3129
- '8.5'
3230

3331
steps:
3432
- name: Checkout repository
35-
uses: actions/checkout@v6
33+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3634

3735
- name: Setup PHP
38-
uses: shivammathur/setup-php@v2
36+
uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0
3937
with:
4038
php-version: ${{ matrix.php-version }}
4139
extensions: tokenizer
@@ -46,27 +44,21 @@ jobs:
4644
run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
4745

4846
- name: Cache composer dependencies
49-
uses: actions/cache@v5
47+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
5048
with:
5149
path: ${{ steps.composer-cache.outputs.COMPOSER_CACHE_FILES_DIR }}
5250
key: composer-${{ matrix.php-version }}-${{ hashFiles('**/composer.*') }}
5351
restore-keys: |
5452
composer-${{ matrix.php-version }}-
5553
composer-
5654
57-
- name: Cache PHPStan cache directory
58-
uses: actions/cache@v5
59-
with:
60-
path: build/phpstan
61-
key: phpstan-${{ github.sha }}
62-
restore-keys: |
63-
phpstan-
64-
6555
- name: Setup Composer's GitHub OAuth access
6656
run: composer config --global github-oauth.github.com ${{ secrets.GITHUB_TOKEN }}
6757

6858
- name: Install dependencies
69-
run: composer update --ansi
59+
run: |
60+
composer update --ansi
61+
composer audit --ansi
7062
7163
- name: Run PHPStan
7264
run: vendor/bin/phpstan analyse --ansi --verbose

‎.github/workflows/test-phpunit.yml‎

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ on:
1919
jobs:
2020
unit-tests:
2121
name: PHPUnit Tests [PHP ${{ matrix.php-version }}]
22-
runs-on: ubuntu-latest
22+
runs-on: ubuntu-24.04
2323

2424
strategy:
2525
fail-fast: false
@@ -32,10 +32,12 @@ jobs:
3232

3333
steps:
3434
- name: Checkout repository
35-
uses: actions/checkout@v6
35+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
36+
with:
37+
persist-credentials: false
3638

3739
- name: Setup PHP
38-
uses: shivammathur/setup-php@v2
40+
uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0
3941
with:
4042
php-version: ${{ matrix.php-version }}
4143
extensions: tokenizer
@@ -46,7 +48,7 @@ jobs:
4648
run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
4749

4850
- name: Cache composer dependencies
49-
uses: actions/cache@v5
51+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
5052
with:
5153
path: ${{ steps.composer-cache.outputs.COMPOSER_CACHE_FILES_DIR }}
5254
key: composer-${{ matrix.php-version }}-${{ hashFiles('**/composer.*') }}
@@ -58,19 +60,20 @@ jobs:
5860
run: composer config --global github-oauth.github.com ${{ secrets.GITHUB_TOKEN }}
5961

6062
- name: Install dependencies
61-
run: composer update --ansi
63+
run: |
64+
composer update --ansi
65+
composer audit --ansi
6266
6367
- name: Run Coding Standards Test Suite
6468
run: vendor/bin/phpunit --colors=always
6569

6670
- name: Upload coverage results to Coveralls
67-
run: |
68-
composer global require --ansi php-coveralls/php-coveralls
69-
php-coveralls --verbose --coverage_clover=build/phpunit/logs/clover.xml --json_path=build/phpunit/logs/coverage-upload.json
70-
env:
71-
COVERALLS_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
72-
COVERALLS_PARALLEL: true
73-
COVERALLS_FLAG_NAME: PHP ${{ matrix.php-version }}
71+
uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.37.0
72+
with:
73+
github-token: ${{ secrets.GITHUB_TOKEN }}
74+
file: build/phpunit/logs/clover.xml
75+
parallel: true
76+
flag-name: PHP ${{ matrix.php-version }}
7477

7578
coveralls-upload:
7679
name: Trigger parallel build webhook on Coveralls
@@ -80,7 +83,7 @@ jobs:
8083

8184
steps:
8285
- name: Upload to Coveralls API
83-
uses: coverallsapp/github-action@master
86+
uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.37.0
8487
with:
8588
github-token: ${{ secrets.GITHUB_TOKEN }}
8689
parallel-finished: true

0 commit comments

Comments
 (0)