Skip to content

Commit d4eeaa6

Browse files
paulbalandanpaulbalandan
committed
Security harden workflows
1 parent 34c2adc commit d4eeaa6

File tree

5 files changed

+39
-31
lines changed

5 files changed

+39
-31
lines changed

‎.github/dependabot.yml‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,4 @@ updates:
1111
directory: /
1212
schedule:
1313
interval: daily
14-
ignore:
15-
- dependency-name: '*'
16-
update-types:
17-
- version-update:semver-minor
18-
- version-update:semver-patch
14+
open-pull-requests-limit: 10

‎.github/workflows/release.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,16 @@ on:
88
jobs:
99
build:
1010
name: Create a release
11-
runs-on: ubuntu-latest
11+
runs-on: ubuntu-24.04
1212

1313
steps:
1414
- name: Checkout code
15-
uses: actions/checkout@v5
15+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
16+
with:
17+
persist-credentials: false
1618

1719
- name: Create release
18-
uses: crazy-max/ghaction-github-release@v2
19-
with:
20-
token: ${{ secrets.RELEASE_TOKEN }}
21-
draft: true
22-
prerelease: false
20+
run: gh release create ${{ github.ref_name }} \
21+
--title ${{ github.ref_name }} \
22+
--draft \
23+
--generate-notes

‎.github/workflows/test-coding-standards.yml‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -26,16 +26,16 @@ jobs:
2626
strategy:
2727
matrix:
2828
php-version:
29-
- '8.1'
30-
- '8.2'
31-
- '8.3'
29+
- '8.5'
3230

3331
steps:
3432
- name: Checkout repository
35-
uses: actions/checkout@v5
33+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
34+
with:
35+
persist-credentials: false
3636

3737
- name: Setup PHP
38-
uses: shivammathur/setup-php@v2
38+
uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0
3939
with:
4040
php-version: ${{ matrix.php-version }}
4141
extensions: tokenizer
@@ -46,7 +46,7 @@ jobs:
4646
run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
4747

4848
- name: Cache composer dependencies
49-
uses: actions/cache@v4
49+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
5050
with:
5151
path: ${{ steps.composer-cache.outputs.COMPOSER_CACHE_FILES_DIR }}
5252
key: composer-${{ matrix.php-version }}-${{ hashFiles('**/composer.*') }}
@@ -58,7 +58,9 @@ jobs:
5858
run: composer config --global github-oauth.github.com ${{ secrets.GITHUB_TOKEN }}
5959

6060
- name: Install dependencies on tools
61-
run: composer update --ansi
61+
run: |
62+
composer update --ansi
63+
composer audit --ansi
6264
6365
- name: Run PHP CS Fixer
64-
run: vendor/bin/php-cs-fixer fix --verbose --ansi --dry-run --diff
66+
run: vendor/bin/php-cs-fixer check --verbose --ansi --diff

‎.github/workflows/test-phpstan.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -32,15 +32,16 @@ jobs:
3232
matrix:
3333
php-version:
3434
- '8.1'
35-
- '8.2'
36-
- '8.3'
35+
- '8.5'
3736

3837
steps:
3938
- name: Checkout repository
40-
uses: actions/checkout@v5
39+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
40+
with:
41+
persist-credentials: false
4142

4243
- name: Setup PHP
43-
uses: shivammathur/setup-php@v2
44+
uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0
4445
with:
4546
php-version: ${{ matrix.php-version }}
4647
coverage: none
@@ -50,7 +51,7 @@ jobs:
5051
run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
5152

5253
- name: Cache composer dependencies
53-
uses: actions/cache@v4
54+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
5455
with:
5556
path: ${{ steps.composer-cache.outputs.COMPOSER_CACHE_FILES_DIR }}
5657
key: composer-${{ matrix.php-version }}-${{ hashFiles('**/composer.*') }}
@@ -73,7 +74,9 @@ jobs:
7374
run: composer config --global github-oauth.github.com ${{ secrets.GITHUB_TOKEN }}
7475

7576
- name: Install dependencies
76-
run: composer update --ansi
77+
run: |
78+
composer update --ansi
79+
composer audit --ansi
7780
7881
- name: Run PHPStan
7982
run: vendor/bin/phpstan analyse --ansi --verbose

‎.github/workflows/test-phpunit.yml‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ on:
2323
jobs:
2424
extension-tests:
2525
name: PHPUnit Extension Tests [PHP ${{ matrix.php-version }}]
26-
runs-on: ubuntu-latest
26+
runs-on: ubuntu-24.04
2727

2828
strategy:
2929
fail-fast: false
@@ -32,13 +32,17 @@ jobs:
3232
- '8.1'
3333
- '8.2'
3434
- '8.3'
35+
- '8.4'
36+
- '8.5'
3537

3638
steps:
3739
- name: Checkout repository
38-
uses: actions/checkout@v5
40+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
41+
with:
42+
persist-credentials: false
3943

4044
- name: Setup PHP
41-
uses: shivammathur/setup-php@v2
45+
uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0
4246
with:
4347
php-version: ${{ matrix.php-version }}
4448
coverage: xdebug
@@ -48,7 +52,7 @@ jobs:
4852
run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
4953

5054
- name: Cache composer dependencies
51-
uses: actions/cache@v4
55+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
5256
with:
5357
path: ${{ steps.composer-cache.outputs.COMPOSER_CACHE_FILES_DIR }}
5458
key: composer-${{ matrix.php-version }}-${{ hashFiles('**/composer.*') }}
@@ -60,7 +64,9 @@ jobs:
6064
run: composer config --global github-oauth.github.com ${{ secrets.GITHUB_TOKEN }}
6165

6266
- name: Install dependencies
63-
run: composer update --ansi
67+
run: |
68+
composer update --ansi
69+
composer audit --ansi
6470
6571
- name: Run Extension Tests
6672
run: vendor/bin/phpunit --no-coverage

0 commit comments

Comments
 (0)