Skip to content

Resolve findings from the security hardening audit #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jakejackson1 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Resolve findings from the security hardening audit #20

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
432 changes: 386 additions & 46 deletions .github/README.md
View file
Open in desktop

Large diffs are not rendered by default.

16 changes: 10 additions & 6 deletions .github/workflows/php-syntax.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ on:
- main
pull_request:

# The workflows only read the repository; nothing needs a write-capable GITHUB_TOKEN.
permissions:
contents: read

# Cancels all previous workflow runs for pull requests that have not completed.
concurrency:
# The concurrency group contains the workflow name and the branch name for pull requests
Expand All @@ -24,10 +28,10 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.0.0

- name: Install PHP
uses: shivammathur/setup-php@v2
uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.35.5
with:
php-version: ${{ matrix.php }}

Expand All @@ -42,14 +46,14 @@ jobs:
# http://man7.org/linux/man-pages/man1/date.1.html
- name: "Get last Monday's date"
id: get-date
run: echo "::set-output name=date::$(/bin/date -u --date='last Mon' "+%F")"
run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"

- name: Get Composer cache directory
id: composer-cache
run: echo "::set-output name=dir::$(composer config cache-files-dir)"
run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"

- name: Cache Composer dependencies
uses: actions/cache@v5
uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.0.4
env:
cache-name: cache-composer-dependencies
with:
Expand All @@ -58,7 +62,7 @@ jobs:


- name: Install Composer dependencies
run: composer install
run: composer install --no-scripts

- name: Check PHP Syntax
run: composer run check-syntax
16 changes: 10 additions & 6 deletions .github/workflows/phpcs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ on:
- main
pull_request:

# The workflows only read the repository; nothing needs a write-capable GITHUB_TOKEN.
permissions:
contents: read

# Cancels all previous workflow runs for pull requests that have not completed.
concurrency:
# The concurrency group contains the workflow name and the branch name for pull requests
Expand All @@ -19,10 +23,10 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.0.0

- name: Install PHP
uses: shivammathur/setup-php@v2
uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.35.5
with:
php-version: 7.3

Expand All @@ -37,22 +41,22 @@ jobs:
# http://man7.org/linux/man-pages/man1/date.1.html
- name: "Get last Monday's date"
id: get-date
run: echo "::set-output name=date::$(/bin/date -u --date='last Mon' "+%F")"
run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"

- name: Get Composer cache directory
id: composer-cache
run: echo "::set-output name=dir::$(composer config cache-files-dir)"
run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"

- name: Cache Composer dependencies
uses: actions/cache@v5
uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.0.4
env:
cache-name: cache-composer-dependencies
with:
path: ${{ steps.composer-cache.outputs.dir }}
key: ${{ runner.os }}-php-7.3-date-${{ steps.get-date.outputs.date }}-composer-${{ hashFiles('**/composer.json') }}

- name: Install Composer dependencies
run: composer install
run: composer install --no-scripts

- name: Run PHPUnit tests
run: composer run lint
16 changes: 10 additions & 6 deletions .github/workflows/phpstan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ on:
- main
pull_request:

# The workflows only read the repository; nothing needs a write-capable GITHUB_TOKEN.
permissions:
contents: read

# Cancels all previous workflow runs for pull requests that have not completed.
concurrency:
# The concurrency group contains the workflow name and the branch name for pull requests
Expand All @@ -19,10 +23,10 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.0.0

- name: Install PHP
uses: shivammathur/setup-php@v2
uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.35.5
with:
php-version: 7.3

Expand All @@ -37,22 +41,22 @@ jobs:
# http://man7.org/linux/man-pages/man1/date.1.html
- name: "Get last Monday's date"
id: get-date
run: echo "::set-output name=date::$(/bin/date -u --date='last Mon' "+%F")"
run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"

- name: Get Composer cache directory
id: composer-cache
run: echo "::set-output name=dir::$(composer config cache-files-dir)"
run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"

- name: Cache Composer dependencies
uses: actions/cache@v5
uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.0.4
env:
cache-name: cache-composer-dependencies
with:
path: ${{ steps.composer-cache.outputs.dir }}
key: ${{ runner.os }}-php-7.3-date-${{ steps.get-date.outputs.date }}-composer-${{ hashFiles('**/composer.json') }}

- name: Install Composer dependencies
run: composer install
run: composer install --no-scripts

- name: Run PHPUnit tests
run: composer run phpstan
29 changes: 20 additions & 9 deletions .github/workflows/phpunit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ on:
- main
pull_request:

# The workflows only read the repository; nothing needs a write-capable GITHUB_TOKEN.
permissions:
contents: read

# Cancels all previous workflow runs for pull requests that have not completed.
concurrency:
# The concurrency group contains the workflow name and the branch name for pull requests
Expand All @@ -28,10 +32,10 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.0.0

- name: Install PHP
uses: shivammathur/setup-php@v2
uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.35.5
with:
php-version: ${{ matrix.php }}

Expand All @@ -46,28 +50,35 @@ jobs:
# http://man7.org/linux/man-pages/man1/date.1.html
- name: "Get last Monday's date"
id: get-date
run: echo "::set-output name=date::$(/bin/date -u --date='last Mon' "+%F")"
run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"

- name: Get Composer cache directory
id: composer-cache
run: echo "::set-output name=dir::$(composer config cache-files-dir)"
run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"

- name: Cache Composer dependencies
uses: actions/cache@v5
uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.0.4
env:
cache-name: cache-composer-dependencies
with:
path: ${{ steps.composer-cache.outputs.dir }}
key: ${{ runner.os }}-php-${{ matrix.php }}-date-${{ steps.get-date.outputs.date }}-composer-${{ hashFiles('**/composer.json') }}

- name: Install Composer dependencies
run: composer install
run: composer install --no-scripts

- name: Run PHPUnit tests
run: vendor/bin/phpunit

- name: Run (xDebug) tests
if: ${{ matrix.report }}
run: |
vendor/bin/phpunit --verbose --coverage-clover=tmp/coverage/report-xml/php-coverage1.xml
bash <(curl -s https://codecov.io/bash);
run: vendor/bin/phpunit --verbose --coverage-clover=tmp/coverage/report-xml/php-coverage1.xml

# Replaces `bash <(curl -s https://codecov.io/bash)` — an unpinned remote script piped
# into bash, which was compromised in April 2021 and has since been sunset by Codecov.
- name: Upload coverage to Codecov
if: ${{ matrix.report }}
uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.1
with:
files: tmp/coverage/report-xml/php-coverage1.xml
token: ${{ secrets.CODECOV_TOKEN }}
Loading
Loading