From 8c3520f2b06dac3255e85b865e2aee8a5db63408 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 00:36:07 +0300 Subject: [PATCH 01/15] Harden GitHub workflows --- .github/workflows/bc.yml | 2 +- .github/workflows/composer-require-checker.yml | 4 +++- .github/workflows/db-mssql.yml | 12 ++++++++---- .github/workflows/db-mysql.yml | 14 +++++++++----- .github/workflows/db-oracle.yml | 14 +++++++++----- .github/workflows/db-pgsql.yml | 12 ++++++++---- .github/workflows/db-sqlite.yml | 12 ++++++++---- .github/workflows/mutation.yml | 12 ++++++++---- .github/workflows/rector-cs.yml | 2 +- .github/workflows/static.yml | 4 +++- .github/workflows/update-readme-packages.yml | 4 ++-- 11 files changed, 60 insertions(+), 32 deletions(-) diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml index 94ed26c69..ea4ab51c8 100644 --- a/.github/workflows/bc.yml +++ b/.github/workflows/bc.yml @@ -16,7 +16,7 @@ permissions: jobs: roave_bc_check: - uses: yiisoft/actions/.github/workflows/bc.yml@master + uses: yiisoft/actions/.github/workflows/bc.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: php: >- ['8.5'] diff --git a/.github/workflows/composer-require-checker.yml b/.github/workflows/composer-require-checker.yml index 5455811ee..c26f38de1 100644 --- a/.github/workflows/composer-require-checker.yml +++ b/.github/workflows/composer-require-checker.yml @@ -16,9 +16,11 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read jobs: composer-require-checker: - uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@master + uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: php: >- ['8.1', '8.2', '8.3', '8.4', '8.5'] diff --git a/.github/workflows/db-mssql.yml b/.github/workflows/db-mssql.yml index 0050a3eee..73ed8168d 100644 --- a/.github/workflows/db-mssql.yml +++ b/.github/workflows/db-mssql.yml @@ -22,6 +22,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read jobs: build: name: PHP ${{ matrix.php }} @@ -61,13 +63,15 @@ jobs: sudo ACCEPT_EULA=Y apt-get install -y msodbcsql18 - name: Checkout. - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + with: + persist-credentials: false - name: Create MS SQL Database run: docker exec -i mssql /opt/mssql-tools18/bin/sqlcmd -C -S localhost -U SA -P 'YourStrong!Passw0rd' -Q 'CREATE DATABASE [ar-test]' - name: Install PHP with extensions. - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 with: php-version: ${{ matrix.php }} extensions: ${{ env.extensions }} @@ -78,7 +82,7 @@ jobs: run: composer remove --dev yiisoft/db-sqlite yiisoft/db-mysql yiisoft/db-pgsql yiisoft/db-oracle - name: Install required yiisoft/db and yiisoft/db-mssql - uses: yiisoft/actions/install-packages@master + uses: yiisoft/actions/install-packages@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: packages: >- ['db', 'db-mssql'] @@ -87,7 +91,7 @@ jobs: run: vendor/bin/phpunit --testsuite=Mssql --coverage-clover=coverage.xml --colors=always --display-warnings --display-deprecations - name: Upload coverage to Codecov. - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage.xml diff --git a/.github/workflows/db-mysql.yml b/.github/workflows/db-mysql.yml index 3426142de..c32957ab6 100644 --- a/.github/workflows/db-mysql.yml +++ b/.github/workflows/db-mysql.yml @@ -22,6 +22,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read jobs: build: name: PHP ${{ matrix.php }} @@ -43,7 +45,7 @@ jobs: services: mysql: - image: mysql:latest + image: mysql:9 env: MYSQL_ALLOW_EMPTY_PASSWORD: true MYSQL_DATABASE: ar-test @@ -55,10 +57,12 @@ jobs: steps: - name: Checkout. - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + with: + persist-credentials: false - name: Install PHP with extensions. - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 with: php-version: ${{ matrix.php }} extensions: ${{ env.extensions }} @@ -69,7 +73,7 @@ jobs: run: composer remove --dev yiisoft/db-sqlite yiisoft/db-pgsql yiisoft/db-mssql yiisoft/db-oracle - name: Install required yiisoft/db and yiisoft/db-mysql - uses: yiisoft/actions/install-packages@master + uses: yiisoft/actions/install-packages@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: packages: >- ['db', 'db-mysql'] @@ -78,7 +82,7 @@ jobs: run: vendor/bin/phpunit --testsuite=Mysql --coverage-clover=coverage.xml --colors=always --display-warnings --display-deprecations - name: Upload coverage to Codecov. - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage.xml diff --git a/.github/workflows/db-oracle.yml b/.github/workflows/db-oracle.yml index d548168ab..97164ca05 100644 --- a/.github/workflows/db-oracle.yml +++ b/.github/workflows/db-oracle.yml @@ -22,6 +22,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read jobs: build: name: PHP ${{ matrix.php }} @@ -43,7 +45,7 @@ jobs: services: oci: - image: gvenzl/oracle-xe:latest + image: gvenzl/oracle-xe:21 ports: - 1521:1521 env: @@ -63,10 +65,12 @@ jobs: run: docker exec -i oci bash -c "sqlplus -s system/root@XE <<< 'ALTER USER system DEFAULT TABLESPACE USERS;'" - name: Checkout. - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + with: + persist-credentials: false - name: Install PHP with extensions. - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 with: php-version: ${{ matrix.php }} extensions: ${{ env.extensions }} @@ -77,7 +81,7 @@ jobs: run: composer remove --dev yiisoft/db-sqlite yiisoft/db-mysql yiisoft/db-pgsql yiisoft/db-mssql - name: Install required yiisoft/db and yiisoft/db-oracle - uses: yiisoft/actions/install-packages@master + uses: yiisoft/actions/install-packages@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: packages: >- ['db', 'db-oracle'] @@ -86,7 +90,7 @@ jobs: run: vendor/bin/phpunit --testsuite=Oracle --coverage-clover=coverage.xml --colors=always --display-warnings --display-deprecations - name: Upload coverage to Codecov. - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage.xml diff --git a/.github/workflows/db-pgsql.yml b/.github/workflows/db-pgsql.yml index 02b28d480..b9da520d9 100644 --- a/.github/workflows/db-pgsql.yml +++ b/.github/workflows/db-pgsql.yml @@ -22,6 +22,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read jobs: build: name: PHP ${{ matrix.php }} @@ -53,10 +55,12 @@ jobs: steps: - name: Checkout. - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + with: + persist-credentials: false - name: Install PHP with extensions. - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 with: php-version: ${{ matrix.php }} extensions: ${{ env.extensions }} @@ -67,7 +71,7 @@ jobs: run: composer remove --dev yiisoft/db-sqlite yiisoft/db-mysql yiisoft/db-mssql yiisoft/db-oracle - name: Install required yiisoft/db and yiisoft/db-pgsql - uses: yiisoft/actions/install-packages@master + uses: yiisoft/actions/install-packages@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: packages: >- ['db', 'db-pgsql'] @@ -76,7 +80,7 @@ jobs: run: vendor/bin/phpunit --testsuite=Pgsql --coverage-clover=coverage.xml --colors=always --display-warnings --display-deprecations - name: Upload coverage to Codecov. - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage.xml diff --git a/.github/workflows/db-sqlite.yml b/.github/workflows/db-sqlite.yml index bd0b4722c..91f72eddd 100644 --- a/.github/workflows/db-sqlite.yml +++ b/.github/workflows/db-sqlite.yml @@ -22,6 +22,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read jobs: build: name: PHP ${{ matrix.php }}-sqlite-${{ matrix.os }} @@ -47,10 +49,12 @@ jobs: steps: - name: Checkout. - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + with: + persist-credentials: false - name: Install PHP with extensions. - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 with: php-version: ${{ matrix.php }} extensions: ${{ env.extensions }} @@ -61,7 +65,7 @@ jobs: run: composer remove --dev yiisoft/db-mysql yiisoft/db-pgsql yiisoft/db-mssql yiisoft/db-oracle - name: Install required yiisoft/db and yiisoft/db-sqlite - uses: yiisoft/actions/install-packages@master + uses: yiisoft/actions/install-packages@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: packages: >- ['db', 'db-sqlite'] @@ -70,7 +74,7 @@ jobs: run: vendor/bin/phpunit --testsuite=Sqlite --coverage-clover=coverage.xml --colors=always --display-warnings --display-deprecations - name: Upload coverage to Codecov. - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage.xml diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml index 6912041ba..9353e5de8 100644 --- a/.github/workflows/mutation.yml +++ b/.github/workflows/mutation.yml @@ -18,6 +18,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read jobs: mutation: name: PHP ${{ matrix.php }}-${{ matrix.os }} @@ -47,10 +49,12 @@ jobs: steps: - name: Checkout. - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + with: + persist-credentials: false - name: Install PHP with extensions. - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 with: php-version: ${{ matrix.php }} extensions: ${{ env.extensions }} @@ -61,10 +65,10 @@ jobs: run: composer remove --dev yiisoft/db-sqlite yiisoft/db-mysql yiisoft/db-mssql yiisoft/db-oracle - name: Install Composer dependencies - uses: ramsey/composer-install@v3 + uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f - name: Install required yiisoft/db and yiisoft/db-pgsql - uses: yiisoft/actions/install-packages@master + uses: yiisoft/actions/install-packages@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: packages: >- ['db', 'db-pgsql'] diff --git a/.github/workflows/rector-cs.yml b/.github/workflows/rector-cs.yml index 1bff7b99d..40178fb37 100644 --- a/.github/workflows/rector-cs.yml +++ b/.github/workflows/rector-cs.yml @@ -20,7 +20,7 @@ concurrency: jobs: rector: - uses: yiisoft/actions/.github/workflows/rector-cs.yml@master + uses: yiisoft/actions/.github/workflows/rector-cs.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: php: '8.1' required-packages: >- diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml index 2041ed935..f77596078 100644 --- a/.github/workflows/static.yml +++ b/.github/workflows/static.yml @@ -17,9 +17,11 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read jobs: psalm: - uses: yiisoft/actions/.github/workflows/psalm.yml@master + uses: yiisoft/actions/.github/workflows/psalm.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: php: >- ['8.1', '8.2', '8.3', '8.4', '8.5'] diff --git a/.github/workflows/update-readme-packages.yml b/.github/workflows/update-readme-packages.yml index ec988be9d..90a406c19 100644 --- a/.github/workflows/update-readme-packages.yml +++ b/.github/workflows/update-readme-packages.yml @@ -1,7 +1,7 @@ name: Update README packages on: - pull_request_target: + pull_request: paths: - '.github/workflows/update-readme-packages.yml' - 'composer.json' @@ -11,6 +11,6 @@ permissions: jobs: update-readme: - uses: yiisoft/actions/.github/workflows/update-readme-packages.yml@master + uses: yiisoft/actions/.github/workflows/update-readme-packages.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 secrets: TOKEN: ${{ secrets.YIISOFT_GITHUB_TOKEN }} From 6661b750d32a0769d979539cfd63a4e7baba0d02 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 02:06:57 +0300 Subject: [PATCH 02/15] Add zizmorify configuration --- .github/dependabot.yml | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d7ebdbfdb..6cc00712d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,16 +1,8 @@ version: 2 updates: - # Maintain dependencies for GitHub Actions. - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "daily" - # Too noisy. See https://github.community/t/increase-if-necessary-for-github-actions-in-dependabot/179581 - open-pull-requests-limit: 0 - - # Maintain dependencies for Composer - - package-ecosystem: "composer" - directory: "/" - schedule: - interval: "daily" - versioning-strategy: increase-if-necessary + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7 From 4026e0dc24224e19f687a8e56f51e821106454b8 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 02:31:35 +0300 Subject: [PATCH 03/15] Add zizmorify workflow --- .github/workflows/zizmor.yml | 37 ++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 000000000..e9b7e067e --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,37 @@ +name: GitHub Actions Security Analysis with zizmor 🌈 + +on: + push: + branches: + - main + paths: + - '.github/**.yml' + - '.github/**.yaml' + pull_request: + paths: + - '.github/**.yml' + - '.github/**.yaml' + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + zizmor: + name: Run zizmor 🌈 + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Run zizmor 🌈 + uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 + with: + advanced-security: false + annotations: true + persona: 'pedantic' From e4384c44fbed01dec404ad34ef170eee8cc28c12 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 12:01:07 +0300 Subject: [PATCH 04/15] Restore Dependabot non-GitHub-Actions updates --- .github/dependabot.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6cc00712d..cb0e7a1ea 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,5 +1,19 @@ version: 2 updates: + # Maintain dependencies for GitHub Actions. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "daily" + # Too noisy. See https://github.community/t/increase-if-necessary-for-github-actions-in-dependabot/179581 + open-pull-requests-limit: 0 + + # Maintain dependencies for Composer + - package-ecosystem: "composer" + directory: "/" + schedule: + interval: "daily" + versioning-strategy: increase-if-necessary - package-ecosystem: "github-actions" directory: "/" schedule: From caa3f4972061b777648dda57b00252fd8cfeb950 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sat, 20 Jun 2026 11:36:11 +0300 Subject: [PATCH 05/15] Use master for yiisoft actions --- .github/workflows/bc.yml | 2 +- .github/workflows/composer-require-checker.yml | 2 +- .github/workflows/db-mssql.yml | 2 +- .github/workflows/db-mysql.yml | 2 +- .github/workflows/db-oracle.yml | 2 +- .github/workflows/db-pgsql.yml | 2 +- .github/workflows/db-sqlite.yml | 2 +- .github/workflows/mutation.yml | 2 +- .github/workflows/rector-cs.yml | 2 +- .github/workflows/static.yml | 2 +- .github/workflows/update-readme-packages.yml | 2 +- .github/zizmor.yml | 5 +++++ 12 files changed, 16 insertions(+), 11 deletions(-) create mode 100644 .github/zizmor.yml diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml index ea4ab51c8..94ed26c69 100644 --- a/.github/workflows/bc.yml +++ b/.github/workflows/bc.yml @@ -16,7 +16,7 @@ permissions: jobs: roave_bc_check: - uses: yiisoft/actions/.github/workflows/bc.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/bc.yml@master with: php: >- ['8.5'] diff --git a/.github/workflows/composer-require-checker.yml b/.github/workflows/composer-require-checker.yml index c26f38de1..4dcc19e19 100644 --- a/.github/workflows/composer-require-checker.yml +++ b/.github/workflows/composer-require-checker.yml @@ -20,7 +20,7 @@ permissions: contents: read jobs: composer-require-checker: - uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@master with: php: >- ['8.1', '8.2', '8.3', '8.4', '8.5'] diff --git a/.github/workflows/db-mssql.yml b/.github/workflows/db-mssql.yml index 73ed8168d..583426f57 100644 --- a/.github/workflows/db-mssql.yml +++ b/.github/workflows/db-mssql.yml @@ -82,7 +82,7 @@ jobs: run: composer remove --dev yiisoft/db-sqlite yiisoft/db-mysql yiisoft/db-pgsql yiisoft/db-oracle - name: Install required yiisoft/db and yiisoft/db-mssql - uses: yiisoft/actions/install-packages@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/install-packages@master with: packages: >- ['db', 'db-mssql'] diff --git a/.github/workflows/db-mysql.yml b/.github/workflows/db-mysql.yml index c32957ab6..7dd7dfedb 100644 --- a/.github/workflows/db-mysql.yml +++ b/.github/workflows/db-mysql.yml @@ -73,7 +73,7 @@ jobs: run: composer remove --dev yiisoft/db-sqlite yiisoft/db-pgsql yiisoft/db-mssql yiisoft/db-oracle - name: Install required yiisoft/db and yiisoft/db-mysql - uses: yiisoft/actions/install-packages@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/install-packages@master with: packages: >- ['db', 'db-mysql'] diff --git a/.github/workflows/db-oracle.yml b/.github/workflows/db-oracle.yml index 97164ca05..41704a6b9 100644 --- a/.github/workflows/db-oracle.yml +++ b/.github/workflows/db-oracle.yml @@ -81,7 +81,7 @@ jobs: run: composer remove --dev yiisoft/db-sqlite yiisoft/db-mysql yiisoft/db-pgsql yiisoft/db-mssql - name: Install required yiisoft/db and yiisoft/db-oracle - uses: yiisoft/actions/install-packages@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/install-packages@master with: packages: >- ['db', 'db-oracle'] diff --git a/.github/workflows/db-pgsql.yml b/.github/workflows/db-pgsql.yml index b9da520d9..e2f30a50c 100644 --- a/.github/workflows/db-pgsql.yml +++ b/.github/workflows/db-pgsql.yml @@ -71,7 +71,7 @@ jobs: run: composer remove --dev yiisoft/db-sqlite yiisoft/db-mysql yiisoft/db-mssql yiisoft/db-oracle - name: Install required yiisoft/db and yiisoft/db-pgsql - uses: yiisoft/actions/install-packages@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/install-packages@master with: packages: >- ['db', 'db-pgsql'] diff --git a/.github/workflows/db-sqlite.yml b/.github/workflows/db-sqlite.yml index 91f72eddd..68cb037b4 100644 --- a/.github/workflows/db-sqlite.yml +++ b/.github/workflows/db-sqlite.yml @@ -65,7 +65,7 @@ jobs: run: composer remove --dev yiisoft/db-mysql yiisoft/db-pgsql yiisoft/db-mssql yiisoft/db-oracle - name: Install required yiisoft/db and yiisoft/db-sqlite - uses: yiisoft/actions/install-packages@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/install-packages@master with: packages: >- ['db', 'db-sqlite'] diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml index 9353e5de8..bfa19a81e 100644 --- a/.github/workflows/mutation.yml +++ b/.github/workflows/mutation.yml @@ -68,7 +68,7 @@ jobs: uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f - name: Install required yiisoft/db and yiisoft/db-pgsql - uses: yiisoft/actions/install-packages@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/install-packages@master with: packages: >- ['db', 'db-pgsql'] diff --git a/.github/workflows/rector-cs.yml b/.github/workflows/rector-cs.yml index 40178fb37..1bff7b99d 100644 --- a/.github/workflows/rector-cs.yml +++ b/.github/workflows/rector-cs.yml @@ -20,7 +20,7 @@ concurrency: jobs: rector: - uses: yiisoft/actions/.github/workflows/rector-cs.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/rector-cs.yml@master with: php: '8.1' required-packages: >- diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml index f77596078..64f73a00f 100644 --- a/.github/workflows/static.yml +++ b/.github/workflows/static.yml @@ -21,7 +21,7 @@ permissions: contents: read jobs: psalm: - uses: yiisoft/actions/.github/workflows/psalm.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/psalm.yml@master with: php: >- ['8.1', '8.2', '8.3', '8.4', '8.5'] diff --git a/.github/workflows/update-readme-packages.yml b/.github/workflows/update-readme-packages.yml index 90a406c19..f4e13aab0 100644 --- a/.github/workflows/update-readme-packages.yml +++ b/.github/workflows/update-readme-packages.yml @@ -11,6 +11,6 @@ permissions: jobs: update-readme: - uses: yiisoft/actions/.github/workflows/update-readme-packages.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/update-readme-packages.yml@master secrets: TOKEN: ${{ secrets.YIISOFT_GITHUB_TOKEN }} diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 000000000..85ca7982a --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,5 @@ +rules: + unpinned-uses: + config: + policies: + "yiisoft/*": any From a2abf1be3dd9956600532e5002f23ec1960c3e8c Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sat, 20 Jun 2026 11:36:17 +0300 Subject: [PATCH 06/15] Use master for yiisoft actions --- .github/zizmor.yml | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .github/zizmor.yml diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 000000000..85ca7982a --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,5 @@ +rules: + unpinned-uses: + config: + policies: + "yiisoft/*": any From 9233b1f728be8604a000d08b91db17b698a97c7b Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sat, 20 Jun 2026 12:05:48 +0300 Subject: [PATCH 07/15] Use master for yiisoft actions --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d7ebdbfdb..426dc2b07 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,8 @@ updates: open-pull-requests-limit: 0 # Maintain dependencies for Composer + ignore: + - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: From 7789ce5b087eccb71388b3622f412f25ace8e649 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sat, 20 Jun 2026 12:05:53 +0300 Subject: [PATCH 08/15] Use master for yiisoft actions --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index cb0e7a1ea..763f70808 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,8 @@ updates: open-pull-requests-limit: 0 # Maintain dependencies for Composer + ignore: + - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: @@ -20,3 +22,5 @@ updates: interval: "weekly" cooldown: default-days: 7 + ignore: + - dependency-name: "yiisoft/*" From db1bb7d3e160524af446bdd245d26bf49577822e Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sun, 21 Jun 2026 15:04:13 +0300 Subject: [PATCH 09/15] Remove redundant zizmor config --- .github/zizmor.yml | 5 ----- 1 file changed, 5 deletions(-) delete mode 100644 .github/zizmor.yml diff --git a/.github/zizmor.yml b/.github/zizmor.yml deleted file mode 100644 index 85ca7982a..000000000 --- a/.github/zizmor.yml +++ /dev/null @@ -1,5 +0,0 @@ -rules: - unpinned-uses: - config: - policies: - "yiisoft/*": any From 2dc1fc612af0b660c872b90f04ef15e2e891a92b Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Wed, 24 Jun 2026 15:59:53 +0300 Subject: [PATCH 10/15] Remove redundant dependabot change --- .github/dependabot.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 426dc2b07..d7ebdbfdb 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,8 +9,6 @@ updates: open-pull-requests-limit: 0 # Maintain dependencies for Composer - ignore: - - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: From efaf76515be95b9cf7ac85a108e09b9de54c49cc Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Wed, 24 Jun 2026 16:30:42 +0300 Subject: [PATCH 11/15] Revert "Remove redundant dependabot change" This reverts commit 2dc1fc612af0b660c872b90f04ef15e2e891a92b. --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d7ebdbfdb..426dc2b07 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,8 @@ updates: open-pull-requests-limit: 0 # Maintain dependencies for Composer + ignore: + - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: From 9e13467e027373e3bf9b45d3f9bb3dd20857f9ea Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Wed, 24 Jun 2026 17:54:05 +0300 Subject: [PATCH 12/15] Normalize Dependabot GitHub Actions updates --- .github/dependabot.yml | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 763f70808..01264e0b7 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,6 +1,6 @@ version: 2 updates: - # Maintain dependencies for GitHub Actions. + - package-ecosystem: "github-actions"\n directory: "/"\n schedule:\n interval: "weekly"\n cooldown:\n default-days: 7\n ignore:\n - dependency-name: "yiisoft/*"\n # Maintain dependencies for GitHub Actions. - package-ecosystem: "github-actions" directory: "/" schedule: @@ -9,18 +9,8 @@ updates: open-pull-requests-limit: 0 # Maintain dependencies for Composer - ignore: - - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: interval: "daily" versioning-strategy: increase-if-necessary - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - cooldown: - default-days: 7 - ignore: - - dependency-name: "yiisoft/*" From 6205259bc1ad16b2a3e03b3bb9f59a7dfcf0a4fd Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Wed, 24 Jun 2026 22:38:40 +0300 Subject: [PATCH 13/15] Fix Dependabot GitHub Actions updates --- .github/dependabot.yml | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 01264e0b7..a4c1ef2b0 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,16 +1,18 @@ version: 2 updates: - - package-ecosystem: "github-actions"\n directory: "/"\n schedule:\n interval: "weekly"\n cooldown:\n default-days: 7\n ignore:\n - dependency-name: "yiisoft/*"\n # Maintain dependencies for GitHub Actions. - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "daily" - # Too noisy. See https://github.community/t/increase-if-necessary-for-github-actions-in-dependabot/179581 - open-pull-requests-limit: 0 + # Maintain dependencies for GitHub Actions. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7 + ignore: + - dependency-name: "yiisoft/*" - # Maintain dependencies for Composer - - package-ecosystem: "composer" - directory: "/" - schedule: - interval: "daily" - versioning-strategy: increase-if-necessary + # Maintain dependencies for Composer + - package-ecosystem: "composer" + directory: "/" + schedule: + interval: "daily" + versioning-strategy: increase-if-necessary From 840ad2eb806b1c662c04f2333285b4491c14313f Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Thu, 25 Jun 2026 00:45:46 +0300 Subject: [PATCH 14/15] Fix zizmor workflow findings --- .github/dependabot.yml | 2 ++ .github/workflows/zizmor.yml | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a4c1ef2b0..5fd269dae 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -16,3 +16,5 @@ updates: schedule: interval: "daily" versioning-strategy: increase-if-necessary + cooldown: + default-days: 7 diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 94658469a..430255de4 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -14,8 +14,8 @@ on: - '.github/**.yaml' permissions: - actions: read - contents: read + actions: read # Required by zizmor when reading workflow metadata through the API. + contents: read # Required to read workflow files. jobs: zizmor: From 53bd1fc069befac9d2886ab270a6f532f396f2f6 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Thu, 2 Jul 2026 20:03:56 +0300 Subject: [PATCH 15/15] Fix zizmor workflow findings --- .github/workflows/db-mssql.yml | 8 ++++---- .github/workflows/db-mysql.yml | 8 ++++---- .github/workflows/db-oracle.yml | 8 ++++---- .github/workflows/db-pgsql.yml | 8 ++++---- .github/workflows/db-sqlite.yml | 6 +++--- .github/workflows/mutation.yml | 8 ++++---- .github/workflows/rector-cs.yml | 4 +++- 7 files changed, 26 insertions(+), 24 deletions(-) diff --git a/.github/workflows/db-mssql.yml b/.github/workflows/db-mssql.yml index 583426f57..95f8afcb7 100644 --- a/.github/workflows/db-mssql.yml +++ b/.github/workflows/db-mssql.yml @@ -45,7 +45,7 @@ jobs: services: mssql: - image: mcr.microsoft.com/mssql/server:2022-latest + image: mcr.microsoft.com/mssql/server:2022-latest@sha256:e07b9699a2b749969f19d86563ceeea22bd3a69f7f1db85a8d1ac4bdaf0c6f56 env: SA_PASSWORD: YourStrong!Passw0rd ACCEPT_EULA: Y @@ -63,7 +63,7 @@ jobs: sudo ACCEPT_EULA=Y apt-get install -y msodbcsql18 - name: Checkout. - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: persist-credentials: false @@ -71,7 +71,7 @@ jobs: run: docker exec -i mssql /opt/mssql-tools18/bin/sqlcmd -C -S localhost -U SA -P 'YourStrong!Passw0rd' -Q 'CREATE DATABASE [ar-test]' - name: Install PHP with extensions. - uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: ${{ matrix.php }} extensions: ${{ env.extensions }} @@ -91,7 +91,7 @@ jobs: run: vendor/bin/phpunit --testsuite=Mssql --coverage-clover=coverage.xml --colors=always --display-warnings --display-deprecations - name: Upload coverage to Codecov. - uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 + uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage.xml diff --git a/.github/workflows/db-mysql.yml b/.github/workflows/db-mysql.yml index 7dd7dfedb..19342f989 100644 --- a/.github/workflows/db-mysql.yml +++ b/.github/workflows/db-mysql.yml @@ -45,7 +45,7 @@ jobs: services: mysql: - image: mysql:9 + image: mysql:9@sha256:55e529b57e06b3da98df40600de2245a0ab4bb4b979e3ead4339349b0b50bf4a env: MYSQL_ALLOW_EMPTY_PASSWORD: true MYSQL_DATABASE: ar-test @@ -57,12 +57,12 @@ jobs: steps: - name: Checkout. - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: persist-credentials: false - name: Install PHP with extensions. - uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: ${{ matrix.php }} extensions: ${{ env.extensions }} @@ -82,7 +82,7 @@ jobs: run: vendor/bin/phpunit --testsuite=Mysql --coverage-clover=coverage.xml --colors=always --display-warnings --display-deprecations - name: Upload coverage to Codecov. - uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 + uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage.xml diff --git a/.github/workflows/db-oracle.yml b/.github/workflows/db-oracle.yml index 41704a6b9..7a129cfbf 100644 --- a/.github/workflows/db-oracle.yml +++ b/.github/workflows/db-oracle.yml @@ -45,7 +45,7 @@ jobs: services: oci: - image: gvenzl/oracle-xe:21 + image: gvenzl/oracle-xe:21@sha256:c2682a4216b0fe65537912c4a049c7e5c15a85bb7c94bb8137d5f2d2eef60603 ports: - 1521:1521 env: @@ -65,12 +65,12 @@ jobs: run: docker exec -i oci bash -c "sqlplus -s system/root@XE <<< 'ALTER USER system DEFAULT TABLESPACE USERS;'" - name: Checkout. - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: persist-credentials: false - name: Install PHP with extensions. - uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: ${{ matrix.php }} extensions: ${{ env.extensions }} @@ -90,7 +90,7 @@ jobs: run: vendor/bin/phpunit --testsuite=Oracle --coverage-clover=coverage.xml --colors=always --display-warnings --display-deprecations - name: Upload coverage to Codecov. - uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 + uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage.xml diff --git a/.github/workflows/db-pgsql.yml b/.github/workflows/db-pgsql.yml index e2f30a50c..c379c175a 100644 --- a/.github/workflows/db-pgsql.yml +++ b/.github/workflows/db-pgsql.yml @@ -44,7 +44,7 @@ jobs: services: postgres: - image: postgres:18 + image: postgres:18@sha256:8d526a5b3f29da6d7835ebdab8e3393958e09608e21fd848c32b9187b4a1e1ce env: POSTGRES_DB: ar-test POSTGRES_USER: yii @@ -55,12 +55,12 @@ jobs: steps: - name: Checkout. - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: persist-credentials: false - name: Install PHP with extensions. - uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: ${{ matrix.php }} extensions: ${{ env.extensions }} @@ -80,7 +80,7 @@ jobs: run: vendor/bin/phpunit --testsuite=Pgsql --coverage-clover=coverage.xml --colors=always --display-warnings --display-deprecations - name: Upload coverage to Codecov. - uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 + uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 # v3.1.6 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage.xml diff --git a/.github/workflows/db-sqlite.yml b/.github/workflows/db-sqlite.yml index 68cb037b4..4c51a8206 100644 --- a/.github/workflows/db-sqlite.yml +++ b/.github/workflows/db-sqlite.yml @@ -49,12 +49,12 @@ jobs: steps: - name: Checkout. - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: persist-credentials: false - name: Install PHP with extensions. - uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: ${{ matrix.php }} extensions: ${{ env.extensions }} @@ -74,7 +74,7 @@ jobs: run: vendor/bin/phpunit --testsuite=Sqlite --coverage-clover=coverage.xml --colors=always --display-warnings --display-deprecations - name: Upload coverage to Codecov. - uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 + uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage.xml diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml index bfa19a81e..33a9ad8de 100644 --- a/.github/workflows/mutation.yml +++ b/.github/workflows/mutation.yml @@ -38,7 +38,7 @@ jobs: services: postgres: - image: postgres:18 + image: postgres:18@sha256:8d526a5b3f29da6d7835ebdab8e3393958e09608e21fd848c32b9187b4a1e1ce env: POSTGRES_DB: ar-test POSTGRES_USER: yii @@ -49,12 +49,12 @@ jobs: steps: - name: Checkout. - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: persist-credentials: false - name: Install PHP with extensions. - uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: ${{ matrix.php }} extensions: ${{ env.extensions }} @@ -65,7 +65,7 @@ jobs: run: composer remove --dev yiisoft/db-sqlite yiisoft/db-mysql yiisoft/db-mssql yiisoft/db-oracle - name: Install Composer dependencies - uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f + uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f # 3.2.1 - name: Install required yiisoft/db and yiisoft/db-pgsql uses: yiisoft/actions/install-packages@master diff --git a/.github/workflows/rector-cs.yml b/.github/workflows/rector-cs.yml index 1bff7b99d..3f04c69fa 100644 --- a/.github/workflows/rector-cs.yml +++ b/.github/workflows/rector-cs.yml @@ -12,7 +12,7 @@ on: - '.php-cs-fixer.dist.php' permissions: - contents: write + contents: read concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -21,6 +21,8 @@ concurrency: jobs: rector: uses: yiisoft/actions/.github/workflows/rector-cs.yml@master + permissions: + contents: write # Required by the reusable workflow to commit Rector and PHP CS Fixer changes. with: php: '8.1' required-packages: >-