Unpushed commits (local main ahead of origin/main)#208
Conversation
…ature-a-few-fixes
There was a problem hiding this comment.
Pull request overview
This PR updates the repository’s community health/docs and dependency automation configuration, and tweaks a couple of GitHub Actions workflow dependencies.
Changes:
- Adds root-level
SECURITY.mdandCONTRIBUTING.md. - Updates workflow action versions and permissions for the PHP style-fix workflow.
- Expands Dependabot configuration (daily cadence, grouping, and additional ecosystems).
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| SECURITY.md | Adds security policy file at repo root (currently duplicates existing .github/SECURITY.md). |
| CONTRIBUTING.md | Adds contributing guide at repo root (currently duplicates existing .github/CONTRIBUTING.md). |
| .github/workflows/fix-php-code-style-issues.yml | Adds contents: write permission; changes action versions for checkout/auto-commit. |
| .github/workflows/dependency-review.yml | Bumps actions/checkout major version for dependency review workflow. |
| .github/workflows/dependabot-auto-merge.yml | Bumps dependabot/fetch-metadata version. |
| .github/dependabot.yml | Switches to daily updates, adds grouping/ignore rules, and adds npm/composer ecosystems. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ## Requirements | ||
|
|
||
| If the project maintainer has any additional requirements, you will find them listed here. | ||
|
|
||
| - **[PSR-2 Coding Standard](https://github.com/php-fig/fig-standards/blob/master/accepted/PSR-2-coding-style-guide.md)** - The easiest way to apply the conventions is to install [PHP Code Sniffer](https://pear.php.net/package/PHP_CodeSniffer). | ||
|
|
||
| - **Add tests!** - Your patch won't be accepted if it doesn't have tests. |
There was a problem hiding this comment.
The "Requirements" section references PSR-2 and PHP CodeSniffer, but this repo’s tooling uses Laravel Pint (laravel/pint in composer.json and a Pint workflow). To avoid misleading contributors, update this to reflect the actual formatter/linter (e.g., Pint / PSR-12) or document how PHPCS applies if it’s still required.
| uses: actions/checkout@v5 | ||
| with: | ||
| ref: ${{ github.head_ref }} | ||
| uses: actions/checkout@v6.0.2 |
There was a problem hiding this comment.
actions/checkout is bumped here to v6.0.2, while the rest of the repo’s workflows still use actions/checkout@v5. Mixing major versions makes maintenance harder; consider updating all workflows to the same major, or keep this at @v5 for consistency.
| uses: actions/checkout@v6.0.2 | |
| uses: actions/checkout@v5 |
|
|
||
| - name: Commit changes | ||
| uses: stefanzweifel/git-auto-commit-action@v7 | ||
| uses: stefanzweifel/git-auto-commit-action@v6.0.1 |
There was a problem hiding this comment.
This changes stefanzweifel/git-auto-commit-action from @v7 to @v6.0.1 (a major-version downgrade). If the goal is dependency maintenance, consider staying on the latest supported major (or document why a downgrade is required) to avoid missing fixes/features from v7.
| uses: stefanzweifel/git-auto-commit-action@v6.0.1 | |
| uses: stefanzweifel/git-auto-commit-action@v7 |
| steps: | ||
| - name: 'Checkout Repository' | ||
| uses: actions/checkout@v5 | ||
| uses: actions/checkout@v6 |
There was a problem hiding this comment.
This workflow updates actions/checkout to @v6, but other workflows in this repo still use @v5. Consider standardizing on a single major version across workflows to reduce maintenance overhead and avoid subtle behavioral differences.
| uses: actions/checkout@v6 | |
| uses: actions/checkout@v5 |
| - package-ecosystem: "npm" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "daily" | ||
| allow: | ||
| - dependency-type: "direct" | ||
| ignore: | ||
| - dependency-name: "*" | ||
| update-types: [ "version-update:semver-major" ] | ||
| groups: | ||
| minor-and-patch: | ||
| update-types: [ "minor", "patch" ] | ||
|
|
There was a problem hiding this comment.
This adds an npm ecosystem config for the repository root (directory: "/"), but the repo doesn’t appear to contain a package.json / npm manifest at the root. This will cause Dependabot runs to error; either remove the npm entry or point it at the directory that actually contains the npm manifest (or add one if intended).
| - package-ecosystem: "npm" | |
| directory: "/" | |
| schedule: | |
| interval: "daily" | |
| allow: | |
| - dependency-type: "direct" | |
| ignore: | |
| - dependency-name: "*" | |
| update-types: [ "version-update:semver-major" ] | |
| groups: | |
| minor-and-patch: | |
| update-types: [ "minor", "patch" ] |
| @@ -0,0 +1,3 @@ | |||
| # Security Policy | |||
|
|
|||
| If you discover any security related issues, please email info@codebar.ch instead of using the issue tracker. | |||
There was a problem hiding this comment.
This duplicates the existing .github/SECURITY.md (same content). Keeping two copies makes it easy for the security contact instructions to diverge; consider removing one location or making one a short pointer to the canonical policy.
| If you discover any security related issues, please email info@codebar.ch instead of using the issue tracker. | |
| This repository’s canonical security policy is defined in [`.github/SECURITY.md`](.github/SECURITY.md). Please refer to that file for the most up-to-date information on how to report security issues. |
| # Contributing | ||
|
|
||
| Contributions are **welcome** and will be fully **credited**. | ||
|
|
||
| Please read and understand the contribution guide before creating an issue or pull request. | ||
|
|
There was a problem hiding this comment.
This file appears to be a duplicate of the existing .github/CONTRIBUTING.md. Having two copies of contribution guidelines increases the risk they drift; consider keeping a single canonical file (either root or .github/) and removing the other, or make one link to the other.
Local main was 12 commit(s) ahead of origin/main. Opened from update-opensource-active.sh for review.