[TASK] Harden GitHub Actions by eliashaeussler · Pull Request #636 · eliashaeussler/cache-warmup

eliashaeussler · 2026-05-19T20:06:02Z

Summary by CodeRabbit

Release Notes

Chores

Strengthened CI/CD security with explicit permission configurations and improved credential handling across all build workflows
Integrated automated security scanning into the continuous integration pipeline
Enhanced release process automation with refined checkout configurations and credential management
Optimized build caching behavior for improved workflow efficiency and faster builds

coderabbitai · 2026-05-19T20:06:16Z

Warning

Rate limit exceeded

@eliashaeussler has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 54 minutes and 54 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 43e0d466-104c-4c9a-a8b1-19d24f27170e

📥 Commits

Reviewing files that changed from the base of the PR and between 434c35e and 142b99e.

📒 Files selected for processing (3)

.github/workflows/cgl.yaml
.github/workflows/release.yaml
.github/workflows/tests.yaml

Walkthrough

The PR hardens GitHub Actions workflows by declaring explicit permissions blocks and disabling checkout credential persistence across three workflows. It adds Zizmor security scanning to the cgl workflow and modernizes the release workflow by introducing a shared environment variable for tag handling, updating caching strategies, and replacing the release-action action with a native gh CLI release command.

Changes

Workflow Security and Release Modernization

Layer / File(s)	Summary
Permissions and checkout security hardening `.github/workflows/cgl.yaml`, `.github/workflows/tests.yaml`, `.github/workflows/release.yaml`	Explicit workflow and job-level `permissions` blocks are added across all three workflows, granting read-only access to `contents` and other necessary permissions. All checkout steps are updated to set `persist-credentials: false`, disabling credential persistence in the `tests`, `coverage`, `coverage-report`, `e2e`, `cgl`, `phar`, `docker`, and `release` jobs.
Code quality scanning enhancement `.github/workflows/cgl.yaml`	A new "Run zizmor" step using `zizmorcore/zizmor-action` is added to the cgl job after the migration/rector dry-run section.
Release workflow modernization `.github/workflows/release.yaml`	The release workflow introduces a global `REF_NAME` environment variable derived from `github.ref_name` for consistent tag handling. The `phar`, `docker`, and `release` jobs add explicit permissions and update checkout configuration. Composer installation is adjusted to ignore cache. Docker metadata and tag validation logic switch to use `REF_NAME`. The `docs` job updates checkout credentials and changes Node caching from `cache: npm` to `package-manager-cache: false`. The `release` job replaces `ncipollo/release-action` with a `gh release create` command, using `GH_TOKEN` and the compiled PHAR and its detached signature as artifacts with `--generate-notes`.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change across all three workflow files: adding security hardening measures (permissions, persist-credentials settings, and new Zizmor scanning).
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-advanced-security · 2026-05-19T20:07:10Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

coveralls · 2026-05-19T20:08:09Z

Coverage Report for CI Build 26122437111

Coverage remained the same at 90.01%

Details

Coverage remained the same as the base build.
Patch coverage: No coverable lines changed in this PR.
No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

Coverage Stats


Relevant Lines:	1982
Covered Lines:	1784
Line Coverage:	90.01%
Coverage Strength:	10.18 hits per line

💛 - Coveralls

coderabbitai

Actionable comments posted: 2

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3246ddd0-7ce9-4bc2-9743-7653e7654f07

📥 Commits

Reviewing files that changed from the base of the PR and between 0133090 and 434c35e.

📒 Files selected for processing (3)

.github/workflows/cgl.yaml
.github/workflows/release.yaml
.github/workflows/tests.yaml

eliashaeussler added the maintenance Code base is being maintained label May 19, 2026

eliashaeussler self-assigned this May 19, 2026

github-advanced-security AI found potential problems May 19, 2026

View reviewed changes

Comment thread .github/workflows/cgl.yaml Fixed

coderabbitai Bot reviewed May 19, 2026

View reviewed changes

Comment thread .github/workflows/release.yaml Outdated

Comment thread .github/workflows/release.yaml Outdated

[TASK] Harden GitHub Actions

142b99e

eliashaeussler force-pushed the task/actions branch from 434c35e to 142b99e Compare May 19, 2026 20:11

eliashaeussler had a problem deploying to github-pages May 19, 2026 20:15 — with GitHub Actions Failure

eliashaeussler temporarily deployed to github-pages May 19, 2026 20:16 — with GitHub Actions Inactive

eliashaeussler merged commit bd75701 into main May 19, 2026
34 of 35 checks passed

eliashaeussler deleted the task/actions branch May 19, 2026 20:17

coderabbitai Bot mentioned this pull request May 23, 2026

[TASK] Use reusable workflows and actions #641

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[TASK] Harden GitHub Actions#636

[TASK] Harden GitHub Actions#636
eliashaeussler merged 1 commit into
mainfrom
task/actions

eliashaeussler commented May 19, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 19, 2026 •

edited

Loading

Rate limit exceeded

Uh oh!

github-advanced-security AI commented May 19, 2026

Uh oh!

Uh oh!

coveralls commented May 19, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

eliashaeussler commented May 19, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Release Notes

Uh oh!

coderabbitai Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Walkthrough

Changes

Uh oh!

github-advanced-security AI commented May 19, 2026

What Enabling Code Scanning Means:

Uh oh!

Uh oh!

coveralls commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report for CI Build 26122437111

Coverage remained the same at 90.01%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

eliashaeussler commented May 19, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 19, 2026 •

edited

Loading

coveralls commented May 19, 2026 •

edited

Loading