Skip to content

Commit 6b3e056

Browse files
danharrindanharrin
committed
Update GH actions security
1 parent b3262c4 commit 6b3e056

8 files changed

Lines changed: 155 additions & 83 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,5 +8,9 @@ updates:
88
directory: "/"
99
schedule:
1010
interval: "weekly"
11+
open-pull-requests-limit: 10
12+
cooldown:
13+
default-days: 7
1114
labels:
12-
- "dependencies"
15+
- "dependencies"
16+
- "github_actions"

‎.github/workflows/dependabot-auto-merge.yml‎

Lines changed: 0 additions & 33 deletions
This file was deleted.

‎.github/workflows/fix-code-style.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: fix-code-style
2+
3+
on:
4+
push:
5+
paths:
6+
- '**.php'
7+
8+
permissions:
9+
contents: write
10+
11+
jobs:
12+
fix-code-style:
13+
runs-on: ubuntu-latest
14+
steps:
15+
# persist-credentials: true is required so `git-auto-commit-action` below
16+
# can push the reformatted files back to the branch.
17+
- name: Checkout code
18+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked]
19+
20+
- name: Cache Composer dependencies
21+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
22+
with:
23+
path: ~/.composer/cache/files
24+
key: composer-cs-${{ hashFiles('composer.json') }}
25+
restore-keys: |
26+
composer-cs-
27+
28+
- name: Setup PHP
29+
uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
30+
with:
31+
php-version: 8.3
32+
33+
- name: Install dependencies
34+
run: composer install --no-interaction --no-scripts
35+
36+
- name: Run Pint
37+
run: ./vendor/bin/pint
38+
39+
- name: Commit changes
40+
uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
41+
with:
42+
commit_message: Fix styling

‎.github/workflows/fix-php-code-style-issues.yml‎

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎.github/workflows/phpstan.yml‎

Lines changed: 51 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,67 @@
1-
name: PHPStan
1+
name: phpstan
22

33
on:
44
push:
5-
paths:
6-
- '**.php'
7-
- 'phpstan.neon.dist'
5+
pull_request:
6+
7+
permissions:
8+
contents: read
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
12+
cancel-in-progress: true
813

914
jobs:
1015
phpstan:
11-
name: phpstan
1216
runs-on: ubuntu-latest
17+
strategy:
18+
fail-fast: false
19+
matrix:
20+
php: [8.3, 8.2, 8.1]
21+
laravel: [11.*, 10.*]
22+
stability: [prefer-stable]
23+
include:
24+
- laravel: 11.*
25+
testbench: 9.*
26+
- laravel: 10.*
27+
testbench: 8.*
28+
exclude:
29+
- laravel: 11.*
30+
php: 8.1
31+
name: P${{ matrix.php }} - L${{ matrix.laravel }} - ${{ matrix.stability }}
1332
steps:
14-
- uses: actions/checkout@v4
33+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
34+
with:
35+
persist-credentials: false
36+
37+
- name: Cache Composer dependencies
38+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
39+
with:
40+
path: ~/.composer/cache/files
41+
key: composer-${{ matrix.php }}-${{ matrix.laravel }}-${{ hashFiles('composer.json') }}
42+
restore-keys: |
43+
composer-${{ matrix.php }}-${{ matrix.laravel }}-
44+
composer-${{ matrix.php }}-
45+
46+
- name: Cache PHPStan result
47+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
48+
with:
49+
path: /tmp/phpstan
50+
key: phpstan-${{ matrix.php }}-${{ matrix.laravel }}-${{ github.sha }}
51+
restore-keys: |
52+
phpstan-${{ matrix.php }}-${{ matrix.laravel }}-
1553
1654
- name: Setup PHP
17-
uses: shivammathur/setup-php@v2
55+
uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
1856
with:
19-
php-version: '8.1'
57+
php-version: ${{ matrix.php }}
58+
extensions: mbstring, pdo, pdo_sqlite
2059
coverage: none
2160

22-
- name: Install composer dependencies
23-
uses: ramsey/composer-install@v3
61+
- name: Install dependencies
62+
run: |
63+
composer require "laravel/framework:${{ matrix.laravel }}" "orchestra/testbench:${{ matrix.testbench }}" --no-interaction --no-update
64+
composer update --${{ matrix.stability }} --prefer-dist --no-interaction
2465
2566
- name: Run PHPStan
2667
run: ./vendor/bin/phpstan --error-format=github

.github/workflows/run-tests.yml renamed to .github/workflows/tests.yml

Lines changed: 23 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
1-
name: run-tests
1+
name: tests
22

33
on:
44
push:
5-
branches: [main]
65
pull_request:
7-
branches: [main]
6+
7+
permissions:
8+
contents: read
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
12+
cancel-in-progress: true
813

914
jobs:
10-
test:
15+
run-tests:
1116
runs-on: ${{ matrix.os }}
1217
strategy:
1318
fail-fast: true
@@ -30,11 +35,21 @@ jobs:
3035
name: P${{ matrix.php }} - L${{ matrix.laravel }} - ${{ matrix.stability }} - ${{ matrix.os }}
3136

3237
steps:
33-
- name: Checkout code
34-
uses: actions/checkout@v4
38+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
39+
with:
40+
persist-credentials: false
41+
42+
- name: Cache Composer dependencies
43+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
44+
with:
45+
path: ~/.composer/cache/files
46+
key: composer-${{ matrix.os }}-${{ matrix.php }}-${{ matrix.laravel }}-${{ matrix.stability }}-${{ hashFiles('composer.json') }}
47+
restore-keys: |
48+
composer-${{ matrix.os }}-${{ matrix.php }}-${{ matrix.laravel }}-
49+
composer-${{ matrix.os }}-${{ matrix.php }}-
3550
3651
- name: Setup PHP
37-
uses: shivammathur/setup-php@v2
52+
uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
3853
with:
3954
php-version: ${{ matrix.php }}
4055
extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick, fileinfo
@@ -50,7 +65,7 @@ jobs:
5065
composer require "laravel/framework:${{ matrix.laravel }}" "orchestra/testbench:${{ matrix.testbench }}" "nesbot/carbon:${{ matrix.carbon }}" --no-interaction --no-update
5166
composer update --${{ matrix.stability }} --prefer-dist --no-interaction
5267
53-
- name: List Installed Dependencies
68+
- name: List installed dependencies
5469
run: composer show -D
5570

5671
- name: Execute tests

‎.github/workflows/update-changelog.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: "Update Changelog"
1+
name: update-changelog
22

33
on:
44
release:
@@ -12,19 +12,21 @@ jobs:
1212
runs-on: ubuntu-latest
1313

1414
steps:
15+
# persist-credentials: true is required so `git-auto-commit-action` below
16+
# can push the CHANGELOG update.
1517
- name: Checkout code
16-
uses: actions/checkout@v4
18+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked]
1719
with:
1820
ref: main
1921

2022
- name: Update Changelog
21-
uses: stefanzweifel/changelog-updater-action@v1
23+
uses: stefanzweifel/changelog-updater-action@a938690fad7edf25368f37e43a1ed1b34303eb36 # v1.12.0
2224
with:
2325
latest-version: ${{ github.event.release.name }}
2426
release-notes: ${{ github.event.release.body }}
2527

2628
- name: Commit updated CHANGELOG
27-
uses: stefanzweifel/git-auto-commit-action@v5
29+
uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
2830
with:
2931
branch: main
3032
commit_message: Update CHANGELOG

‎.github/workflows/zizmor.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: zizmor
2+
3+
on:
4+
push:
5+
paths:
6+
- '.github/workflows/**'
7+
- '.github/dependabot.yml'
8+
pull_request:
9+
paths:
10+
- '.github/workflows/**'
11+
- '.github/dependabot.yml'
12+
13+
permissions:
14+
contents: read
15+
16+
jobs:
17+
zizmor:
18+
runs-on: ubuntu-latest
19+
permissions:
20+
contents: read
21+
steps:
22+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23+
with:
24+
persist-credentials: false
25+
26+
- uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
27+
with:
28+
advanced-security: false

0 commit comments

Comments
 (0)