From 947f2492a8ba6ea763f7694db4a139122fce48e2 Mon Sep 17 00:00:00 2001 From: hectorhammett Date: Wed, 29 Jul 2026 21:22:32 +0000 Subject: [PATCH 1/4] update workflow files to make them zizmor compliant --- .../conformance-tests-bigtable-proxy.yaml | 13 +- .../conformance-tests-gax-showcase.yaml | 8 +- .../conformance-tests-storage-emulator.yaml | 8 +- .github/workflows/docs.yaml | 19 ++- .../emulator-system-tests-bigtable.yaml | 6 +- .../emulator-system-tests-datastore.yaml | 6 +- .../emulator-system-tests-firestore.yaml | 6 +- .../emulator-system-tests-pubsub.yaml | 6 +- .../emulator-system-tests-spanner.yaml | 8 +- .github/workflows/lint.yaml | 16 +- .github/workflows/major-version-approval.yaml | 2 +- .github/workflows/owlbot-checks.yaml | 24 ++- .github/workflows/release-checks.yaml | 35 ++-- .github/workflows/release.yml | 154 +++++++++--------- .github/workflows/system-tests.yaml | 14 +- .github/workflows/unit-tests.yaml | 30 ++-- renovate.json | 2 +- 17 files changed, 216 insertions(+), 141 deletions(-) diff --git a/.github/workflows/conformance-tests-bigtable-proxy.yaml b/.github/workflows/conformance-tests-bigtable-proxy.yaml index 6560a5f0e21f..c2018342519c 100644 --- a/.github/workflows/conformance-tests-bigtable-proxy.yaml +++ b/.github/workflows/conformance-tests-bigtable-proxy.yaml @@ -26,27 +26,32 @@ on: - '.github/workflows/conformance-tests-bigtable-proxy.yaml' workflow_dispatch: name: Run Bigtable Conformance Tests With Proxy +permissions: + contents: read jobs: conformance: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.1' extensions: grpc - name: Checkout Bigtable conformance tests - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: repository: googleapis/cloud-bigtable-clients-test ref: v0.0.3 path: cloud-bigtable-clients-test + persist-credentials: false - - uses: actions/setup-go@v7 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 with: go-version: '>=1.20.2' diff --git a/.github/workflows/conformance-tests-gax-showcase.yaml b/.github/workflows/conformance-tests-gax-showcase.yaml index 864d3748350e..fcca0736bd2c 100644 --- a/.github/workflows/conformance-tests-gax-showcase.yaml +++ b/.github/workflows/conformance-tests-gax-showcase.yaml @@ -8,18 +8,20 @@ permissions: contents: read jobs: gapic-showcase: + name: GAPIC Showcase Conformance Tests runs-on: ubuntu-latest env: GAPIC_SHOWCASE_VERSION: 0.42.0 OS: linux ARCH: amd64 - name: GAPIC Showcase Conformance Tests steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.2' extensions: grpc-1.83.0 diff --git a/.github/workflows/conformance-tests-storage-emulator.yaml b/.github/workflows/conformance-tests-storage-emulator.yaml index 7a2c50bbeb56..479304702400 100644 --- a/.github/workflows/conformance-tests-storage-emulator.yaml +++ b/.github/workflows/conformance-tests-storage-emulator.yaml @@ -10,6 +10,8 @@ on: - 'Storage/**' - '.github/workflows/conformance-tests-storage-emulator.yaml' name: Run Storage Retry Conformance Tests With Emulator +permissions: + contents: read jobs: test: runs-on: 'ubuntu-24.04' @@ -22,10 +24,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.1' diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 98c2c9a82fff..515c58c71903 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -5,6 +5,9 @@ on: pull_request: workflow_dispatch: +permissions: + contents: read + jobs: docfx: name: "Run DocFX tests" @@ -12,26 +15,30 @@ jobs: env: PHPDOC_ENV: prod steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: Setup Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: '3.14' - run: pip install --require-hashes -r .kokoro/docs/docker/requirements.txt - name: Setup PHP - uses: shivammathur/setup-php@verbose + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: "8.2" - name: Extract phpDocumentor id: extract - uses: shrink/actions-docker-extract@v4 + uses: shrink/actions-docker-extract@f1ef61065b78731fe3310b4e84e511f6a927a77e # v4 with: image: "phpdoc/phpdoc:3.5.3" path: "/opt/phpdoc/." - name: Symlink phpDocumentor - run: ln -s $(pwd)/${{ steps.extract.outputs.destination }}/bin/phpdoc /usr/local/bin/phpdoc + run: ln -s $(pwd)/${STEPS_EXTRACT_OUTPUTS_DESTINATION}/bin/phpdoc /usr/local/bin/phpdoc + env: + STEPS_EXTRACT_OUTPUTS_DESTINATION: ${{ steps.extract.outputs.destination }} - name: Install Dependencies - uses: nick-invision/retry@v4 + uses: nick-invision/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4 with: timeout_minutes: 10 max_attempts: 3 diff --git a/.github/workflows/emulator-system-tests-bigtable.yaml b/.github/workflows/emulator-system-tests-bigtable.yaml index e628ceff9d41..e18bdd0734dd 100644 --- a/.github/workflows/emulator-system-tests-bigtable.yaml +++ b/.github/workflows/emulator-system-tests-bigtable.yaml @@ -19,12 +19,14 @@ jobs: name: Bigtable runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - run: ./.github/emulator/start-emulator.sh bigtable 522.0.0-emulators - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.1' tools: pecl diff --git a/.github/workflows/emulator-system-tests-datastore.yaml b/.github/workflows/emulator-system-tests-datastore.yaml index 039ffe245edf..97515c527ea5 100644 --- a/.github/workflows/emulator-system-tests-datastore.yaml +++ b/.github/workflows/emulator-system-tests-datastore.yaml @@ -19,12 +19,14 @@ jobs: name: Datastore runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - run: ./.github/emulator/start-emulator.sh datastore 522.0.0-emulators - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.1' tools: pecl diff --git a/.github/workflows/emulator-system-tests-firestore.yaml b/.github/workflows/emulator-system-tests-firestore.yaml index 9815b4fbf1ef..06af2125dec8 100644 --- a/.github/workflows/emulator-system-tests-firestore.yaml +++ b/.github/workflows/emulator-system-tests-firestore.yaml @@ -19,12 +19,14 @@ jobs: name: Firestore runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - run: ./.github/emulator/start-emulator.sh firestore 522.0.0-emulators - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.1' tools: pecl diff --git a/.github/workflows/emulator-system-tests-pubsub.yaml b/.github/workflows/emulator-system-tests-pubsub.yaml index ec56723d86e2..372baa554c53 100644 --- a/.github/workflows/emulator-system-tests-pubsub.yaml +++ b/.github/workflows/emulator-system-tests-pubsub.yaml @@ -19,12 +19,14 @@ jobs: name: PubSub runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - run: ./.github/emulator/start-emulator.sh pubsub - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.1' tools: pecl diff --git a/.github/workflows/emulator-system-tests-spanner.yaml b/.github/workflows/emulator-system-tests-spanner.yaml index 62dd6dfe1b82..464a698cba1c 100644 --- a/.github/workflows/emulator-system-tests-spanner.yaml +++ b/.github/workflows/emulator-system-tests-spanner.yaml @@ -25,10 +25,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: Create Spanner instance - uses: google-github-actions/setup-gcloud@v3 + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3 with: version: '516.0.0' - run: gcloud info @@ -39,7 +41,7 @@ jobs: - run: gcloud spanner instances create google-cloud-php-system-tests --config=emulator-config --description="Test Instance" --nodes=1 - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.4' ini-values: grpc.enable_fork_support=1 diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index 14b493339aab..937389d76f30 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -12,9 +12,11 @@ jobs: runs-on: ubuntu-latest name: PHP Style Check steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.1' - name: Install Dependencies @@ -24,9 +26,9 @@ jobs: style_csfixer: name: PHP CS Fixer - uses: GoogleCloudPlatform/php-tools/.github/workflows/code-standards.yml@main + uses: GoogleCloudPlatform/php-tools/.github/workflows/code-standards.yml@8d707553d2c90c3b614941950814dcc10c19ce47 # main with: - config: GoogleCloudPlatform/php-tools/.php-cs-fixer.default.php@main + config: GoogleCloudPlatform/php-tools/.php-cs-fixer.default.php@8d707553d2c90c3b614941950814dcc10c19ce47 exclude-patterns: | [ "#.*/src/V[0-9]+#", @@ -52,9 +54,11 @@ jobs: runs-on: ubuntu-latest name: PHPStan Static Analysis steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: Install PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.2' - name: "Install dependencies" diff --git a/.github/workflows/major-version-approval.yaml b/.github/workflows/major-version-approval.yaml index b2e0a6993bd7..8d1675842f13 100644 --- a/.github/workflows/major-version-approval.yaml +++ b/.github/workflows/major-version-approval.yaml @@ -19,7 +19,7 @@ jobs: if: github.event.pull_request.user.login == 'release-please[bot]' && contains(github.event.pull_request.body, 'MAJOR_VERSION_ALLOWED=') steps: - name: Run Approval Check - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 env: GH_TOKEN: ${{ secrets.SPLIT_TOKEN }} with: diff --git a/.github/workflows/owlbot-checks.yaml b/.github/workflows/owlbot-checks.yaml index b69f3a68ecab..a435e4609691 100644 --- a/.github/workflows/owlbot-checks.yaml +++ b/.github/workflows/owlbot-checks.yaml @@ -3,6 +3,8 @@ on: pull_request: types: [opened, synchronize, reopened, edited] branches: ['main'] +permissions: + contents: read jobs: # Ensure that PRs labeled "feat" actually contain a new feature, PRs labeled # "bug" or "chore" do not. @@ -12,11 +14,12 @@ jobs: runs-on: ubuntu-latest if: github.event.pull_request.user.login == 'gcf-owl-bot[bot]' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 + persist-credentials: false - name: "Install PHP" - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: "8.1" - name: "Install dependencies" @@ -25,18 +28,23 @@ jobs: id: compatibility-checker continue-on-error: true # OwlBot PRs which are not labelled feat should not add new files or methods + env: + FROM_REF: ${{ github.head_ref || github.ref_name }} run: | ~/.composer/vendor/bin/roave-backward-compatibility-check \ - --from=origin/${{ github.head_ref || github.ref_name }} \ + --from=origin/${FROM_REF} \ --to=origin/main - name: "Print the action item" + env: + STEPS_COMPATIBILITY_CHECKER_OUTCOME: ${{ steps.compatibility-checker.outcome }} + IS_STARTS_WITH_FEAT: ${{ startsWith(github.event.pull_request.title, 'feat') }} run: | - if [[ "${{ steps.compatibility-checker.outcome }}" == 'failure' ]]; then - if [[ "${{ startsWith(github.event.pull_request.title, 'feat') }}" == "false" ]]; then + if [[ "${STEPS_COMPATIBILITY_CHECKER_OUTCOME}" == 'failure' ]]; then + if [[ "${IS_STARTS_WITH_FEAT}" == "false" ]]; then echo "Action item: Change the conventional commit to use 'feat'" exit 1 fi - elif [[ "${{ startsWith(github.event.pull_request.title, 'feat') }}" == "true" ]]; then + elif [[ "${IS_STARTS_WITH_FEAT}" == "true" ]]; then echo "Action item: No features found, do not use 'feat' for the conventional commit" exit 1 fi @@ -47,7 +55,9 @@ jobs: runs-on: ubuntu-latest if: github.event.pull_request.user.login == 'gcf-owl-bot[bot]' && github.event.pull_request.draft == false steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: Ensure run: | directory_to_check="owl-bot-staging" diff --git a/.github/workflows/release-checks.yaml b/.github/workflows/release-checks.yaml index 336a93531f59..b1fbb6fceaa9 100644 --- a/.github/workflows/release-checks.yaml +++ b/.github/workflows/release-checks.yaml @@ -12,19 +12,22 @@ jobs: runs-on: ubuntu-latest if: ${{ !contains(github.event.pull_request.body, 'BREAKING_CHANGE_REASON=') }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 + persist-credentials: false - name: "Install PHP" - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: "8.1" - name: "Rebase PR branch onto main branch" if: github.event.pull_request.user.login != 'release-please[bot]' + env: + HEAD_SHA: ${{ github.event.pull_request.head.sha }} run: | git config user.name "Github Actions" git config user.email "actions@github.com" - git checkout ${{ github.event.pull_request.head.sha }} + git checkout "$HEAD_SHA" if ! git rebase origin/main; then echo "Failed to rebase PR branch onto main. There may be conflicts. Please resolve conflicts or rebase manually." exit 1 @@ -36,15 +39,17 @@ jobs: run: | ~/.composer/vendor/bin/roave-backward-compatibility-check --from=origin/main --format=github-actions - name: "Check for BC label" + env: + HAS_BC_LABEL: ${{ contains(github.event.pull_request.title, '!:') }} run: | - if [[ "true" == "${{ contains(github.event.pull_request.title, '!:') }}" ]]; then + if [[ "true" == "${HAS_BC_LABEL}" ]]; then echo "Breaking change label found in PR title" exit 1 fi - name: Get Latest Release if: github.event.pull_request.user.login == 'release-please[bot]' id: latest-release - uses: pozetroninc/github-action-get-latest-release@master + uses: pozetroninc/github-action-get-latest-release@5ac6001ed175b443484c81ab32a20e12132be99c # master with: repository: ${{ github.repository }} token: ${{ secrets.GITHUB_TOKEN }} @@ -54,8 +59,10 @@ jobs: continue-on-error: true run: | ~/.composer/vendor/bin/roave-backward-compatibility-check \ - --from=${{ steps.latest-release.outputs.release }} \ + --from=${STEPS_LATEST_RELEASE_OUTPUTS_RELEASE} \ --to=origin/main --format=github-actions + env: + STEPS_LATEST_RELEASE_OUTPUTS_RELEASE: ${{ steps.latest-release.outputs.release }} # Ensure the release PR does not contain an unexpected (e.g. 2.0.0) major version release # Add "MAJOR_VERSION_ALLOWED=component1,component2" to the PR description to allow major version @@ -65,11 +72,12 @@ jobs: runs-on: ubuntu-latest if: github.event.pull_request.user.login == 'release-please[bot]' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 + persist-credentials: false - name: Parse allowed major versions - uses: actions-ecosystem/action-regex-match@v2 + uses: actions-ecosystem/action-regex-match@9e6c4fb3d5e898f505be7a1fb6e7b0a278f6665b # v2 id: allowed-major-versions with: text: ${{ github.event.pull_request.body }} @@ -78,7 +86,7 @@ jobs: - name: "Check for unexpected major version" run: | # parse allowed major versions into an array - IFS=', ' read -r -a ALLOWED_MAJOR_VERSIONS <<< "${{ steps.allowed-major-versions.outputs.group1 }}" + IFS=', ' read -r -a ALLOWED_MAJOR_VERSIONS <<< "${STEPS_ALLOWED_MAJOR_VERSIONS_OUTPUTS_GROUP1}" # get all changed components COMPONENTS=$(git diff origin/main --name-only | grep VERSION | xargs dirname) FAIL="" @@ -102,10 +110,12 @@ jobs: echo "major version releases for those components" exit 1 fi + env: + STEPS_ALLOWED_MAJOR_VERSIONS_OUTPUTS_GROUP1: ${{ steps.allowed-major-versions.outputs.group1 }} next-release-label-check: name: Check for "next release" label - uses: GoogleCloudPlatform/php-tools/.github/workflows/release-checks.yml@main + uses: GoogleCloudPlatform/php-tools/.github/workflows/release-checks.yml@8d707553d2c90c3b614941950814dcc10c19ce47 # main if: github.event.pull_request.user.login == 'release-please[bot]' with: next-release-label-check: true @@ -116,11 +126,12 @@ jobs: runs-on: ubuntu-latest if: github.event.pull_request.user.login == 'release-please[bot]' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 + persist-credentials: false - name: "Install PHP" - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: "8.2" - name: "Install dependencies" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5805ea725b30..e66eff54d881 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,79 +1,85 @@ name: Release Components on: - # push: - # tags: - # - "*" - workflow_dispatch: - inputs: - tag: - description: 'Tag to release' - required: true + # push: + # tags: + # - "*" + workflow_dispatch: + inputs: + tag: + description: 'Tag to release' + required: true permissions: - contents: read + contents: read jobs: - release: - name: "Split and Release Components" - runs-on: ubuntu-latest + release: + name: "Split and Release Components" + runs-on: ubuntu-latest + env: + LD_LIBRARY_PATH: /usr/local/lib + RELEASE_TAG: ${{ inputs.tag }} + steps: + - name: Clone libgit2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + repository: libgit2/libgit2 + ref: v1.5.1 + path: libgit2 + persist-credentials: false + - name: Install libgit2 + run: | + mkdir libgit2/build && cd libgit2/build + cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local + sudo cmake --build . --target install + - name: Clone splitsh/lite + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + repository: splitsh/lite + ref: v2.0.0 + path: lite + persist-credentials: false + - name: Build splitsh-lite + run: | + cd lite + go build -o splitsh-lite github.com/splitsh/lite + mv splitsh-lite /usr/local/bin/splitsh-lite + - name: Checkout google/cloud + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + fetch-depth: 0 + - name: Setup PHP + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + with: + php-version: '8.2' + ini-values: memory_limit=2048M + - name: Install Dependencies + uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4 + with: + timeout_minutes: 10 + max_attempts: 3 + command: composer update -d dev + - id: getTag + name: Get Tag + run: echo "tag=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT + - name: Run Subtree Split and Release env: - LD_LIBRARY_PATH: /usr/local/lib - RELEASE_TAG: ${{ inputs.tag }} - steps: - - name: Clone libgit2 - uses: actions/checkout@master - with: - repository: libgit2/libgit2 - ref: v1.5.1 - path: libgit2 - - name: Install libgit2 - run: | - mkdir libgit2/build && cd libgit2/build - cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local - sudo cmake --build . --target install - - name: Clone splitsh/lite - uses: actions/checkout@master - with: - repository: splitsh/lite - ref: v2.0.0 - path: lite - - name: Build splitsh-lite - run: | - cd lite - go build -o splitsh-lite github.com/splitsh/lite - mv splitsh-lite /usr/local/bin/splitsh-lite - - name: Checkout google/cloud - uses: actions/checkout@v7 - with: - persist-credentials: false - fetch-depth: 0 - - name: Setup PHP - uses: shivammathur/setup-php@v2 - with: - php-version: '8.2' - ini-values: memory_limit=2048M - - name: Install Dependencies - uses: nick-fields/retry@v4 - with: - timeout_minutes: 10 - max_attempts: 3 - command: composer update -d dev - - id: getTag - name: Get Tag - run: echo "tag=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT - - name: Run Subtree Split and Release - env: - RELEASE_TAG: ${{ inputs.tag != '' && inputs.tag || steps.getTag.outputs.tag }} - run: | - ./dev/google-cloud split $GITHUB_REPOSITORY $RELEASE_TAG \ - --splitsh=/usr/local/bin/splitsh-lite \ - -t ${{ secrets.SPLIT_TOKEN }} \ - --packagist-username=${{ vars.PACKAGIST_USERNAME }} \ - --packagist-token=${{ secrets.PACKAGIST_TOKEN }} \ - --packagist-safe-token=${{ secrets.PACKAGIST_SAFE_TOKEN }} - - name: Verify all releases made it to Packagist - uses: nick-fields/retry@v4 - with: - command: | - ./dev/google-cloud release:verify - timeout_minutes: 1 - max_attempts: 3 - retry_wait_seconds: 30 + RELEASE_TAG: ${{ inputs.tag != '' && inputs.tag || steps.getTag.outputs.tag }} + VARS_PACKAGIST_USERNAME: ${{ vars.PACKAGIST_USERNAME }} + SPLIT_TOKEN: ${{ secrets.SPLIT_TOKEN }} + PACKAGIST_TOKEN: ${{ secrets.PACKAGIST_TOKEN }} + PACKAGIST_SAFE_TOKEN: ${{ secrets.PACKAGIST_SAFE_TOKEN }} + run: | + ./dev/google-cloud split $GITHUB_REPOSITORY $RELEASE_TAG \ + --splitsh=/usr/local/bin/splitsh-lite \ + -t "$SPLIT_TOKEN" \ + --packagist-username="${VARS_PACKAGIST_USERNAME}" \ + --packagist-token="$PACKAGIST_TOKEN" \ + --packagist-safe-token="$PACKAGIST_SAFE_TOKEN" + - name: Verify all releases made it to Packagist + uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4 + with: + command: | + ./dev/google-cloud release:verify + timeout_minutes: 1 + max_attempts: 3 + retry_wait_seconds: 30 diff --git a/.github/workflows/system-tests.yaml b/.github/workflows/system-tests.yaml index e8598f9347ba..1d27ad1b7915 100644 --- a/.github/workflows/system-tests.yaml +++ b/.github/workflows/system-tests.yaml @@ -3,6 +3,10 @@ on: # This is failing because we don't have a service account key # they need to be moved to kokoro instead workflow_dispatch: + +permissions: + contents: read + jobs: # Run system tests on the release PR system-tests: @@ -12,18 +16,22 @@ jobs: env: ASSET_TEST_BUCKET: cloud-php-testdata steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 + persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@verbose + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: "8.1" extensions: grpc ini-values: grpc.grpc_verbosity=error - name: Save secrets to file + env: + TESTS_KEY: ${{ secrets.GOOGLE_CLOUD_PHP_TESTS_KEY }} + RUNNER_TEMP: ${{ runner.temp }} run: | - echo "${{ secrets.GOOGLE_CLOUD_PHP_TESTS_KEY }}" | base64 -d > ${{ runner.temp }}/service-account.json + echo "$TESTS_KEY" | base64 -d > "$RUNNER_TEMP/service-account.json" - name: Install dependencies run: composer --no-interaction --no-ansi --no-progress update - name: Run System Tests diff --git a/.github/workflows/unit-tests.yaml b/.github/workflows/unit-tests.yaml index e8c1c1225c96..74b22aa8df2a 100644 --- a/.github/workflows/unit-tests.yaml +++ b/.github/workflows/unit-tests.yaml @@ -32,31 +32,33 @@ jobs: runs-on: ${{ matrix.platform }} continue-on-error: true steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: Setup cache environment id: extcache - uses: shivammathur/cache-extensions@v1 + uses: shivammathur/cache-extensions@9b476298b44f2e4d4268dd103ff4c3e216314e27 # v1 with: php-version: ${{ matrix.php }} extensions: sodium, sysvshm, ${{ matrix.extensions }} key: cache-key-1 # increment to bust the cache - name: Cache extensions - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: path: ${{ steps.extcache.outputs.dir }} key: ${{ steps.extcache.outputs.key }} restore-keys: ${{ steps.extcache.outputs.key }} - name: Setup PHP - uses: shivammathur/setup-php@verbose + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: ${{ matrix.php }} extensions: sodium, sysvshm, ${{ matrix.extensions }} - name: Install Dependencies - uses: nick-invision/retry@v4 + uses: nick-invision/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4 with: timeout_minutes: 10 max_attempts: 3 @@ -74,9 +76,11 @@ jobs: name: Package Tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@verbose + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.1' extensions: grpc @@ -87,9 +91,11 @@ jobs: name: Package Tests (Lowest Dependencies) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@verbose + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.1' extensions: grpc @@ -102,9 +108,11 @@ jobs: name: Dev Commands Unit Tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@verbose + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: "8.2" - name: "Install dependencies" diff --git a/renovate.json b/renovate.json index cf7b3f329252..9199717a9747 100644 --- a/renovate.json +++ b/renovate.json @@ -1,6 +1,6 @@ { "extends": [ - "config:base" + "config:best-practices" ], "pinVersions": false, "rebaseStalePrs": true, From 3d159dec092ad4f4e8555578a846a8f7bef0913d Mon Sep 17 00:00:00 2001 From: hectorhammett Date: Wed, 29 Jul 2026 21:59:52 +0000 Subject: [PATCH 2/4] Remove commented lines on release.yml --- .github/workflows/release.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e66eff54d881..0e6a7ccffc89 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,8 +1,5 @@ name: Release Components on: - # push: - # tags: - # - "*" workflow_dispatch: inputs: tag: From 5eed8e4dd7a4256c8c29b0232f18a1a029c7f2e1 Mon Sep 17 00:00:00 2001 From: hectorhammett Date: Thu, 30 Jul 2026 18:23:50 +0000 Subject: [PATCH 3/4] update release.yml to keep the same level of indentation --- .github/workflows/release.yml | 144 +++++++++++++++++----------------- 1 file changed, 72 insertions(+), 72 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0e6a7ccffc89..86ba0249a434 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,77 +6,77 @@ on: description: 'Tag to release' required: true permissions: - contents: read + contents: read jobs: - release: - name: "Split and Release Components" - runs-on: ubuntu-latest - env: - LD_LIBRARY_PATH: /usr/local/lib - RELEASE_TAG: ${{ inputs.tag }} - steps: - - name: Clone libgit2 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - with: - repository: libgit2/libgit2 - ref: v1.5.1 - path: libgit2 - persist-credentials: false - - name: Install libgit2 - run: | - mkdir libgit2/build && cd libgit2/build - cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local - sudo cmake --build . --target install - - name: Clone splitsh/lite - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - with: - repository: splitsh/lite - ref: v2.0.0 - path: lite - persist-credentials: false - - name: Build splitsh-lite - run: | - cd lite - go build -o splitsh-lite github.com/splitsh/lite - mv splitsh-lite /usr/local/bin/splitsh-lite - - name: Checkout google/cloud - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - with: - persist-credentials: false - fetch-depth: 0 - - name: Setup PHP - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 - with: - php-version: '8.2' - ini-values: memory_limit=2048M - - name: Install Dependencies - uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4 - with: - timeout_minutes: 10 - max_attempts: 3 - command: composer update -d dev - - id: getTag - name: Get Tag - run: echo "tag=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT - - name: Run Subtree Split and Release + release: + name: "Split and Release Components" + runs-on: ubuntu-latest env: - RELEASE_TAG: ${{ inputs.tag != '' && inputs.tag || steps.getTag.outputs.tag }} - VARS_PACKAGIST_USERNAME: ${{ vars.PACKAGIST_USERNAME }} - SPLIT_TOKEN: ${{ secrets.SPLIT_TOKEN }} - PACKAGIST_TOKEN: ${{ secrets.PACKAGIST_TOKEN }} - PACKAGIST_SAFE_TOKEN: ${{ secrets.PACKAGIST_SAFE_TOKEN }} - run: | - ./dev/google-cloud split $GITHUB_REPOSITORY $RELEASE_TAG \ - --splitsh=/usr/local/bin/splitsh-lite \ - -t "$SPLIT_TOKEN" \ - --packagist-username="${VARS_PACKAGIST_USERNAME}" \ - --packagist-token="$PACKAGIST_TOKEN" \ - --packagist-safe-token="$PACKAGIST_SAFE_TOKEN" - - name: Verify all releases made it to Packagist - uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4 - with: - command: | - ./dev/google-cloud release:verify - timeout_minutes: 1 - max_attempts: 3 - retry_wait_seconds: 30 + LD_LIBRARY_PATH: /usr/local/lib + RELEASE_TAG: ${{ inputs.tag }} + steps: + - name: Clone libgit2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + repository: libgit2/libgit2 + ref: v1.5.1 + path: libgit2 + persist-credentials: false + - name: Install libgit2 + run: | + mkdir libgit2/build && cd libgit2/build + cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local + sudo cmake --build . --target install + - name: Clone splitsh/lite + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + repository: splitsh/lite + ref: v2.0.0 + path: lite + persist-credentials: false + - name: Build splitsh-lite + run: | + cd lite + go build -o splitsh-lite github.com/splitsh/lite + mv splitsh-lite /usr/local/bin/splitsh-lite + - name: Checkout google/cloud + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + fetch-depth: 0 + - name: Setup PHP + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + with: + php-version: '8.2' + ini-values: memory_limit=2048M + - name: Install Dependencies + uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4 + with: + timeout_minutes: 10 + max_attempts: 3 + command: composer update -d dev + - id: getTag + name: Get Tag + run: echo "tag=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT + - name: Run Subtree Split and Release + env: + RELEASE_TAG: ${{ inputs.tag != '' && inputs.tag || steps.getTag.outputs.tag }} + VARS_PACKAGIST_USERNAME: ${{ vars.PACKAGIST_USERNAME }} + SPLIT_TOKEN: ${{ secrets.SPLIT_TOKEN }} + PACKAGIST_TOKEN: ${{ secrets.PACKAGIST_TOKEN }} + PACKAGIST_SAFE_TOKEN: ${{ secrets.PACKAGIST_SAFE_TOKEN }} + run: | + ./dev/google-cloud split $GITHUB_REPOSITORY $RELEASE_TAG \ + --splitsh=/usr/local/bin/splitsh-lite \ + -t "$SPLIT_TOKEN" \ + --packagist-username="${VARS_PACKAGIST_USERNAME}" \ + --packagist-token="$PACKAGIST_TOKEN" \ + --packagist-safe-token="$PACKAGIST_SAFE_TOKEN" + - name: Verify all releases made it to Packagist + uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4 + with: + command: | + ./dev/google-cloud release:verify + timeout_minutes: 1 + max_attempts: 3 + retry_wait_seconds: 30 From 20f2cfa0593389cb8e5af31b88923f53de0f32e6 Mon Sep 17 00:00:00 2001 From: hectorhammett Date: Thu, 30 Jul 2026 19:04:37 +0000 Subject: [PATCH 4/4] Modify the configuration for the sytle fixer --- .github/workflows/lint.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index 937389d76f30..0bf35cdb947f 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -28,7 +28,7 @@ jobs: name: PHP CS Fixer uses: GoogleCloudPlatform/php-tools/.github/workflows/code-standards.yml@8d707553d2c90c3b614941950814dcc10c19ce47 # main with: - config: GoogleCloudPlatform/php-tools/.php-cs-fixer.default.php@8d707553d2c90c3b614941950814dcc10c19ce47 + config: GoogleCloudPlatform/php-tools/.php-cs-fixer.default.php@main exclude-patterns: | [ "#.*/src/V[0-9]+#",