ci: cut Actions burn in .github/workflows/rescript-deno-ci.yml (scope… #299
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0-or-later | ||
| name: PHP Security Check | ||
| on: | ||
| push: | ||
| branches: [main, master] | ||
| pull_request: | ||
| # Estate guardrail: scope push to default branches so a PR fires once (not | ||
| # push+PR), and cancel superseded runs. Safe — read-only PR-triggered check. | ||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true | ||
| on: | ||
| push: | ||
| branches: [main, master] | ||
| pull_request: | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| security: | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4.1.1 | ||
| - name: PHP Security Scan | ||
| run: | | ||
| # Check for dangerous functions | ||
| DANGEROUS=$(grep -rE 'eval\s*\(|exec\s*\(|system\s*\(|passthru\s*\(|shell_exec\s*\(|`.*\$' --include="*.php" . 2>/dev/null | grep -v 'vendor/' | head -10 || true) | ||
| if [ -n "$DANGEROUS" ]; then | ||
| echo "⚠️ Potentially dangerous PHP functions found:" | ||
| echo "$DANGEROUS" | ||
| fi | ||
| # Check for SQL injection patterns | ||
| SQLI=$(grep -rE '\$_(GET|POST|REQUEST).*query|mysqli_query.*\$_' --include="*.php" . 2>/dev/null | grep -v 'vendor/' | head -5 || true) | ||
| if [ -n "$SQLI" ]; then | ||
| echo "⚠️ Potential SQL injection patterns:" | ||
| echo "$SQLI" | ||
| fi | ||
| # Check for XSS patterns | ||
| XSS=$(grep -rE 'echo\s+\$_(GET|POST|REQUEST)' --include="*.php" . 2>/dev/null | grep -v 'vendor/' | head -5 || true) | ||
| if [ -n "$XSS" ]; then | ||
| echo "⚠️ Potential XSS patterns (unescaped output):" | ||
| echo "$XSS" | ||
| fi | ||
| echo "✅ PHP security scan completed" | ||
