Merge pull request #396 from itk-dev/feature/security-update

Security update

Author: rimi-itk

.docker/data/.gitignore

@@ -1,5 +1,5 @@
 # Ignore everything in this directory
 *
-# Except this file
+# Except
 !.gitignore
-!Readme.md
+!README.md

.docker/data/README.md

@@ -2,11 +2,14 @@
 
 Please map persistent volumes to this directory on the servers.
 
-If a container needs to persist data between restarts you can map the relevant files in the container to ``docker/data/<container-name>`.
+If a container needs to persist data between restarts you can map the relevant files in the container to
+`.docker/data/<container-name>`.
 
 ## RabbitMQ example
-If you are using RabbitMQ running in a container as a message broker you need to configure a persistent volume for RabbitMQs data directory to avoid losing message on container restarts.
 
+If you are using RabbitMQ running in a container as a message broker you need to configure a persistent volume for
+RabbitMQs data directory to avoid losing message on container restarts.
+x
 ```yaml
 # docker-compose.server.override.yml
 

.github/workflows/changelog.yaml

@@ -14,11 +14,9 @@ on:
 jobs:
   changelog:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 2
 

.github/workflows/composer.yaml

@@ -30,18 +30,21 @@ env:
 
 on:
   pull_request:
+    paths: &paths
+      - "composer.json"
+      - "composer.lock"
+      - "docker-compose.yml"
   push:
     branches:
       - main
       - develop
+    paths: *paths
 
 jobs:
   composer-validate:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Create docker network
         run: |
@@ -52,10 +55,8 @@ jobs:
 
   composer-normalized:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Create docker network
         run: |
@@ -67,14 +68,12 @@ jobs:
 
   composer-audit:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Create docker network
         run: |
           docker network create frontend
 
       - run: |
-          docker compose run --rm phpfpm composer audit
+          docker compose run --rm phpfpm composer audit --locked

.github/workflows/javascript.yaml

@@ -15,19 +15,21 @@ name: JavaScript
 
 on:
   pull_request:
+    paths: &paths
+      - "**/*.js"
+      - "docker-compose.yml"
   push:
     branches:
       - main
       - develop
+    paths: *paths
 
 jobs:
   javascript-lint:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Create docker network
         run: |

.github/workflows/markdown.yaml

@@ -22,19 +22,20 @@ name: Markdown
 
 on:
   pull_request:
+    paths: &paths
+      - "**/*.md"
   push:
     branches:
       - main
       - develop
+    paths: *paths
 
 jobs:
   markdown-lint:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Create docker network
         run: |

.github/workflows/php.yaml

@@ -38,17 +38,23 @@ env:
 
 on:
   pull_request:
+    paths: &paths
+      - "**/*.php"
+      - "composer.json"
+      - "composer.lock"
+      - "docker-compose.yml"
   push:
     branches:
       - main
       - develop
+    paths: *paths
 
 jobs:
   coding-standards:
     name: PHP - Check Coding Standards
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Create docker network
         run: |

.github/workflows/site.yaml

@@ -33,7 +33,7 @@ jobs:
     name: Check that site can be installed
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Create docker network
         run: |
@@ -92,7 +92,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Install site from our base ref
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           ref: ${{ github.base_ref }}
 
@@ -130,7 +130,7 @@ jobs:
           sudo chmod -Rv a+w web/sites/default || true
 
       # Update site using our updated code.
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # Keep our local settings (cf.
           # https://github.com/actions/checkout?tab=readme-ov-file#usage)

.github/workflows/styles.yaml

@@ -15,19 +15,22 @@ name: Styles
 
 on:
   pull_request:
+    paths: &paths
+      - "**/*.css"
+      - "**/*.scss"
+      - "docker-compose.yml"
   push:
     branches:
       - main
       - develop
+    paths: *paths
 
 jobs:
   styles-lint:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Create docker network
         run: |

.github/workflows/twig.yaml

@@ -28,19 +28,23 @@ env:
 
 on:
   pull_request:
+    paths: &paths
+      - "**/*.twig"
+      - "composer.json"
+      - "composer.lock"
+      - "docker-compose.yml"
   push:
     branches:
       - main
       - develop
+    paths: *paths
 
 jobs:
   twig-lint:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Create docker network
         run: |