Updated attribution files for commit 81ff0f4fd365d4aeae46feead2a91b4b403325c8

.github/actions/install-shared-dependencies/action.yml

@@ -38,7 +38,9 @@ runs:
       if: "${{ contains(inputs.target, 'musl') }}"
       run: |
         apk update
-        wget -O - https://sh.rustup.rs | sh -s -- -y
+        wget -O /tmp/rustup-init.sh https://sh.rustup.rs
+        sh /tmp/rustup-init.sh -y
+        rm /tmp/rustup-init.sh
         source "$HOME/.cargo/env"
         apk add protobuf-dev musl-dev make gcc envsubst openssl libressl-dev py3-pip
 

.github/dependabot.yml

@@ -8,6 +8,8 @@ updates:
       day: "monday"
       time: "09:00"
     open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
     reviewers:
       - "valkey-io/php-maintainers"
     assignees:
@@ -25,6 +27,8 @@ updates:
       day: "monday"
       time: "09:00"
     open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
     reviewers:
       - "valkey-io/php-maintainers"
     assignees:

.github/workflows/build-pecl-package/action.yml

@@ -20,6 +20,7 @@ runs:
       shell: bash
       run: |
         echo "=== Generating submodule commit info ==="
+        > .submodule-commits
         git submodule status | while read commit path extra; do
           # Remove leading - or + from commit hash
           clean_commit=$(echo "$commit" | sed 's/^[-+]//')

.github/workflows/build-php-wrapper/action.yml

@@ -32,20 +32,15 @@ runs:
     - name: Install system dependencies (Ubuntu)
       if: ${{ inputs.os == 'ubuntu' }}
       shell: bash
-      env:
-        PHP_VER: ${{ inputs.php-version }}
       run: |
         sudo apt-get update
         sudo apt-get install -y \
-            php$PHP_VER-dev \
-            php$PHP_VER-cli \
             build-essential \
             autoconf \
             automake \
             libtool \
             pkg-config \
             libssl-dev \
-            php-bcmath \
             unzip \
             clang-format \
             cppcheck \

.github/workflows/codeql.yml

@@ -38,7 +38,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@53e96ec3b35fce51c141c0d6f0e31028a448722d # v3

.github/workflows/create-version-pr/action.yml

@@ -28,7 +28,7 @@ runs:
   steps:
     - name: Create Pull Request
       id: create-pr
-      uses: actions/github-script@v7
+      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
       env:
         INPUT_VERSION: ${{ inputs.version }}
         INPUT_TEMP_BRANCH: ${{ inputs.temp-branch }}

.github/workflows/lint-yaml.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Run Prettier on YAML files
         run: |

.github/workflows/nightly.yml

@@ -13,4 +13,5 @@ jobs:
     uses: ./.github/workflows/test.yml
     with:
       profile: full
-    secrets: inherit
+    secrets:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ort-sweeper.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Fetch relevant branches
         id: get-branches
@@ -28,7 +28,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Trigger ORT Check workflows
-        uses: actions/github-script@v6
+        uses: actions/github-script@00f12e3e20659f42342b1c0226afda7f7c042325 # v6
         with:
           script: |
             const branches = "${{ steps.get-branches.outputs.branches }}".split(" ");

.github/workflows/ort.yml

@@ -44,7 +44,7 @@ jobs:
           fi
 
       - name: Checkout target branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ env.TARGET_BRANCH }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
@@ -57,13 +57,13 @@ jobs:
           echo "TARGET_COMMIT=`git rev-parse HEAD`" >> $GITHUB_ENV
 
       - name: Set up JDK 11 for the ORT package
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           distribution: "temurin"
           java-version: 11
 
       - name: Cache ORT and Gradle packages
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         id: cache-ort
         with:
           path: |
@@ -74,7 +74,7 @@ jobs:
 
       - name: Checkout ORT Repository
         if: steps.cache-ort.outputs.cache-hit != 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           repository: "oss-review-toolkit/ort"
           path: "./ort"
@@ -307,7 +307,7 @@ jobs:
 
       - name: Upload the final package list
         continue-on-error: true
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: final-package-list-${{ steps.date.outputs.date }}
           path: |
@@ -316,7 +316,7 @@ jobs:
 
       - name: Upload the skipped package list
         continue-on-error: true
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: skipped-package-list-${{ steps.date.outputs.date }}
           path: |
@@ -325,7 +325,7 @@ jobs:
 
       - name: Upload the unknown/unapproved package list
         continue-on-error: true
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: unapproved-package-list-${{ steps.date.outputs.date }}
           path: |

.github/workflows/php.yml

@@ -83,7 +83,7 @@ jobs:
       host-matrix-output: ${{ steps.get-matrices.outputs.host-matrix-output }}
       version-matrix-output: ${{ steps.get-matrices.outputs.version-matrix-output }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
       - id: get-matrices
@@ -106,7 +106,7 @@ jobs:
     runs-on: ${{ matrix.host.RUNNER }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
 
@@ -151,7 +151,7 @@ jobs:
       - name: Upload logs and reports
         if: always()
         continue-on-error: true
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: test-report-php-${{ matrix.php }}-${{ matrix.engine.type }}-${{ matrix.engine.version }}-${{ matrix.host.RUNNER }}
           path: |
@@ -174,7 +174,7 @@ jobs:
         engine: ${{ fromJson(needs.get-matrices.outputs.engine-matrix-output) }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
 
@@ -183,7 +183,7 @@ jobs:
           echo "Job running with the following matrix configuration:"
           echo "${{ toJson(matrix) }}"
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             valkey-glide/ffi/target
@@ -343,7 +343,7 @@ jobs:
       - name: Upload ASAN logs and reports
         if: always()
         continue-on-error: true
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: asan-test-report-php-${{ matrix.engine.type }}-${{ matrix.engine.version }}
           path: |
@@ -365,7 +365,7 @@ jobs:
         engine: ${{ fromJson(needs.get-matrices.outputs.engine-matrix-output) }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
 
@@ -374,7 +374,7 @@ jobs:
           echo "Job running with the following matrix configuration:"
           echo "${{ toJson(matrix) }}"
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             ~/.cargo/registry/index/
@@ -396,7 +396,7 @@ jobs:
             ubuntu-latest
 
       - name: Cache Cargo dependencies (early)
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             ~/.cargo/registry/index/
@@ -806,7 +806,7 @@ jobs:
       - name: Upload Valgrind logs and reports
         if: always()
         continue-on-error: true
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: valgrind-test-report-php-${{ matrix.engine.type }}-${{ matrix.engine.version }}
           path: |
@@ -821,7 +821,7 @@ jobs:
     timeout-minutes: 15
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
 
@@ -885,7 +885,7 @@ jobs:
           python3 utils/remove_optional_from_proto.py
           echo "=== Proto file cleanup completed ==="
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             valkey-glide/ffi/target
@@ -918,7 +918,7 @@ jobs:
       version-matrix-output: ${{ steps.get-matrices.outputs.version-matrix-output }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
       - id: get-matrices
@@ -949,11 +949,11 @@ jobs:
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
           echo IMAGE=amazonlinux:latest | sed -r 's/:/-/g' >> $GITHUB_ENV
       # Replace `:` in the variable otherwise it can't be used in `upload-artifact`
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             valkey-glide/ffi/target
@@ -1055,7 +1055,7 @@ jobs:
       - name: Upload test reports
         if: always()
         continue-on-error: true
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: test-reports-php-${{ matrix.php }}-${{ matrix.engine.type }}-${{ matrix.engine.version }}-${{ env.IMAGE }}-${{ matrix.host.ARCH }}
           path: |
@@ -1073,7 +1073,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
 
@@ -1117,7 +1117,7 @@ jobs:
       - name: Upload test reports
         if: always()
         continue-on-error: true
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: test-reports-modules-php-docker
           path: |
@@ -1134,7 +1134,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           submodules: recursive
 
@@ -1223,7 +1223,7 @@ jobs:
       - name: Upload test reports
         if: always()
         continue-on-error: true
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: test-reports-modules
           path: |