Harden GitHub workflows #1828

	on:
	pull_request:
	paths:
	- 'src/**'
	- '.github/workflows/mutation.yml'
	- 'composer.json'

	push:
	branches: ['master']
	paths:
	- 'src/**'
	- '.github/workflows/mutation.yml'
	- 'composer.json'

	name: mutation test

	permissions:
	contents: read

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	mutation:
	name: PHP ${{ matrix.php }}-${{ matrix.os }}

	env:
	COMPOSER_ROOT_VERSION: 1.0.0
	EXTENSIONS: pdo, pdo_pgsql

	runs-on: ${{ matrix.os }}

	strategy:
	matrix:
	os:
	- ubuntu-latest

	php:
	- 8.5

	services:
	postgres:
	image: postgres:17 # zizmor: ignore[unpinned-images]
	env:
	POSTGRES_USER: root
	POSTGRES_PASSWORD: root
	POSTGRES_DB: yiitest
	ports:
	- 5432:5432
	options: --name=postgres --health-cmd="pg_isready" --health-interval=10s --health-timeout=5s --health-retries=3

	steps:
	- name: Checkout.
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
	with:
	persist-credentials: false

	- name: Install PHP with extensions.
	uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45
	with:
	php-version: ${{ matrix.php }}
	extensions: ${{ env.EXTENSIONS }}
	ini-values: memory_limit=-1
	coverage: pcov

	- name: Install Composer dependencies
	uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f

	- name: Install db.
	uses: yiisoft/actions/install-packages@master
	with:
	packages: >-
	['db']

	- name: Run infection.
	run: \|
	vendor/bin/infection --threads=1 --ignore-msi-with-no-mutations
	env:
	STRYKER_DASHBOARD_API_KEY: ${{ secrets.STRYKER_DASHBOARD_API_KEY }}

Provide feedback