chore(ci): modernise GitHub workflows

.github/workflows/ci.yml

@@ -11,10 +11,58 @@ on:
     branches:
       - "master"
 
+permissions:
+  contents: read
+
 jobs:
-  ci:
-    name: "Execute (PHP ${{ matrix.php-version }} with ${{ matrix.dependencies }} deps)"
-    runs-on: "ubuntu-latest"
+  static-analysis:
+    name: "Static analysis"
+    runs-on: ubuntu-24.04
+    container:
+      image: public.ecr.aws/docker/library/php:8.3-cli-alpine
+      env:
+        COMPOSER_ALLOW_SUPERUSER: true
+        COMPOSER_ROOT_VERSION: dev-master
+
+    steps:
+      - name: "Install bash, git"
+        run: apk add --no-cache bash git
+
+      - name: "Install Composer"
+        run: curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/bin --filename=composer --version=2.9.8
+
+      - name: "Checkout"
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: "Install dependencies"
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
+
+      - name: "Validate Composer dependencies"
+        run: composer validate
+
+      - name: "Check Composer dependency licenses"
+        run: composer licenses:check
+
+      - name: "Run linting"
+        run: composer lint
+
+      - name: "Run coding style"
+        run: composer code-style:check
+
+      - name: "Run PHPStan"
+        run: composer phpstan
+
+      - name: "Run Rector"
+        run: composer rector:check
+
+  tests:
+    name: "Tests (PHP ${{ matrix.php-version }}, ${{ matrix.dependencies }} deps)"
+    runs-on: ubuntu-24.04
+    container:
+      image: public.ecr.aws/docker/library/php:${{ matrix.php-version }}-cli-alpine
+      env:
+        COMPOSER_ALLOW_SUPERUSER: true
+        COMPOSER_ROOT_VERSION: dev-master
 
     strategy:
       fail-fast: false
@@ -29,45 +77,26 @@ jobs:
           - "8.5"
 
     steps:
-      - name: "Checkout"
-        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6
+      - name: "Install bash, git, and pcov"
+        run: |
+          apk add --no-cache bash git $PHPIZE_DEPS
+          pecl install pcov
+          docker-php-ext-enable pcov
 
-      - name: "Install PHP"
-        uses: "shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc" # v2
-        with:
-          php-version: "${{ matrix.php-version }}"
-          ini-values: memory_limit=-1
+      - name: "Install Composer"
+        run: curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/bin --filename=composer --version=2.9.8
+
+      - name: "Checkout"
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: "Update Composer platform version"
         if: ${{ matrix.dependencies != 'locked' && matrix.php-version != '8.3' }}
-        shell: bash
-        run: "composer config platform.php ${{ matrix.php-version }}"
+        run: composer config platform.php ${{ matrix.php-version }}
 
       - name: "Install dependencies"
-        uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # 4.0.0
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
         with:
           dependency-versions: "${{ matrix.dependencies }}"
 
-      - name: "Validate Composer dependencies"
-        run: "composer validate"
-
-      - name: "Check Composer dependency licenses"
-        run: "composer licenses:check"
-
-      - name: "Run linting"
-        run: "composer lint"
-
-      - name: "Run coding style"
-        if: ${{ matrix.dependencies == 'locked' && matrix.php-version == '8.3' }}
-        run: "composer code-style:check"
-
-      - name: "Run PHPStan"
-        if: ${{ matrix.dependencies == 'locked' }}
-        run: "composer phpstan"
-
-      - name: "Run Rector"
-        if: ${{ matrix.dependencies == 'locked' }}
-        run: "composer rector:check"
-
-      - name: "Tests"
-        run: "composer tests"
+      - name: "Run tests"
+        run: composer tests

.github/workflows/conventional-commits.yml

@@ -1,7 +1,6 @@
-name: Conventional Commits
+name: "Conventional Commits"
 
 on:
-  # https://github.com/marketplace/actions/semantic-pull-request#event-triggers
   pull_request:
     types:
       - opened
@@ -11,13 +10,20 @@ on:
   merge_group:
 
 permissions:
+  contents: read
   pull-requests: read
 
 jobs:
   main:
-    name: Validate PR title
+    name: "Validate PR title"
     runs-on: ubuntu-24.04
     steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          sparse-checkout: |
+            .github/commitlint.config.js
+          sparse-checkout-cone-mode: false
+
       - uses: benhodgson87/conventional-pull-request-action@14ff798e4d745c3e3e951f6ef472ff598b9c47a5 # v1
         if: ${{ github.event_name == 'pull_request' }}
         env:

.github/workflows/release.yml

@@ -1,4 +1,4 @@
-name: Release
+name: "Release"
 
 on:
   push:
@@ -13,11 +13,12 @@ permissions:
 
 concurrency:
   group: "release-${{ github.ref_name }}"
+  cancel-in-progress: true
 
 jobs:
   release-please:
+    name: "Make a new release"
     runs-on: ubuntu-24.04
-    name: Release Automation
     steps:
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         id: generate-token

.github/workflows/sloth.yml

@@ -0,0 +1,20 @@
+name: "Sloth"
+
+on:
+  pull_request:
+  merge_group:
+
+permissions:
+  contents: read
+  checks: read
+
+jobs:
+  sloth:
+    name: "Sloth"
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Sloth
+        uses: lendable/sloth@dbff4bbe34557fd3bd3865387f900d92034b9259 # v1.2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          case-sensitive: false

.github/workflows/stale-activity.yml

@@ -0,0 +1,26 @@
+name: "Stale Activity"
+
+on:
+  schedule:
+    - cron: "30 7 * * 1-5"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  actions: read
+  pull-requests: read
+
+jobs:
+  remove-stale-branches:
+    name: "Remove stale branches"
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: fpicalausa/remove-stale-branches@9b829bc2975ade0c61e64e9613def53ec0732440 # v2.6.1
+        with:
+          exempt-branches-regex: "^(master)$"
+          days-before-branch-stale: 182
+          days-before-branch-delete: 7
+          stale-branch-message: >
+            This branch [{branchName}]({branchUrl}) hasn't been updated in the last 6 months and is marked as stale.
+
+            It will be removed in a week. If you want to keep this branch around, delete this comment or add new commits to this branch.