From efea2a12e05dddc62286451bbc218d61a5afa81c Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 00:20:53 +0300 Subject: [PATCH 01/15] Harden GitHub workflows --- .github/workflows/build.yml | 13 +++++++++---- .../workflows/composer-dependency-analyzer.yml | 11 ++++++++--- .github/workflows/cs.yml | 18 ++++++++++++++---- .github/workflows/static.yml | 11 ++++++++--- 4 files changed, 39 insertions(+), 14 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 16de44f..dbb5b2b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -20,6 +20,9 @@ on: name: build +permissions: + contents: read + jobs: codeception: name: PHP ${{ matrix.php }}-${{ matrix.os }} @@ -45,10 +48,12 @@ jobs: steps: - name: Checkout. - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + with: + persist-credentials: false - name: Install PHP with extensions. - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 with: coverage: false extensions: fileinfo, intl @@ -56,7 +61,7 @@ jobs: php-version: ${{ matrix.php }} - name: Install Composer dependencies - uses: ramsey/composer-install@v3 + uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f - name: Run codeception build. run: vendor/bin/codecept build @@ -72,7 +77,7 @@ jobs: - name: Upload coverage to Codecov. if: matrix.os == 'ubuntu-latest' - uses: codecov/codecov-action@v4 + uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 with: token: ${{ secrets.CODECOV_TOKEN }} files: runtime/tests/_output/coverage.xml diff --git a/.github/workflows/composer-dependency-analyzer.yml b/.github/workflows/composer-dependency-analyzer.yml index 973be4b..c126c82 100644 --- a/.github/workflows/composer-dependency-analyzer.yml +++ b/.github/workflows/composer-dependency-analyzer.yml @@ -22,6 +22,9 @@ on: name: Composer dependency analyzer +permissions: + contents: read + jobs: analyzer: name: PHP ${{ matrix.php }}-${{ matrix.os }} @@ -40,17 +43,19 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + with: + persist-credentials: false - name: Install PHP with extensions - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 with: coverage: none php-version: ${{ matrix.php }} tools: composer:v2, cs2pr - name: Install Composer dependencies - uses: ramsey/composer-install@v3 + uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f - name: Run composer dependency analyzer run: vendor/bin/composer-dependency-analyser --config=composer-dependency-analyser.php diff --git a/.github/workflows/cs.yml b/.github/workflows/cs.yml index d258a46..361fde2 100644 --- a/.github/workflows/cs.yml +++ b/.github/workflows/cs.yml @@ -1,5 +1,8 @@ name: Code Style +permissions: + contents: read + on: pull_request: paths-ignore: @@ -17,17 +20,19 @@ jobs: contents: write steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + with: + persist-credentials: false - name: Install PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 with: php-version: 8.2 tools: composer:v2 coverage: none - name: Install Composer dependencies - uses: "ramsey/composer-install@v4" + uses: ramsey/composer-install@26d8a556604053a9612623447203a691f406fbe6 - name: Run PHP CS Fixer run: ./vendor/bin/php-cs-fixer fix --config=.php-cs-fixer.php @@ -35,8 +40,13 @@ jobs: - name: Run Rector run: ./vendor/bin/rector --output-format=github + - name: Configure Git credentials + env: + GH_TOKEN: ${{ github.token }} + run: git config --global credential.helper '!f() { echo username=x-access-token; echo password=$GH_TOKEN; }; f' + - name: Commit changes - uses: stefanzweifel/git-auto-commit-action@v7 + uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 with: commit_message: "Apply PHP CS Fixer and Rector changes (CI)" file_pattern: '*.php' diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml index 5eba8a9..4dea3c1 100644 --- a/.github/workflows/static.yml +++ b/.github/workflows/static.yml @@ -20,6 +20,9 @@ on: name: static analysis +permissions: + contents: read + jobs: psalm: name: PHP ${{ matrix.php }}-${{ matrix.os }} @@ -37,17 +40,19 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + with: + persist-credentials: false - name: Install PHP with extensions - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 with: coverage: none php-version: ${{ matrix.php }} tools: composer:v2, cs2pr - name: Install Composer dependencies - uses: ramsey/composer-install@v3 + uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f - name: Static analysis run: vendor/bin/psalm --shepherd --stats --output-format=checkstyle --no-cache --php-version=${{ matrix.php }} | cs2pr --graceful-warnings --colorize From 1dbc8a1336623dd92e1af9dcd6ae4caa9e6bad85 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 02:16:17 +0300 Subject: [PATCH 02/15] Add zizmorify configuration --- .github/dependabot.yml | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d7ebdbf..6cc0071 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,16 +1,8 @@ version: 2 updates: - # Maintain dependencies for GitHub Actions. - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "daily" - # Too noisy. See https://github.community/t/increase-if-necessary-for-github-actions-in-dependabot/179581 - open-pull-requests-limit: 0 - - # Maintain dependencies for Composer - - package-ecosystem: "composer" - directory: "/" - schedule: - interval: "daily" - versioning-strategy: increase-if-necessary + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7 From ffa61191ed9e15e8e1c7dd79a90f966a78861a1f Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 02:37:22 +0300 Subject: [PATCH 03/15] Add zizmorify workflow --- .github/workflows/zizmor.yml | 37 ++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000..e9b7e06 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,37 @@ +name: GitHub Actions Security Analysis with zizmor 🌈 + +on: + push: + branches: + - main + paths: + - '.github/**.yml' + - '.github/**.yaml' + pull_request: + paths: + - '.github/**.yml' + - '.github/**.yaml' + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + zizmor: + name: Run zizmor 🌈 + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Run zizmor 🌈 + uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 + with: + advanced-security: false + annotations: true + persona: 'pedantic' From 880100a9a949a0ec5f13a3f3c84a263852c43433 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 12:05:00 +0300 Subject: [PATCH 04/15] Restore Dependabot non-GitHub-Actions updates --- .github/dependabot.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6cc0071..cb0e7a1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,5 +1,19 @@ version: 2 updates: + # Maintain dependencies for GitHub Actions. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "daily" + # Too noisy. See https://github.community/t/increase-if-necessary-for-github-actions-in-dependabot/179581 + open-pull-requests-limit: 0 + + # Maintain dependencies for Composer + - package-ecosystem: "composer" + directory: "/" + schedule: + interval: "daily" + versioning-strategy: increase-if-necessary - package-ecosystem: "github-actions" directory: "/" schedule: From 4a07ff57d579eaa968e9d96cfb1972a077889a52 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sat, 20 Jun 2026 11:48:15 +0300 Subject: [PATCH 05/15] Use master for yiisoft actions --- .github/zizmor.yml | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .github/zizmor.yml diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..85ca798 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,5 @@ +rules: + unpinned-uses: + config: + policies: + "yiisoft/*": any From 4a4d8e14ed79f6ba10163bae8704199261f47fb4 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sat, 20 Jun 2026 11:48:20 +0300 Subject: [PATCH 06/15] Use master for yiisoft actions --- .github/zizmor.yml | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .github/zizmor.yml diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..85ca798 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,5 @@ +rules: + unpinned-uses: + config: + policies: + "yiisoft/*": any From e9e18c287ad5b57502120ea2eb2b16765451a4be Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sat, 20 Jun 2026 12:17:49 +0300 Subject: [PATCH 07/15] Use master for yiisoft actions --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d7ebdbf..426dc2b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,8 @@ updates: open-pull-requests-limit: 0 # Maintain dependencies for Composer + ignore: + - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: From 9ae6568e4f2c6a621c91993a5e2751c65ed9ebcd Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sat, 20 Jun 2026 12:17:54 +0300 Subject: [PATCH 08/15] Use master for yiisoft actions --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index cb0e7a1..763f708 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,8 @@ updates: open-pull-requests-limit: 0 # Maintain dependencies for Composer + ignore: + - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: @@ -20,3 +22,5 @@ updates: interval: "weekly" cooldown: default-days: 7 + ignore: + - dependency-name: "yiisoft/*" From 758abbed760de77af8dc0cf1a9ba6e33166f5b8b Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sun, 21 Jun 2026 15:08:32 +0300 Subject: [PATCH 09/15] Remove redundant zizmor config --- .github/zizmor.yml | 5 ----- 1 file changed, 5 deletions(-) delete mode 100644 .github/zizmor.yml diff --git a/.github/zizmor.yml b/.github/zizmor.yml deleted file mode 100644 index 85ca798..0000000 --- a/.github/zizmor.yml +++ /dev/null @@ -1,5 +0,0 @@ -rules: - unpinned-uses: - config: - policies: - "yiisoft/*": any From a030c401e5aba1c19fbf1b09150056839a33f176 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Wed, 24 Jun 2026 15:58:48 +0300 Subject: [PATCH 10/15] Remove redundant dependabot change --- .github/dependabot.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 426dc2b..d7ebdbf 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,8 +9,6 @@ updates: open-pull-requests-limit: 0 # Maintain dependencies for Composer - ignore: - - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: From 82ea4ec7b6b151df73a14b1601e7354cef728c7e Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Wed, 24 Jun 2026 16:30:53 +0300 Subject: [PATCH 11/15] Revert "Remove redundant dependabot change" This reverts commit a030c401e5aba1c19fbf1b09150056839a33f176. --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d7ebdbf..426dc2b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,8 @@ updates: open-pull-requests-limit: 0 # Maintain dependencies for Composer + ignore: + - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: From f6f2fb367982d59284435a0b2fbf9b21729c7cf9 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Wed, 24 Jun 2026 17:54:26 +0300 Subject: [PATCH 12/15] Normalize Dependabot GitHub Actions updates --- .github/dependabot.yml | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 763f708..01264e0 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,6 +1,6 @@ version: 2 updates: - # Maintain dependencies for GitHub Actions. + - package-ecosystem: "github-actions"\n directory: "/"\n schedule:\n interval: "weekly"\n cooldown:\n default-days: 7\n ignore:\n - dependency-name: "yiisoft/*"\n # Maintain dependencies for GitHub Actions. - package-ecosystem: "github-actions" directory: "/" schedule: @@ -9,18 +9,8 @@ updates: open-pull-requests-limit: 0 # Maintain dependencies for Composer - ignore: - - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: interval: "daily" versioning-strategy: increase-if-necessary - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - cooldown: - default-days: 7 - ignore: - - dependency-name: "yiisoft/*" From c4170c27ba89da0b7b64c136217208b72534c172 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Wed, 24 Jun 2026 22:38:43 +0300 Subject: [PATCH 13/15] Fix Dependabot GitHub Actions updates --- .github/dependabot.yml | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 01264e0..a4c1ef2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,16 +1,18 @@ version: 2 updates: - - package-ecosystem: "github-actions"\n directory: "/"\n schedule:\n interval: "weekly"\n cooldown:\n default-days: 7\n ignore:\n - dependency-name: "yiisoft/*"\n # Maintain dependencies for GitHub Actions. - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "daily" - # Too noisy. See https://github.community/t/increase-if-necessary-for-github-actions-in-dependabot/179581 - open-pull-requests-limit: 0 + # Maintain dependencies for GitHub Actions. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7 + ignore: + - dependency-name: "yiisoft/*" - # Maintain dependencies for Composer - - package-ecosystem: "composer" - directory: "/" - schedule: - interval: "daily" - versioning-strategy: increase-if-necessary + # Maintain dependencies for Composer + - package-ecosystem: "composer" + directory: "/" + schedule: + interval: "daily" + versioning-strategy: increase-if-necessary From c2d66213e7ca2b74fb696f53da125ad289fe2106 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Thu, 25 Jun 2026 00:45:46 +0300 Subject: [PATCH 14/15] Fix zizmor workflow findings --- .github/dependabot.yml | 2 ++ .github/workflows/zizmor.yml | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a4c1ef2..5fd269d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -16,3 +16,5 @@ updates: schedule: interval: "daily" versioning-strategy: increase-if-necessary + cooldown: + default-days: 7 diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 9465846..430255d 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -14,8 +14,8 @@ on: - '.github/**.yaml' permissions: - actions: read - contents: read + actions: read # Required by zizmor when reading workflow metadata through the API. + contents: read # Required to read workflow files. jobs: zizmor: From b9142a3d985d749a260573d280575a25285e5270 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Thu, 2 Jul 2026 22:12:47 +0300 Subject: [PATCH 15/15] Fix zizmor workflow findings --- .github/workflows/build.yml | 12 +++++--- .../composer-dependency-analyzer.yml | 10 +++++-- .github/workflows/cs.yml | 29 +++++++++++++------ .github/workflows/static.yml | 14 ++++++--- 4 files changed, 45 insertions(+), 20 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index dbb5b2b..090bbdf 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -20,6 +20,10 @@ on: name: build +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + permissions: contents: read @@ -48,12 +52,12 @@ jobs: steps: - name: Checkout. - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: persist-credentials: false - name: Install PHP with extensions. - uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: coverage: false extensions: fileinfo, intl @@ -61,7 +65,7 @@ jobs: php-version: ${{ matrix.php }} - name: Install Composer dependencies - uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f + uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f # 3.2.1 - name: Run codeception build. run: vendor/bin/codecept build @@ -77,7 +81,7 @@ jobs: - name: Upload coverage to Codecov. if: matrix.os == 'ubuntu-latest' - uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 + uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0 with: token: ${{ secrets.CODECOV_TOKEN }} files: runtime/tests/_output/coverage.xml diff --git a/.github/workflows/composer-dependency-analyzer.yml b/.github/workflows/composer-dependency-analyzer.yml index c126c82..2ef3d7c 100644 --- a/.github/workflows/composer-dependency-analyzer.yml +++ b/.github/workflows/composer-dependency-analyzer.yml @@ -22,6 +22,10 @@ on: name: Composer dependency analyzer +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + permissions: contents: read @@ -43,19 +47,19 @@ jobs: steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: persist-credentials: false - name: Install PHP with extensions - uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: coverage: none php-version: ${{ matrix.php }} tools: composer:v2, cs2pr - name: Install Composer dependencies - uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f + uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f # 3.2.1 - name: Run composer dependency analyzer run: vendor/bin/composer-dependency-analyser --config=composer-dependency-analyser.php diff --git a/.github/workflows/cs.yml b/.github/workflows/cs.yml index 361fde2..a8ee45f 100644 --- a/.github/workflows/cs.yml +++ b/.github/workflows/cs.yml @@ -1,5 +1,9 @@ name: Code Style +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + permissions: contents: read @@ -15,24 +19,25 @@ on: jobs: cs-fix: + name: PHP CS Fixer and Rector runs-on: ubuntu-latest permissions: - contents: write + contents: write # Required to push automated CS fixes to the pull request branch. steps: - name: Checkout code - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - name: Install PHP - uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: 8.2 tools: composer:v2 coverage: none - name: Install Composer dependencies - uses: ramsey/composer-install@26d8a556604053a9612623447203a691f406fbe6 + uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f # 3.2.1 - name: Run PHP CS Fixer run: ./vendor/bin/php-cs-fixer fix --config=.php-cs-fixer.php @@ -46,8 +51,14 @@ jobs: run: git config --global credential.helper '!f() { echo username=x-access-token; echo password=$GH_TOKEN; }; f' - name: Commit changes - uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 - with: - commit_message: "Apply PHP CS Fixer and Rector changes (CI)" - file_pattern: '*.php' - disable_globbing: true + run: | + git add -- '*.php' + + if git diff --cached --quiet; then + exit 0 + fi + + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git commit -m "Apply PHP CS Fixer and Rector changes (CI)" + git push diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml index 4dea3c1..ff81524 100644 --- a/.github/workflows/static.yml +++ b/.github/workflows/static.yml @@ -20,6 +20,10 @@ on: name: static analysis +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + permissions: contents: read @@ -40,19 +44,21 @@ jobs: steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: persist-credentials: false - name: Install PHP with extensions - uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: coverage: none php-version: ${{ matrix.php }} tools: composer:v2, cs2pr - name: Install Composer dependencies - uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f + uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f # 3.2.1 - name: Static analysis - run: vendor/bin/psalm --shepherd --stats --output-format=checkstyle --no-cache --php-version=${{ matrix.php }} | cs2pr --graceful-warnings --colorize + env: + PHP_VERSION: ${{ matrix.php }} + run: vendor/bin/psalm --shepherd --stats --output-format=checkstyle --no-cache --php-version="${PHP_VERSION}" | cs2pr --graceful-warnings --colorize