Skip to content

Commit 2a76adb

Browse files
ManukMinasyanManukMinasyan
authored
Merge pull request #203 from relaticle/chore/harden-ci
chore(ci): pin actions, add cooldown, security policy, lean dist
2 parents c6f3c52 + e69e7bb commit 2a76adb

9 files changed

Lines changed: 172 additions & 41 deletions

File tree

‎.gitattributes‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,7 @@
99
/.github export-ignore
1010
CHANGELOG.md export-ignore
1111
.styleci.yml export-ignore
12+
composer.lock export-ignore
13+
phpstan.neon export-ignore
1214

13-
/docs export-ignore
15+
/docs export-ignore

‎.github/SECURITY.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Security Policy
2+
3+
If you discover any security related issues, please email manuk.minasyan1@gmail.com instead of using the issue tracker.

‎.github/dependabot.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,50 @@ updates:
55
directory: "/"
66
schedule:
77
interval: "weekly"
8+
cooldown:
9+
default-days: 7
10+
groups:
11+
github-actions:
12+
patterns:
13+
- "*"
14+
labels:
15+
- "dependencies"
16+
17+
- package-ecosystem: "composer"
18+
directory: "/"
19+
schedule:
20+
interval: "weekly"
21+
cooldown:
22+
default-days: 7
23+
groups:
24+
composer:
25+
patterns:
26+
- "*"
27+
labels:
28+
- "dependencies"
29+
30+
- package-ecosystem: "npm"
31+
directory: "/"
32+
schedule:
33+
interval: "weekly"
34+
cooldown:
35+
default-days: 7
36+
groups:
37+
npm:
38+
patterns:
39+
- "*"
40+
labels:
41+
- "dependencies"
42+
43+
- package-ecosystem: "npm"
44+
directory: "/docs"
45+
schedule:
46+
interval: "weekly"
47+
cooldown:
48+
default-days: 7
49+
groups:
50+
npm:
51+
patterns:
52+
- "*"
853
labels:
954
- "dependencies"

‎.github/workflows/auto-merge.yml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,24 @@
11
name: Auto-Merge
22

3-
on: pull_request_target
3+
on: pull_request
44

55
permissions:
6-
pull-requests: write
7-
contents: write
6+
contents: read
87

98
jobs:
109
dependabot:
1110
runs-on: ubuntu-latest
12-
if: ${{ github.actor == 'dependabot[bot]' }}
11+
if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
12+
13+
permissions:
14+
pull-requests: write
15+
contents: write
16+
1317
steps:
1418

1519
- name: Dependabot metadata
1620
id: metadata
17-
uses: dependabot/fetch-metadata@v3.1.0
21+
uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
1822
with:
1923
github-token: "${{ secrets.GITHUB_TOKEN }}"
2024

‎.github/workflows/deploy-docs.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -65,18 +65,18 @@ jobs:
6565
esac
6666
6767
- name: Checkout source branch
68-
uses: actions/checkout@v7
68+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
6969
with:
7070
ref: ${{ steps.version.outputs.branch }}
7171

7272
- name: Checkout gh-pages
73-
uses: actions/checkout@v7
73+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
7474
with:
7575
ref: gh-pages
7676
path: gh-pages
7777

7878
- name: Setup Node.js
79-
uses: actions/setup-node@v7
79+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
8080
with:
8181
node-version: '20'
8282
cache: 'npm'

‎.github/workflows/pint.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,14 @@ jobs:
1414

1515
steps:
1616
- name: Checkout code
17-
uses: actions/checkout@v7
17+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
1818
with:
1919
ref: ${{ github.head_ref }}
2020

2121
- name: Fix PHP code style issues
22-
uses: aglipanci/laravel-pint-action@2.6
22+
uses: aglipanci/laravel-pint-action@36de00d5f5a8a4e12d443e01671daa12a18f4c79 # 2.6
2323

2424
- name: Commit changes
25-
uses: stefanzweifel/git-auto-commit-action@v7
25+
uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
2626
with:
2727
commit_message: Fix styling

‎.github/workflows/release.yml‎

Lines changed: 44 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -6,89 +6,104 @@ on:
66
- 'v*.*.*'
77

88
permissions:
9-
contents: write
9+
contents: read
1010

1111
jobs:
1212
tests:
1313
uses: ./.github/workflows/tests.yml
14-
secrets: inherit
1514

1615
release:
1716
needs: tests
1817
runs-on: ubuntu-latest
18+
permissions:
19+
contents: write
1920

2021
steps:
2122
- name: Checkout code
22-
uses: actions/checkout@v7
23+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
24+
with:
25+
persist-credentials: false
2326

2427
- name: Determine if pre-release
2528
id: prerelease
29+
env:
30+
TAG: ${{ github.ref_name }}
2631
run: |
27-
TAG="${{ github.ref_name }}"
2832
if [[ "$TAG" == *"-"* ]]; then
29-
echo "flag=--prerelease" >> $GITHUB_OUTPUT
33+
echo "flag=--prerelease" >> "$GITHUB_OUTPUT"
3034
else
31-
echo "flag=" >> $GITHUB_OUTPUT
35+
echo "flag=" >> "$GITHUB_OUTPUT"
3236
fi
3337
3438
- name: Check if release exists
3539
id: check
40+
env:
41+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
42+
TAG: ${{ github.ref_name }}
3643
run: |
37-
if gh release view "${{ github.ref_name }}" > /dev/null 2>&1; then
38-
echo "exists=true" >> $GITHUB_OUTPUT
44+
if gh release view "$TAG" > /dev/null 2>&1; then
45+
echo "exists=true" >> "$GITHUB_OUTPUT"
3946
else
40-
echo "exists=false" >> $GITHUB_OUTPUT
47+
echo "exists=false" >> "$GITHUB_OUTPUT"
4148
fi
42-
env:
43-
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
4449
4550
- name: Create GitHub Release
4651
if: steps.check.outputs.exists == 'false'
47-
run: gh release create "${{ github.ref_name }}" --generate-notes ${{ steps.prerelease.outputs.flag }}
4852
env:
4953
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
54+
TAG: ${{ github.ref_name }}
55+
PRERELEASE_FLAG: ${{ steps.prerelease.outputs.flag }}
56+
run: gh release create "$TAG" --generate-notes $PRERELEASE_FLAG
5057

5158
changelog:
5259
needs: release
5360
runs-on: ubuntu-latest
61+
permissions:
62+
contents: write
5463

5564
steps:
5665
- name: Determine target branch
5766
id: branch
67+
env:
68+
TAG: ${{ github.ref_name }}
69+
REPO: ${{ github.repository }}
70+
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
5871
run: |
59-
TAG="${{ github.ref_name }}"
6072
MAJOR=$(echo "$TAG" | sed -E 's/^v?([0-9]+)\..*/\1/')
6173
BRANCH="${MAJOR}.x"
62-
if ! git ls-remote --exit-code --heads "https://github.com/${{ github.repository }}" "$BRANCH" > /dev/null 2>&1; then
63-
BRANCH="${{ github.event.repository.default_branch }}"
74+
if ! git ls-remote --exit-code --heads "https://github.com/$REPO" "$BRANCH" > /dev/null 2>&1; then
75+
BRANCH="$DEFAULT_BRANCH"
6476
fi
65-
echo "name=${BRANCH}" >> $GITHUB_OUTPUT
77+
echo "name=${BRANCH}" >> "$GITHUB_OUTPUT"
6678
6779
- name: Checkout code
68-
uses: actions/checkout@v7
80+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
6981
with:
7082
ref: ${{ steps.branch.outputs.name }}
7183
ssh-key: ${{ secrets.DEPLOY_KEY }}
7284

7385
- name: Get release notes
7486
id: notes
75-
run: |
76-
NOTES=$(gh release view "${{ github.ref_name }}" --json body --jq .body)
77-
EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
78-
echo "body<<$EOF" >> $GITHUB_OUTPUT
79-
echo "$NOTES" >> $GITHUB_OUTPUT
80-
echo "$EOF" >> $GITHUB_OUTPUT
8187
env:
8288
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
89+
TAG: ${{ github.ref_name }}
90+
run: |
91+
NOTES=$(gh release view "$TAG" --json body --jq .body)
92+
EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
93+
{
94+
echo "body<<$EOF"
95+
echo "$NOTES"
96+
echo "$EOF"
97+
} >> "$GITHUB_OUTPUT"
8398
8499
- name: Update Changelog
85-
uses: stefanzweifel/changelog-updater-action@v1
100+
uses: stefanzweifel/changelog-updater-action@a938690fad7edf25368f37e43a1ed1b34303eb36 # v1.12.0
86101
with:
87102
latest-version: ${{ github.ref_name }}
88103
release-notes: ${{ steps.notes.outputs.body }}
89104

90105
- name: Commit updated CHANGELOG
91-
uses: stefanzweifel/git-auto-commit-action@v7
106+
uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
92107
with:
93108
branch: ${{ steps.branch.outputs.name }}
94109
commit_message: "chore: update CHANGELOG for ${{ github.ref_name }}"
@@ -103,7 +118,9 @@ jobs:
103118

104119
steps:
105120
- name: Checkout code
106-
uses: actions/checkout@v7
121+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
107122

108123
- name: Delete tag on test failure
109-
run: git push --delete origin "${{ github.ref_name }}"
124+
env:
125+
TAG: ${{ github.ref_name }}
126+
run: git push --delete origin "$TAG"

‎.github/workflows/tests.yml‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,37 @@ on:
77
branches: [3.x]
88
workflow_call:
99

10+
permissions:
11+
contents: read
12+
1013
jobs:
14+
actions-pinned:
15+
name: Actions pinned to SHA
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- name: Checkout code
20+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
21+
with:
22+
persist-credentials: false
23+
24+
- name: Assert every third-party action is pinned to a full commit SHA
25+
run: |
26+
unpinned=$(grep -rhoE '^[[:space:]]*-?[[:space:]]*uses:[[:space:]]*[^[:space:]]+' .github/workflows \
27+
| sed -E 's/.*uses:[[:space:]]*//' \
28+
| grep -v '^\./' \
29+
| grep -vE '@[0-9a-f]{40}$' \
30+
| sort -u || true)
31+
32+
if [ -n "$unpinned" ]; then
33+
echo "Third-party actions must be pinned to a full 40-character commit SHA."
34+
echo "Unpinned references:"
35+
echo "$unpinned" | sed 's/^/ /'
36+
exit 1
37+
fi
38+
39+
echo "All third-party action references are pinned to a full commit SHA."
40+
1141
tests:
1242
runs-on: ubuntu-latest
1343
strategy:
@@ -26,10 +56,10 @@ jobs:
2656

2757
steps:
2858
- name: Checkout code
29-
uses: actions/checkout@v7
59+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3060

3161
- name: Setup PHP
32-
uses: shivammathur/setup-php@v2
62+
uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
3363
with:
3464
php-version: ${{ matrix.php }}
3565
extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick, fileinfo

‎.github/workflows/zizmor.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Zizmor
2+
3+
on:
4+
push:
5+
paths:
6+
- '.github/workflows/**'
7+
- '.github/dependabot.yml'
8+
pull_request:
9+
paths:
10+
- '.github/workflows/**'
11+
- '.github/dependabot.yml'
12+
13+
permissions:
14+
contents: read
15+
16+
jobs:
17+
zizmor:
18+
runs-on: ubuntu-latest
19+
permissions:
20+
contents: read
21+
security-events: write
22+
23+
steps:
24+
- name: Checkout code
25+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
26+
with:
27+
persist-credentials: false
28+
29+
- name: Audit workflows
30+
uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2

0 commit comments

Comments
 (0)