chore(ci): adopt zizmor, fix its high findings, group dependabot PRs #148
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Tests | |
| on: | |
| push: | |
| branches: [4.x] | |
| pull_request: | |
| branches: [4.x] | |
| workflow_call: | |
| permissions: | |
| contents: read | |
| jobs: | |
| actions-pinned: | |
| name: Actions pinned to SHA | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Assert every third-party action is pinned to a full commit SHA | |
| run: | | |
| unpinned=$(grep -rhoE '^[[:space:]]*-?[[:space:]]*uses:[[:space:]]*[^[:space:]]+' .github/workflows \ | |
| | sed -E 's/.*uses:[[:space:]]*//' \ | |
| | grep -v '^\./' \ | |
| | grep -vE '@[0-9a-f]{40}$' \ | |
| | sort -u || true) | |
| if [ -n "$unpinned" ]; then | |
| echo "Third-party actions must be pinned to a full 40-character commit SHA." | |
| echo "Unpinned references:" | |
| echo "$unpinned" | sed 's/^/ /' | |
| exit 1 | |
| fi | |
| echo "All third-party action references are pinned to a full commit SHA." | |
| test: | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| os: [ubuntu-latest] | |
| php: [8.3, 8.4] | |
| laravel: [12.*, 13.*] | |
| stability: [prefer-stable] | |
| include: | |
| - laravel: 12.* | |
| testbench: 10.* | |
| - laravel: 13.* | |
| testbench: 11.* | |
| name: P${{ matrix.php }} - L${{ matrix.laravel }} - ${{ matrix.stability }} - ${{ matrix.os }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Setup PHP | |
| uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 | |
| with: | |
| php-version: ${{ matrix.php }} | |
| extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick, fileinfo | |
| coverage: xdebug | |
| - name: Setup problem matchers | |
| run: | | |
| echo "::add-matcher::${{ runner.tool_cache }}/php.json" | |
| echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json" | |
| - name: Install dependencies | |
| run: | | |
| composer require "laravel/framework:${{ matrix.laravel }}" "orchestra/testbench:${{ matrix.testbench }}" --no-interaction --no-update | |
| composer update --${{ matrix.stability }} --prefer-dist --no-interaction | |
| - name: List Installed Dependencies | |
| run: composer show -D | |
| - name: Execute tests | |
| run: vendor/bin/pest --ci |