CptNope · Nov 6, 2026 · Nov 6, 2026 · Nov 6, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,30 @@
+# Dependabot keeps the GitHub Actions used by the workflows up to date. This
+# repository has no Composer or npm dependencies: the plugin ships no
+# third-party code, so the actions are its whole supply chain.
+#
+# Actions are pinned to exact commits with the version in a comment;
+# Dependabot updates both. Updates come as one grouped PR a week, and only
+# for releases at least a week old, so a hijacked release has time to be
+# caught before it reaches CI or the release pipeline. Security updates
+# (when turned on in Settings → Advanced Security) are not delayed.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: America/New_York
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: ci
+    labels:
+      - dependencies
+      - github-actions
+    open-pull-requests-limit: 5
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -9,9 +9,8 @@ on:
 permissions:
   contents: read
 
-# Third-party actions are pinned to exact commits (tags can be moved).
-# checkout v5 = fbc6f39…, setup-php v2 = eb7c497…, setup-node v5 = a0853c2…,
-# WordPress/plugin-check-action v1.1.9 = 10857da…
+# Actions are pinned to exact commits (tags can be moved), with the version in a comment.
+# Dependabot (.github/dependabot.yml) proposes updates weekly.
 
 jobs:
   lint:
@@ -22,8 +21,10 @@ jobs:
       matrix:
         php: ['7.0', '7.1', '7.2', '7.3', '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5']
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
-      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php }}
           coverage: none
@@ -34,8 +35,10 @@ jobs:
     name: README diagrams parse
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
-      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: '22'
       - run: npm install --no-save --no-audit --no-fund mermaid@11 jsdom
@@ -52,13 +55,15 @@ jobs:
     needs: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Build the WordPress.org edition
         run: bash .github/scripts/build-wporg.sh build
 
       # The same checks the WordPress.org review team runs. Errors fail the job.
-      - uses: WordPress/plugin-check-action@10857da14b6c2246d15402b3e69f777edcf8c12e
+      - uses: WordPress/plugin-check-action@10857da14b6c2246d15402b3e69f777edcf8c12e # v1.1.9
         with:
           build-dir: './build/jat-shell-scanner'
           slug: 'jat-shell-scanner'
@@ -69,8 +74,10 @@ jobs:
     needs: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
-      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: '8.3'
           coverage: none
@@ -128,9 +135,11 @@ jobs:
           --health-cmd="mysqladmin ping -proot"
           --health-interval=5s --health-timeout=5s --health-retries=20
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
-      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php }}
           extensions: mysqli, zip

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -0,0 +1,40 @@
+name: CodeQL
+
+# Scans the GitHub Actions workflows for security problems: untrusted input in
+# run steps (script injection), over-broad tokens, risky triggers. CodeQL has
+# no PHP support; the plugin's own code is covered by CI (Plugin Check, the
+# reviewers' phpcs ruleset, integration and false-positive tests).
+on:
+  push:
+    branches: [main]
+    paths: ['.github/**']
+  pull_request:
+    paths: ['.github/**']
+  schedule:
+    - cron: '17 9 * * 1'   # Mondays, after Dependabot's run
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze workflows
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write   # upload results to the Security tab
+      actions: read
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
+
+      - uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          languages: actions
+          queries: security-extended
+
+      - uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          category: /language:actions
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -12,7 +12,7 @@
 # That job only runs once the SVN_USERNAME and SVN_PASSWORD repository
 # secrets exist (set them after WordPress.org approves the plugin).
 #
-# 10up/action-wordpress-plugin-deploy 2.3.0 = 54bd289…
+# Actions are pinned to exact commits; Dependabot proposes updates weekly.
 on:
   workflow_run:
     workflows: [CI]
@@ -28,17 +28,23 @@
 
 jobs:
   release:
-    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push'
+    # Only CI runs for pushes to main in this repository: never a pull request's code (a fork's or not).
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.head_branch == 'main' &&
+      github.event.workflow_run.head_repository.full_name == github.repository
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.v.outputs.version }}
       skip: ${{ steps.v.outputs.skip }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09   # v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
+          persist-credentials: false
           ref: ${{ github.event.workflow_run.head_sha }}
 
       - name: Read and check version
        id: v
        env:
          GH_TOKEN: ${{ github.token }}
@@ -93,7 +99,11 @@
   wporg:
     name: Deploy to WordPress.org
     needs: release
-    if: needs.release.outputs.skip != '1'
+    if: >-
+      needs.release.outputs.skip != '1' &&
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.head_branch == 'main' &&
+      github.event.workflow_run.head_repository.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - name: Are WordPress.org SVN credentials set?
@@ -103,18 +113,19 @@
         run: |
           if [ -n "$SVN_USERNAME" ]; then echo "ok=1" >> "$GITHUB_OUTPUT"; else echo "::notice::SVN_USERNAME / SVN_PASSWORD not set — skipping the WordPress.org deploy."; fi
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         if: steps.creds.outputs.ok == '1'
         with:
+          persist-credentials: false
           ref: ${{ github.event.workflow_run.head_sha }}
 
       - name: Build the WordPress.org edition
        if: steps.creds.outputs.ok == '1'
        run: |
           sudo apt-get update -qq && sudo apt-get install -y -qq subversion
           bash .github/scripts/build-wporg.sh build
 
-      - uses: 10up/action-wordpress-plugin-deploy@54bd289b8525fd23a5c365ec369185f2966529c2
+      - uses: 10up/action-wordpress-plugin-deploy@54bd289b8525fd23a5c365ec369185f2966529c2 # 2.3.0
         if: steps.creds.outputs.ok == '1'
         env:
           SVN_USERNAME: ${{ secrets.SVN_USERNAME }}

diff --git a/.github/workflows/wiki.yml b/.github/workflows/wiki.yml
@@ -24,7 +24,9 @@ jobs:
     name: Rebuild the wiki
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09   # v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Build and publish
         env:

diff --git a/.github/workflows/wporg-assets.yml b/.github/workflows/wporg-assets.yml
@@ -9,7 +9,7 @@ name: Update WordPress.org assets
 #
 # Needs the SVN_USERNAME and SVN_PASSWORD repository secrets.
 #
-# 10up/action-wordpress-plugin-asset-update 2.2.0 = 2480306…
+# Actions are pinned to exact commits; Dependabot proposes updates weekly.
 on:
   workflow_dispatch:
   push:
@@ -40,15 +40,17 @@ jobs:
             exit 1
           fi
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09   # v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Install Subversion
         run: sudo apt-get update -qq && sudo apt-get install -y -qq subversion
 
       # IGNORE_OTHER_FILES: the WordPress.org copy is built by
       # .github/scripts/build-wporg.sh, so trunk never matches the repo
       # file for file. Only readme.txt and the assets are sent.
-      - uses: 10up/action-wordpress-plugin-asset-update@2480306f6f693672726d08b5917ea114cb2825f7
+      - uses: 10up/action-wordpress-plugin-asset-update@2480306f6f693672726d08b5917ea114cb2825f7 # 2.2.0
         env:
           SVN_USERNAME: ${{ secrets.SVN_USERNAME }}
           SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}

diff --git a/.github/workflows/wporg-deploy.yml b/.github/workflows/wporg-deploy.yml
@@ -7,7 +7,7 @@ name: Deploy to WordPress.org
 #
 # Needs the SVN_USERNAME and SVN_PASSWORD repository secrets.
 #
-# 10up/action-wordpress-plugin-deploy 2.3.0 = 54bd289…
+# Actions are pinned to exact commits; Dependabot proposes updates weekly.
 on:
   workflow_dispatch:
 
@@ -33,7 +33,9 @@ jobs:
             exit 1
           fi
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09   # v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Read version
         id: v
@@ -47,7 +49,7 @@ jobs:
           sudo apt-get update -qq && sudo apt-get install -y -qq subversion
           bash .github/scripts/build-wporg.sh build
 
-      - uses: 10up/action-wordpress-plugin-deploy@54bd289b8525fd23a5c365ec369185f2966529c2
+      - uses: 10up/action-wordpress-plugin-deploy@54bd289b8525fd23a5c365ec369185f2966529c2 # 2.3.0
         env:
           SVN_USERNAME: ${{ secrets.SVN_USERNAME }}
           SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}

diff --git a/.github/workflows/wporg-readme.yml b/.github/workflows/wporg-readme.yml
@@ -8,7 +8,7 @@ name: Update WordPress.org readme
 #
 # Needs the SVN_USERNAME and SVN_PASSWORD repository secrets.
 #
-# 10up/action-wordpress-plugin-asset-update 2.2.0 = 2480306…
+# Actions are pinned to exact commits; Dependabot proposes updates weekly.
 on:
   workflow_dispatch:
 
@@ -24,12 +24,14 @@ jobs:
     name: Update readme and images
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09   # v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Install Subversion
         run: sudo apt-get update -qq && sudo apt-get install -y -qq subversion
 
-      - uses: 10up/action-wordpress-plugin-asset-update@2480306f6f693672726d08b5917ea114cb2825f7
+      - uses: 10up/action-wordpress-plugin-asset-update@2480306f6f693672726d08b5917ea114cb2825f7 # 2.2.0
         env:
           SVN_USERNAME: ${{ secrets.SVN_USERNAME }}
           SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}

diff --git a/README.md b/README.md
@@ -1133,7 +1133,7 @@ flowchart LR
 
 **Wiki.** The [wiki](https://github.com/CptNope/JAT-Shell-Scanner/wiki) is built from this README by `.github/scripts/build-wiki.py`, which splits the numbered sections into pages. The **Wiki** workflow rebuilds it whenever README.md changes on main, so edit the README, not the wiki.
 
-Workflow actions are pinned to exact commits. Detection rules live in [`includes/signatures.php`](includes/signatures.php) — **new indicators are very welcome**: open an issue or pull request with a link to the source.
+Workflow actions are pinned to exact commits, with the version in a comment. **Dependabot** proposes one grouped update a week, only for releases at least a week old, and **CodeQL** scans the workflows themselves for injection and over-broad permissions. Detection rules live in [`includes/signatures.php`](includes/signatures.php) — **new indicators are very welcome**: open an issue or pull request with a link to the source.
 
 ## 22. Limits