Skip to content

fix(ci): pin shivammathur/setup-php to commit SHA in tests workflow#175

Merged
s2x merged 1 commit intomasterfrom
fix/pin-setup-php-to-sha
Apr 30, 2026
Merged

fix(ci): pin shivammathur/setup-php to commit SHA in tests workflow#175
s2x merged 1 commit intomasterfrom
fix/pin-setup-php-to-sha

Conversation

@s2x
Copy link
Copy Markdown
Collaborator

@s2x s2x commented Apr 30, 2026

Summary

  • Replace mutable tag shivammathur/setup-php@v2 with a pinned commit SHA in .github/workflows/tests.yaml
  • Prevents supply chain attacks via force-pushed tags
  • Aligns with the pinning strategy already used in release.yaml

Changes

Location Before After
tests.yaml line 15 (lint job) shivammathur/setup-php@v2 shivammathur/setup-php@accd6127 # v2.37.0
tests.yaml line 85 (test job) shivammathur/setup-php@v2 shivammathur/setup-php@accd6127 # v2.37.0

Closes #149

Replace mutable tag @v2 with a pinned commit SHA (accd6127)
to prevent supply chain attacks via force-pushed tags. Aligns with
the pinning strategy already used in release.yaml.

Closes #149
@s2x s2x merged commit 97b98c2 into master Apr 30, 2026
22 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CI: Pin shivammathur/setup-php to SHA in tests workflow

1 participant