From 0edc2e15c21da96c6054e0b209a5af5ce59f25d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Piotr=20Ha=C5=82as?= Date: Fri, 1 May 2026 00:13:01 +0200 Subject: [PATCH] fix(ci): pin shivammathur/setup-php to commit SHA in tests workflow Replace mutable tag @v2 with a pinned commit SHA (accd6127) to prevent supply chain attacks via force-pushed tags. Aligns with the pinning strategy already used in release.yaml. Closes #149 --- .github/workflows/tests.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml index 83fa864..42becc3 100644 --- a/.github/workflows/tests.yaml +++ b/.github/workflows/tests.yaml @@ -12,7 +12,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0 - name: Validate composer.json run: composer validate --strict @@ -82,7 +82,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0 with: php-version: ${{ matrix.php-version }}