From bf9225627705a1db446ef88ffabfa644dcfbfeb6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jefferson=20Sim=C3=A3o=20Gon=C3=A7alves?= Date: Tue, 1 Sep 2026 14:36:38 -0300 Subject: [PATCH] fix: pin GitHub Actions to commit SHA, add dependabot config Pins all 14 third-party Actions in ci.yml, benchmark-comment.yml, and benchmark-on-demand.yml to full commit SHA instead of tag refs, so a re-pointed tag (tj-actions/changed-files incident, 2025-03) can't slip malicious code into CI. Adds .github/dependabot.yml with weekly grouped updates and a 7-day cooldown for composer and github-actions ecosystems. --- .github/dependabot.yml | 21 +++++++++++++++++++++ .github/workflows/benchmark-comment.yml | 6 +++--- .github/workflows/benchmark-on-demand.yml | 8 ++++---- .github/workflows/ci.yml | 14 +++++++------- 4 files changed, 35 insertions(+), 14 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..c9e178fd --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,21 @@ +version: 2 +updates: + - package-ecosystem: "composer" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7 + groups: + all-composer: + patterns: ["*"] + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7 + groups: + all-actions: + patterns: ["*"] diff --git a/.github/workflows/benchmark-comment.yml b/.github/workflows/benchmark-comment.yml index 9fde47f9..5ab13346 100644 --- a/.github/workflows/benchmark-comment.yml +++ b/.github/workflows/benchmark-comment.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Download benchmark result - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: benchmark-result run-id: ${{ github.event.workflow_run.id }} @@ -33,7 +33,7 @@ jobs: echo "To run a specific benchmark, comment /benchmark <name>
attributes, aware, class, default, forwarding, merge, named-slots, no-attributes, slot, compilation" >> benchmark-comment.md - name: Find existing comment - uses: peter-evans/find-comment@v3 + uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3 id: find with: issue-number: ${{ steps.meta.outputs.number }} @@ -41,7 +41,7 @@ jobs: body-includes: '${{ steps.meta.outputs.heading }}' - name: Post or update comment - uses: peter-evans/create-or-update-comment@v4 + uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4 with: issue-number: ${{ steps.meta.outputs.number }} comment-id: ${{ steps.find.outputs.comment-id }} diff --git a/.github/workflows/benchmark-on-demand.yml b/.github/workflows/benchmark-on-demand.yml index fa776c79..ae7e2212 100644 --- a/.github/workflows/benchmark-on-demand.yml +++ b/.github/workflows/benchmark-on-demand.yml @@ -26,12 +26,12 @@ jobs: echo "benchmark=$BENCHMARK" >> "$GITHUB_OUTPUT" - name: Checkout base branch - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: ref: main - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.4' tools: composer:v2 @@ -48,7 +48,7 @@ jobs: run: cp benchmark-snapshot.json ${{ runner.temp }}/benchmark-snapshot.json - name: Checkout PR - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: ref: refs/pull/${{ github.event.issue.number }}/head @@ -64,7 +64,7 @@ jobs: vendor/bin/testbench benchmark ${{ steps.input.outputs.benchmark }} --ci --iterations=5000 --rounds=10 --attempts=10 >> benchmark-result.md - name: Upload benchmark result - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: benchmark-result path: benchmark-result.md diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index abafafc0..e98a82e5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,10 +20,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: ${{ matrix.php }} tools: composer:v2 @@ -36,7 +36,7 @@ jobs: run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT - name: Cache composer - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 with: path: ${{ steps.composer-cache.outputs.dir }} key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }} @@ -61,12 +61,12 @@ jobs: steps: - name: Checkout base branch - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: ref: ${{ github.event.pull_request.base.sha }} - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.4' tools: composer:v2 @@ -83,7 +83,7 @@ jobs: run: cp benchmark-snapshot.json ${{ runner.temp }}/benchmark-snapshot.json - name: Checkout PR - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Install PR dependencies run: composer install --prefer-dist --no-progress --no-interaction @@ -97,7 +97,7 @@ jobs: vendor/bin/testbench benchmark default --ci --iterations=5000 --rounds=10 --attempts=10 >> benchmark-result.md - name: Upload benchmark result - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: benchmark-result path: benchmark-result.md