From cae2f3dd4fdd7e07a0195fdd9d8e2aba8942c4d1 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 00:29:38 +0300 Subject: [PATCH 01/14] Harden GitHub workflows --- .github/workflows/bc.yml | 2 +- .github/workflows/build.yml | 10 ++++++---- .github/workflows/composer-require-checker.yml | 2 +- .github/workflows/mariadb.yml | 2 +- .github/workflows/mssql.yml | 2 +- .github/workflows/mutation.yml | 2 +- .github/workflows/mysql.yml | 2 +- .github/workflows/oracle.yml | 2 +- .github/workflows/pgsql.yml | 2 +- .github/workflows/rector-cs.yml | 2 +- .github/workflows/sqlite.yml | 2 +- .github/workflows/static.yml | 2 +- 12 files changed, 17 insertions(+), 15 deletions(-) diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml index ba292c35..e847858d 100644 --- a/.github/workflows/bc.yml +++ b/.github/workflows/bc.yml @@ -19,7 +19,7 @@ concurrency: jobs: roave_bc_check: - uses: yiisoft/actions/.github/workflows/bc.yml@master + uses: yiisoft/actions/.github/workflows/bc.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: php: >- ['8.5'] diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 9eaaf4eb..53ed619a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -40,17 +40,19 @@ jobs: steps: - name: Checkout. - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + with: + persist-credentials: false - name: Install PHP with extensions. - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 with: php-version: ${{ matrix.php }} ini-values: date.timezone='UTC', pcov.directory=$GITHUB_WORKSPACE, pcov.exclude=#^(?!($GITHUB_WORKSPACE/config/|$GITHUB_WORKSPACE/src/)).*# coverage: pcov - name: Install Composer dependencies + required yiisoft/db and yiisoft/db-sqlite - uses: yiisoft/actions/install-packages@master + uses: yiisoft/actions/install-packages@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: packages: >- ['db', 'db-sqlite'] @@ -60,7 +62,7 @@ jobs: - name: Upload coverage to Codecov. if: matrix.php == '8.5' - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage.xml diff --git a/.github/workflows/composer-require-checker.yml b/.github/workflows/composer-require-checker.yml index 6f44d025..79c5d63f 100644 --- a/.github/workflows/composer-require-checker.yml +++ b/.github/workflows/composer-require-checker.yml @@ -24,7 +24,7 @@ concurrency: jobs: composer-require-checker: - uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@master + uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: php: >- ['8.1', '8.2', '8.3', '8.4', '8.5'] diff --git a/.github/workflows/mariadb.yml b/.github/workflows/mariadb.yml index 96afb023..1954f42b 100644 --- a/.github/workflows/mariadb.yml +++ b/.github/workflows/mariadb.yml @@ -23,4 +23,4 @@ concurrency: jobs: tests: - uses: yiisoft/actions/.github/workflows/db-mariadb.yml@master + uses: yiisoft/actions/.github/workflows/db-mariadb.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 diff --git a/.github/workflows/mssql.yml b/.github/workflows/mssql.yml index 932b139b..f8cf7e3b 100644 --- a/.github/workflows/mssql.yml +++ b/.github/workflows/mssql.yml @@ -23,4 +23,4 @@ concurrency: jobs: tests: - uses: yiisoft/actions/.github/workflows/db-mssql.yml@master + uses: yiisoft/actions/.github/workflows/db-mssql.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml index 9e0c247b..c209e15b 100644 --- a/.github/workflows/mutation.yml +++ b/.github/workflows/mutation.yml @@ -23,4 +23,4 @@ concurrency: jobs: tests: - uses: yiisoft/actions/.github/workflows/db-mutation.yml@master + uses: yiisoft/actions/.github/workflows/db-mutation.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 diff --git a/.github/workflows/mysql.yml b/.github/workflows/mysql.yml index 2cd95094..dadfef3f 100644 --- a/.github/workflows/mysql.yml +++ b/.github/workflows/mysql.yml @@ -23,4 +23,4 @@ concurrency: jobs: tests: - uses: yiisoft/actions/.github/workflows/db-mysql.yml@master + uses: yiisoft/actions/.github/workflows/db-mysql.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 diff --git a/.github/workflows/oracle.yml b/.github/workflows/oracle.yml index 5811a2de..8c27d754 100644 --- a/.github/workflows/oracle.yml +++ b/.github/workflows/oracle.yml @@ -23,4 +23,4 @@ concurrency: jobs: tests: - uses: yiisoft/actions/.github/workflows/db-oracle.yml@master + uses: yiisoft/actions/.github/workflows/db-oracle.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 diff --git a/.github/workflows/pgsql.yml b/.github/workflows/pgsql.yml index e4020c3a..2147dc7a 100644 --- a/.github/workflows/pgsql.yml +++ b/.github/workflows/pgsql.yml @@ -23,4 +23,4 @@ concurrency: jobs: tests: - uses: yiisoft/actions/.github/workflows/db-pgsql.yml@master + uses: yiisoft/actions/.github/workflows/db-pgsql.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 diff --git a/.github/workflows/rector-cs.yml b/.github/workflows/rector-cs.yml index b512f443..d63be8a9 100644 --- a/.github/workflows/rector-cs.yml +++ b/.github/workflows/rector-cs.yml @@ -21,7 +21,7 @@ concurrency: jobs: rector: - uses: yiisoft/actions/.github/workflows/rector-cs.yml@master + uses: yiisoft/actions/.github/workflows/rector-cs.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: php: 8.1 required-packages: >- diff --git a/.github/workflows/sqlite.yml b/.github/workflows/sqlite.yml index 4dbee78b..b7e50ebc 100644 --- a/.github/workflows/sqlite.yml +++ b/.github/workflows/sqlite.yml @@ -23,4 +23,4 @@ concurrency: jobs: tests: - uses: yiisoft/actions/.github/workflows/db-sqlite.yml@master + uses: yiisoft/actions/.github/workflows/db-sqlite.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml index 4e2b077a..c39e1ae5 100644 --- a/.github/workflows/static.yml +++ b/.github/workflows/static.yml @@ -22,7 +22,7 @@ concurrency: jobs: psalm: - uses: yiisoft/actions/.github/workflows/psalm.yml@master + uses: yiisoft/actions/.github/workflows/psalm.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: php: >- ['8.1', '8.2', '8.3', '8.4'] From 1eb5572435f556f58d8b1bd1a738dbfadd1eb2a0 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 02:10:28 +0300 Subject: [PATCH 02/14] Add zizmorify configuration --- .github/dependabot.yml | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d7ebdbfd..6cc00712 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,16 +1,8 @@ version: 2 updates: - # Maintain dependencies for GitHub Actions. - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "daily" - # Too noisy. See https://github.community/t/increase-if-necessary-for-github-actions-in-dependabot/179581 - open-pull-requests-limit: 0 - - # Maintain dependencies for Composer - - package-ecosystem: "composer" - directory: "/" - schedule: - interval: "daily" - versioning-strategy: increase-if-necessary + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7 From f1b6860f2172edb60b7dce045de221198469bfb0 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 02:33:47 +0300 Subject: [PATCH 03/14] Add zizmorify workflow --- .github/workflows/zizmor.yml | 37 ++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000..e9b7e067 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,37 @@ +name: GitHub Actions Security Analysis with zizmor 🌈 + +on: + push: + branches: + - main + paths: + - '.github/**.yml' + - '.github/**.yaml' + pull_request: + paths: + - '.github/**.yml' + - '.github/**.yaml' + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + zizmor: + name: Run zizmor 🌈 + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Run zizmor 🌈 + uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 + with: + advanced-security: false + annotations: true + persona: 'pedantic' From c9c298a742370b5585a0b1a284371124568da149 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 12:02:38 +0300 Subject: [PATCH 04/14] Restore Dependabot non-GitHub-Actions updates --- .github/dependabot.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6cc00712..cb0e7a1e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,5 +1,19 @@ version: 2 updates: + # Maintain dependencies for GitHub Actions. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "daily" + # Too noisy. See https://github.community/t/increase-if-necessary-for-github-actions-in-dependabot/179581 + open-pull-requests-limit: 0 + + # Maintain dependencies for Composer + - package-ecosystem: "composer" + directory: "/" + schedule: + interval: "daily" + versioning-strategy: increase-if-necessary - package-ecosystem: "github-actions" directory: "/" schedule: From c84bee263d7cf35762a8363c0e82412be167f2b4 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sat, 20 Jun 2026 11:40:46 +0300 Subject: [PATCH 05/14] Use master for yiisoft actions --- .github/workflows/bc.yml | 2 +- .github/workflows/build.yml | 2 +- .github/workflows/composer-require-checker.yml | 2 +- .github/workflows/mariadb.yml | 2 +- .github/workflows/mssql.yml | 2 +- .github/workflows/mutation.yml | 2 +- .github/workflows/mysql.yml | 2 +- .github/workflows/oracle.yml | 2 +- .github/workflows/pgsql.yml | 2 +- .github/workflows/rector-cs.yml | 2 +- .github/workflows/sqlite.yml | 2 +- .github/workflows/static.yml | 2 +- .github/zizmor.yml | 5 +++++ 13 files changed, 17 insertions(+), 12 deletions(-) create mode 100644 .github/zizmor.yml diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml index e847858d..ba292c35 100644 --- a/.github/workflows/bc.yml +++ b/.github/workflows/bc.yml @@ -19,7 +19,7 @@ concurrency: jobs: roave_bc_check: - uses: yiisoft/actions/.github/workflows/bc.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/bc.yml@master with: php: >- ['8.5'] diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 53ed619a..f171fb0e 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -52,7 +52,7 @@ jobs: coverage: pcov - name: Install Composer dependencies + required yiisoft/db and yiisoft/db-sqlite - uses: yiisoft/actions/install-packages@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/install-packages@master with: packages: >- ['db', 'db-sqlite'] diff --git a/.github/workflows/composer-require-checker.yml b/.github/workflows/composer-require-checker.yml index 79c5d63f..6f44d025 100644 --- a/.github/workflows/composer-require-checker.yml +++ b/.github/workflows/composer-require-checker.yml @@ -24,7 +24,7 @@ concurrency: jobs: composer-require-checker: - uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@master with: php: >- ['8.1', '8.2', '8.3', '8.4', '8.5'] diff --git a/.github/workflows/mariadb.yml b/.github/workflows/mariadb.yml index 1954f42b..96afb023 100644 --- a/.github/workflows/mariadb.yml +++ b/.github/workflows/mariadb.yml @@ -23,4 +23,4 @@ concurrency: jobs: tests: - uses: yiisoft/actions/.github/workflows/db-mariadb.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/db-mariadb.yml@master diff --git a/.github/workflows/mssql.yml b/.github/workflows/mssql.yml index f8cf7e3b..932b139b 100644 --- a/.github/workflows/mssql.yml +++ b/.github/workflows/mssql.yml @@ -23,4 +23,4 @@ concurrency: jobs: tests: - uses: yiisoft/actions/.github/workflows/db-mssql.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/db-mssql.yml@master diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml index c209e15b..9e0c247b 100644 --- a/.github/workflows/mutation.yml +++ b/.github/workflows/mutation.yml @@ -23,4 +23,4 @@ concurrency: jobs: tests: - uses: yiisoft/actions/.github/workflows/db-mutation.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/db-mutation.yml@master diff --git a/.github/workflows/mysql.yml b/.github/workflows/mysql.yml index dadfef3f..2cd95094 100644 --- a/.github/workflows/mysql.yml +++ b/.github/workflows/mysql.yml @@ -23,4 +23,4 @@ concurrency: jobs: tests: - uses: yiisoft/actions/.github/workflows/db-mysql.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/db-mysql.yml@master diff --git a/.github/workflows/oracle.yml b/.github/workflows/oracle.yml index 8c27d754..5811a2de 100644 --- a/.github/workflows/oracle.yml +++ b/.github/workflows/oracle.yml @@ -23,4 +23,4 @@ concurrency: jobs: tests: - uses: yiisoft/actions/.github/workflows/db-oracle.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/db-oracle.yml@master diff --git a/.github/workflows/pgsql.yml b/.github/workflows/pgsql.yml index 2147dc7a..e4020c3a 100644 --- a/.github/workflows/pgsql.yml +++ b/.github/workflows/pgsql.yml @@ -23,4 +23,4 @@ concurrency: jobs: tests: - uses: yiisoft/actions/.github/workflows/db-pgsql.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/db-pgsql.yml@master diff --git a/.github/workflows/rector-cs.yml b/.github/workflows/rector-cs.yml index d63be8a9..b512f443 100644 --- a/.github/workflows/rector-cs.yml +++ b/.github/workflows/rector-cs.yml @@ -21,7 +21,7 @@ concurrency: jobs: rector: - uses: yiisoft/actions/.github/workflows/rector-cs.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/rector-cs.yml@master with: php: 8.1 required-packages: >- diff --git a/.github/workflows/sqlite.yml b/.github/workflows/sqlite.yml index b7e50ebc..4dbee78b 100644 --- a/.github/workflows/sqlite.yml +++ b/.github/workflows/sqlite.yml @@ -23,4 +23,4 @@ concurrency: jobs: tests: - uses: yiisoft/actions/.github/workflows/db-sqlite.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/db-sqlite.yml@master diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml index c39e1ae5..4e2b077a 100644 --- a/.github/workflows/static.yml +++ b/.github/workflows/static.yml @@ -22,7 +22,7 @@ concurrency: jobs: psalm: - uses: yiisoft/actions/.github/workflows/psalm.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/psalm.yml@master with: php: >- ['8.1', '8.2', '8.3', '8.4'] diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 00000000..85ca7982 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,5 @@ +rules: + unpinned-uses: + config: + policies: + "yiisoft/*": any From 13abbd57231bcdce95e014ec6b827912e8802e05 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sat, 20 Jun 2026 11:40:51 +0300 Subject: [PATCH 06/14] Use master for yiisoft actions --- .github/zizmor.yml | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .github/zizmor.yml diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 00000000..85ca7982 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,5 @@ +rules: + unpinned-uses: + config: + policies: + "yiisoft/*": any From 66a286023962cc27bce343f6f2115c0621177b6d Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sat, 20 Jun 2026 12:10:23 +0300 Subject: [PATCH 07/14] Use master for yiisoft actions --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d7ebdbfd..426dc2b0 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,8 @@ updates: open-pull-requests-limit: 0 # Maintain dependencies for Composer + ignore: + - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: From 28f0440fd6dd6cce25cec6d7063b3c13bd8608f5 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sat, 20 Jun 2026 12:10:28 +0300 Subject: [PATCH 08/14] Use master for yiisoft actions --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index cb0e7a1e..763f7080 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,8 @@ updates: open-pull-requests-limit: 0 # Maintain dependencies for Composer + ignore: + - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: @@ -20,3 +22,5 @@ updates: interval: "weekly" cooldown: default-days: 7 + ignore: + - dependency-name: "yiisoft/*" From 30481c0be9a80c506b8fd5b41fdf52035d7ba151 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sun, 21 Jun 2026 15:25:02 +0300 Subject: [PATCH 09/14] Remove redundant zizmor config --- .github/zizmor.yml | 5 ----- 1 file changed, 5 deletions(-) delete mode 100644 .github/zizmor.yml diff --git a/.github/zizmor.yml b/.github/zizmor.yml deleted file mode 100644 index 85ca7982..00000000 --- a/.github/zizmor.yml +++ /dev/null @@ -1,5 +0,0 @@ -rules: - unpinned-uses: - config: - policies: - "yiisoft/*": any From 303b58c926ddacdde852d267d4eaa11e81233566 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Wed, 24 Jun 2026 16:12:32 +0300 Subject: [PATCH 10/14] Remove redundant dependabot change --- .github/dependabot.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 426dc2b0..d7ebdbfd 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,8 +9,6 @@ updates: open-pull-requests-limit: 0 # Maintain dependencies for Composer - ignore: - - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: From 8742284c793726f8b6c636e671f1278c6d59a211 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Wed, 24 Jun 2026 16:32:25 +0300 Subject: [PATCH 11/14] Revert "Remove redundant dependabot change" This reverts commit 303b58c926ddacdde852d267d4eaa11e81233566. --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d7ebdbfd..426dc2b0 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,8 @@ updates: open-pull-requests-limit: 0 # Maintain dependencies for Composer + ignore: + - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: From 7513f65da079867e5023abbd302ddeb9a0afece1 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Thu, 25 Jun 2026 00:46:40 +0300 Subject: [PATCH 12/14] Fix zizmor workflow findings --- .github/dependabot.yml | 2 ++ .github/workflows/zizmor.yml | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a4c1ef2b..5fd269da 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -16,3 +16,5 @@ updates: schedule: interval: "daily" versioning-strategy: increase-if-necessary + cooldown: + default-days: 7 diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 94658469..430255de 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -14,8 +14,8 @@ on: - '.github/**.yaml' permissions: - actions: read - contents: read + actions: read # Required by zizmor when reading workflow metadata through the API. + contents: read # Required to read workflow files. jobs: zizmor: From 794edc4f096ced0a47a56443d7e972d51cbba8b6 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Tue, 30 Jun 2026 20:06:17 +0300 Subject: [PATCH 13/14] Fix zizmor workflow findings --- .github/workflows/rector-cs.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/rector-cs.yml b/.github/workflows/rector-cs.yml index b512f443..75b3a88e 100644 --- a/.github/workflows/rector-cs.yml +++ b/.github/workflows/rector-cs.yml @@ -13,7 +13,7 @@ on: - '.php-cs-fixer.dist.php' permissions: - contents: write + contents: read concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -21,6 +21,8 @@ concurrency: jobs: rector: + permissions: + contents: write # Required to push PHP CS Fixer and Rector changes back to the branch. uses: yiisoft/actions/.github/workflows/rector-cs.yml@master with: php: 8.1 From f2e636195fdebe5351e6c697848d867903a0a0b6 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Tue, 30 Jun 2026 20:10:49 +0300 Subject: [PATCH 14/14] Fix build workflow zizmor warnings --- .github/workflows/build.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f171fb0e..8177a8a5 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -40,12 +40,12 @@ jobs: steps: - name: Checkout. - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - name: Install PHP with extensions. - uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: ${{ matrix.php }} ini-values: date.timezone='UTC', pcov.directory=$GITHUB_WORKSPACE, pcov.exclude=#^(?!($GITHUB_WORKSPACE/config/|$GITHUB_WORKSPACE/src/)).*# @@ -62,7 +62,7 @@ jobs: - name: Upload coverage to Codecov. if: matrix.php == '8.5' - uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 + uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage.xml