From 0399eb7834b1a925b651121557732185e7854b05 Mon Sep 17 00:00:00 2001
From: James Titcumb <james@asgrim.com>
Date: Wed, 17 Jun 2026 07:44:06 +0100
Subject: [PATCH 1/6] 615: add Zizmor GH action

---
 .github/workflows/continuous-integration.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
index 6405a8f0..e83b33d7 100644
--- a/.github/workflows/continuous-integration.yml
+++ b/.github/workflows/continuous-integration.yml
@@ -221,6 +221,14 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: sudo infection --min-msi=68 --min-covered-msi=68 --threads=max --show-mutations=max --no-progress
 
+  zizmor:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: zizmorcore/zizmor-action@v0.5.6
+        with:
+          advanced-security: false
+
   build-assets:
     needs:
       - unit-tests

From d2652913721fd3b0940e09e9fecbc82b4260b1a5 Mon Sep 17 00:00:00 2001
From: James Titcumb <james@asgrim.com>
Date: Wed, 17 Jun 2026 08:05:37 +0100
Subject: [PATCH 2/6] 615: don't persist credentials in .git for
 actions/checkout

---
 .github/workflows/build-and-push-docker-image.yml |  2 ++
 .github/workflows/build-assets.yml                |  3 +++
 .github/workflows/continuous-integration.yml      | 14 ++++++++++++++
 .github/workflows/docs.yml                        |  2 ++
 .github/workflows/release.yml                     |  3 +++
 5 files changed, 24 insertions(+)

diff --git a/.github/workflows/build-and-push-docker-image.yml b/.github/workflows/build-and-push-docker-image.yml
index aad1ed4d..fe8b578f 100644
--- a/.github/workflows/build-and-push-docker-image.yml
+++ b/.github/workflows/build-and-push-docker-image.yml
@@ -43,6 +43,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Fetch built PHAR from artifacts
         uses: actions/download-artifact@v8
diff --git a/.github/workflows/build-assets.yml b/.github/workflows/build-assets.yml
index 41503677..10a6001e 100644
--- a/.github/workflows/build-assets.yml
+++ b/.github/workflows/build-assets.yml
@@ -41,6 +41,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          persist-credentials: false
       # Fixes `git describe` picking the wrong tag - see https://github.com/php/pie/issues/307
       - run: git fetch --tags --force
       # Ensure some kind of previous tag exists, otherwise box fails
@@ -88,6 +89,8 @@ jobs:
       attestations: write
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Download SPC (non-Windows)
         if: runner.os != 'Windows'
diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
index e83b33d7..4f835087 100644
--- a/.github/workflows/continuous-integration.yml
+++ b/.github/workflows/continuous-integration.yml
@@ -30,6 +30,8 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: ramsey/composer-install@v4
       - name: GH token (non-Windows)
         if: matrix.operating-system != 'windows-latest'
@@ -119,6 +121,8 @@ jobs:
           sudo make install
           cd $GITHUB_WORKSPACE
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Composer Install
         run: composer install --ignore-platform-reqs
       - name: Run bundled PHP install test
@@ -132,6 +136,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          persist-credentials: false
       # Fixes `git describe` picking the wrong tag - see https://github.com/php/pie/issues/307
       - run: git fetch --tags --force
       # Ensure some kind of previous tag exists, otherwise box fails
@@ -157,6 +162,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          persist-credentials: false
       # Fixes `git describe` picking the wrong tag - see https://github.com/php/pie/issues/307
       - run: git fetch --tags --force
       # Ensure some kind of previous tag exists, otherwise box fails
@@ -182,6 +188,8 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: ramsey/composer-install@v4
       - name: Run PHPCS
         run: vendor/bin/phpcs
@@ -197,6 +205,8 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: ramsey/composer-install@v4
       - name: Validate the composer configuration
         run: composer validate --strict
@@ -215,6 +225,8 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: ramsey/composer-install@v4
       - name: Run infection
         env:
@@ -225,6 +237,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: zizmorcore/zizmor-action@v0.5.6
         with:
           advanced-security: false
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 338db80e..c4b79e44 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -34,6 +34,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Build documentation
         run: .github/docs/build-docs.sh
       - name: Fetch built PHAR from artifacts
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5c6aceb8..7155e321 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,6 +29,7 @@ jobs:
         with:
           fetch-tags: 'true'
           ref: ${{ github.ref }}
+          persist-credentials: false
       # The changelog is generated locally using jwage/changelog-generator and
       # that forms the signed tag body. The `--notes-from-tag` option below
       # will copy the release notes from the tag so it will contain the changelog
@@ -48,6 +49,8 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Fetch built PHAR from artifacts
         uses: actions/download-artifact@v8
         with:

From d69a4cd40f732755f064bab9aec80a3441033ba1 Mon Sep 17 00:00:00 2001
From: James Titcumb <james@asgrim.com>
Date: Wed, 17 Jun 2026 08:05:53 +0100
Subject: [PATCH 3/6] 615: add cooldown for dependabot

---
 .github/dependabot.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index bcb3c180..467c1975 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,7 +4,11 @@ updates:
     directory: /
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "composer"
     directory: /
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7

From 38e0c75795b3630e30aa7fcba0d2b45a5a0d9af6 Mon Sep 17 00:00:00 2001
From: James Titcumb <james@asgrim.com>
Date: Wed, 17 Jun 2026 08:08:11 +0100
Subject: [PATCH 4/6] 615: use GITHUB_REF_NAME instead of github.ref_name

---
 .github/workflows/release.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7155e321..5dd94641 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,7 +38,7 @@ jobs:
       - name: Create draft release from tag
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release create "${{ github.ref_name }}" --title "${{ github.ref_name }}" --draft --notes-from-tag
+        run: gh release create "${GITHUB_REF_NAME}" --title "${GITHUB_REF_NAME}" --draft --notes-from-tag
 
   attach-release-assets:
     runs-on: ubuntu-latest
@@ -76,8 +76,8 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh release upload "${{ github.ref_name }}" "pie.phar" --clobber ;
-          find executable-pie-binaries -type f -exec gh release upload "${{ github.ref_name }}" {} --clobber \;
+          gh release upload "${GITHUB_REF_NAME}" "pie.phar" --clobber ;
+          find executable-pie-binaries -type f -exec gh release upload "${GITHUB_REF_NAME}" {} --clobber \;
 
   build-and-push-docker-image:
     if: ${{ startsWith(github.ref, 'refs/tags/') }}

From e75b6cf153dfcbaf1d0cf4e432d5f557e8e3aa1e Mon Sep 17 00:00:00 2001
From: James Titcumb <james@asgrim.com>
Date: Wed, 17 Jun 2026 08:25:39 +0100
Subject: [PATCH 5/6] 615: pin all actions to specific hashes

---
 .../workflows/build-and-push-docker-image.yml | 16 ++++----
 .github/workflows/build-assets.yml            | 20 +++++-----
 .github/workflows/continuous-integration.yml  | 38 +++++++++----------
 .github/workflows/docs.yml                    | 10 ++---
 .github/workflows/release.yml                 |  8 ++--
 5 files changed, 46 insertions(+), 46 deletions(-)

diff --git a/.github/workflows/build-and-push-docker-image.yml b/.github/workflows/build-and-push-docker-image.yml
index fe8b578f..cfce8b29 100644
--- a/.github/workflows/build-and-push-docker-image.yml
+++ b/.github/workflows/build-and-push-docker-image.yml
@@ -42,12 +42,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           persist-credentials: false
 
       - name: Fetch built PHAR from artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
         with:
           name: pie-${{ github.sha }}.phar
 
@@ -57,13 +57,13 @@ jobs:
         run: gh attestation verify pie.phar --repo ${{ github.repository }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 #v4.1.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 #v4.1.0
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee #v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -71,7 +71,7 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 #v6.1.0
         with:
           flavor: |
             latest=false
@@ -81,7 +81,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf #v7.2.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64
@@ -92,7 +92,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
       - name: Generate artifact attestation
-        uses: actions/attest@v4
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 #v4.1.0
         with:
           subject-name: ghcr.io/${{ github.repository }}
           subject-digest: ${{ steps.build-and-push.outputs.digest }}
diff --git a/.github/workflows/build-assets.yml b/.github/workflows/build-assets.yml
index 10a6001e..8f3d875e 100644
--- a/.github/workflows/build-assets.yml
+++ b/.github/workflows/build-assets.yml
@@ -33,12 +33,12 @@ jobs:
       attestations: write
     steps:
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
         with:
           coverage: none
           tools: composer, box:4.7.x
           php-version: "${{ matrix.php-version }}"
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -46,7 +46,7 @@ jobs:
       - run: git fetch --tags --force
       # Ensure some kind of previous tag exists, otherwise box fails
       - run: git describe --tags HEAD || git tag 0.0.0
-      - uses: ramsey/composer-install@v4
+      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
       - name: Build PHAR
         run: box compile
       - name: Check the PHAR executes
@@ -58,10 +58,10 @@ jobs:
         # code, which would store attestation that `php/pie` built the PHAR, and
         # it would look genuine. So this should NOT run for PR builds.
         if: github.event_name != 'pull_request' && github.event.repository.visibility == 'public'
-        uses: actions/attest@v4
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 #v4.1.0
         with:
           subject-path: '${{ github.workspace }}/pie.phar'
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
         with:
           name: pie-${{ github.sha }}.phar
           path: pie.phar
@@ -88,7 +88,7 @@ jobs:
       # attestations:write is required for build provenance attestation.
       attestations: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           persist-credentials: false
 
@@ -135,7 +135,7 @@ jobs:
         run: ${{ env.SPC_BINARY }} --version
 
       - name: Grab the pie.phar from artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
         with:
           name: pie-${{ github.sha }}.phar
 
@@ -147,7 +147,7 @@ jobs:
         run: ${{ env.SPC_BINARY }} micro:combine pie.phar --output=${{ env.PIE_BINARY_OUTPUT }}
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
         with:
           coverage: none
           tools: composer
@@ -162,11 +162,11 @@ jobs:
         # code, which would store attestation that `php/pie` built the binaries,
         # and it would look genuine. So this should NOT run for PR builds.
         if: github.event_name != 'pull_request' && github.event.repository.visibility == 'public'
-        uses: actions/attest@v4
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 #v4.1.0
         with:
           subject-path: '${{ github.workspace }}/${{ env.PIE_BINARY_OUTPUT }}'
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
         with:
           name: pie-${{ github.sha }}-${{ runner.os }}-${{ runner.arch }}.bin
           path: ${{ env.PIE_BINARY_OUTPUT }}
diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
index 4f835087..328a067a 100644
--- a/.github/workflows/continuous-integration.yml
+++ b/.github/workflows/continuous-integration.yml
@@ -23,16 +23,16 @@ jobs:
           - '8.5'
     steps:
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
         with:
           php-version: ${{ matrix.php-versions }}
           extensions: intl, sodium, zip
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           persist-credentials: false
-      - uses: ramsey/composer-install@v4
+      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
       - name: GH token (non-Windows)
         if: matrix.operating-system != 'windows-latest'
         run: sudo composer config --global --auth github-oauth.github.com ${{ secrets.GITHUB_TOKEN }}
@@ -120,7 +120,7 @@ jobs:
           make -j$(nproc)
           sudo make install
           cd $GITHUB_WORKSPACE
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           persist-credentials: false
       - name: Composer Install
@@ -133,7 +133,7 @@ jobs:
   end-to-end-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -141,7 +141,7 @@ jobs:
       - run: git fetch --tags --force
       # Ensure some kind of previous tag exists, otherwise box fails
       - run: git describe --tags HEAD || git tag 0.0.0
-      - uses: ramsey/composer-install@v4
+      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
       - name: Run the tests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -159,7 +159,7 @@ jobs:
           - '8.3'
           - '8.4'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -167,7 +167,7 @@ jobs:
       - run: git fetch --tags --force
       # Ensure some kind of previous tag exists, otherwise box fails
       - run: git describe --tags HEAD || git tag 0.0.0
-      - uses: ramsey/composer-install@v4
+      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -181,16 +181,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
         with:
           php-version: 8.1
           extensions: intl, sodium, zip
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           persist-credentials: false
-      - uses: ramsey/composer-install@v4
+      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
       - name: Run PHPCS
         run: vendor/bin/phpcs
 
@@ -198,16 +198,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
         with:
           php-version: 8.5
           extensions: intl, sodium, zip
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           persist-credentials: false
-      - uses: ramsey/composer-install@v4
+      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
       - name: Validate the composer configuration
         run: composer validate --strict
       - name: Run phpstan
@@ -217,17 +217,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
         with:
           php-version: 8.4
           extensions: intl, sodium, zip
           tools: infection
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           persist-credentials: false
-      - uses: ramsey/composer-install@v4
+      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
       - name: Run infection
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -236,10 +236,10 @@ jobs:
   zizmor:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           persist-credentials: false
-      - uses: zizmorcore/zizmor-action@v0.5.6
+      - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d #v0.5.6
         with:
           advanced-security: false
 
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index c4b79e44..bc00fc51 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -33,17 +33,17 @@ jobs:
       - build-assets
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           persist-credentials: false
       - name: Build documentation
         run: .github/docs/build-docs.sh
       - name: Fetch built PHAR from artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
         with:
           name: pie-${{ github.sha }}.phar
       - name: Fetch the executable PIEs from artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
         with:
           path: executable-pie-binaries
           pattern: pie-${{ github.sha }}-*.bin
@@ -59,7 +59,7 @@ jobs:
       - name: Copy executables into docs
         run: cp executable-pie-binaries/* docs-package/
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 #v5.0.0
         with:
           path: docs-package
 
@@ -79,4 +79,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 #v5.0.0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5dd94641..2596921d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,7 @@ jobs:
       # contents:write is required to create the draft release
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           fetch-tags: 'true'
           ref: ${{ github.ref }}
@@ -48,15 +48,15 @@ jobs:
       # contents:write is required to upload the binaries to the release.
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           persist-credentials: false
       - name: Fetch built PHAR from artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
         with:
           name: pie-${{ github.sha }}.phar
       - name: Fetch the executable PIEs from artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
         with:
           path: executable-pie-binaries
           pattern: pie-${{ github.sha }}-*.bin

From 9f1de402b72be3f9269c1a28d84e131d322e2039 Mon Sep 17 00:00:00 2001
From: James Titcumb <james@asgrim.com>
Date: Wed, 17 Jun 2026 08:36:12 +0100
Subject: [PATCH 6/6] 615: don't use env. template expansions

---
 .github/workflows/build-assets.yml           | 19 ++++++++++++++-----
 .github/workflows/continuous-integration.yml |  6 ++++--
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/build-assets.yml b/.github/workflows/build-assets.yml
index 8f3d875e..b1e3b303 100644
--- a/.github/workflows/build-assets.yml
+++ b/.github/workflows/build-assets.yml
@@ -132,7 +132,9 @@ jobs:
           echo "PIE_BINARY_OUTPUT=pie-${{ runner.os }}-${{ runner.arch }}.exe" >> $env:GITHUB_ENV
 
       - name: Check SPC version
-        run: ${{ env.SPC_BINARY }} --version
+        env:
+          SPC_BINARY: ${{ env.SPC_BINARY }}
+        run: ${SPC_BINARY} --version
 
       - name: Grab the pie.phar from artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
@@ -140,11 +142,16 @@ jobs:
           name: pie-${{ github.sha }}.phar
 
       - name: Build for ${{ runner.os }} ${{ runner.arch }} on ${{ matrix.operating-system }}
-        run: ${{ env.SPC_BINARY }} craft resources/spc/craft.yml
+        run: ${SPC_BINARY} craft resources/spc/craft.yml
         env:
+          SPC_BINARY: ${{ env.SPC_BINARY }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Bundle pie.phar into executable PIE binary
-        run: ${{ env.SPC_BINARY }} micro:combine pie.phar --output=${{ env.PIE_BINARY_OUTPUT }}
+        env:
+          PIE_BINARY_OUTPUT: ${{ env.PIE_BINARY_OUTPUT }}
+          SPC_BINARY: ${{ env.SPC_BINARY }}
+        run: ${SPC_BINARY} micro:combine pie.phar --output=${PIE_BINARY_OUTPUT}
 
       - name: Setup PHP
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
@@ -153,7 +160,9 @@ jobs:
           tools: composer
           php-version: "7.4"
       - name: Quick validation that the binary runs
-        run: ./${{ env.PIE_BINARY_OUTPUT }} show --all
+        env:
+          PIE_BINARY_OUTPUT: ${{ env.PIE_BINARY_OUTPUT }}
+        run: ./${PIE_BINARY_OUTPUT} show --all
 
       - name: Generate build provenance attestation
         # It does not make sense to do this for PR builds, nor do contributors
@@ -164,7 +173,7 @@ jobs:
         if: github.event_name != 'pull_request' && github.event.repository.visibility == 'public'
         uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 #v4.1.0
         with:
-          subject-path: '${{ github.workspace }}/${{ env.PIE_BINARY_OUTPUT }}'
+          subject-path: ${{ github.workspace }}/${{ env.PIE_BINARY_OUTPUT }}
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
         with:
diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
index 328a067a..22391281 100644
--- a/.github/workflows/continuous-integration.yml
+++ b/.github/workflows/continuous-integration.yml
@@ -104,12 +104,14 @@ jobs:
           DIST_URL=`curl -fsSL "https://www.php.net/releases/index.php?json&max=1&version=${{ matrix.php-versions }}" | jq -r '.[].source[]|select(.filename|endswith(".gz")).filename'`
           echo "php_src_download_url=https://www.php.net/distributions/$DIST_URL" >> $GITHUB_ENV
       - name: "Install PHP ${{ matrix.php-versions }}"
+        env:
+          php_src_download_url: ${{ env.php_src_download_url }}
         run: |
           mkdir -p /tmp/php
           mkdir -p /tmp/php.ini.d
           cd /tmp/php
-          echo "Downloading release from ${{ env.php_src_download_url }} ..."
-          wget -O php.tgz ${{ env.php_src_download_url }}
+          echo "Downloading release from ${php_src_download_url} ..."
+          wget -O php.tgz ${php_src_download_url}
           tar zxf php.tgz
           rm php.tgz
           ls -l