615 add zizmor

.github/dependabot.yml

@@ -4,7 +4,11 @@ updates:
  directory: /
  schedule:
  interval: "monthly"
+ cooldown:
+ default-days: 7
  - package-ecosystem: "composer"
  directory: /
  schedule:
  interval: "monthly"
+ cooldown:
+ default-days: 7

.github/workflows/build-and-push-docker-image.yml

@@ -42,10 +42,12 @@ jobs:
 
  steps:
  - name: Checkout repository
- uses: actions/checkout@v6
+ uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+ with:
+ persist-credentials: false
 
  - name: Fetch built PHAR from artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
  with:
  name: pie-${{ github.sha }}.phar
 
@@ -55,21 +57,21 @@ jobs:
  run: gh attestation verify pie.phar --repo ${{ github.repository }}
 
  - name: Set up QEMU
- uses: docker/setup-qemu-action@v4
+ uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 #v4.1.0
 
  - name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v4
+ uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 #v4.1.0
 
  - name: Log in to the Container registry
- uses: docker/login-action@v4
+ uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee #v4.2.0
  with:
  registry: ghcr.io
  username: ${{ github.actor }}
  password: ${{ secrets.GITHUB_TOKEN }}
 
  - name: Extract metadata (tags, labels) for Docker
  id: meta
- uses: docker/metadata-action@v6
+ uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 #v6.1.0
  with:
  flavor: |
  latest=false
@@ -79,7 +81,7 @@ jobs:
 
  - name: Build and push Docker image
  id: build-and-push
- uses: docker/build-push-action@v7
+ uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf #v7.2.0
  with:
  context: .
  platforms: linux/amd64,linux/arm64
@@ -90,7 +92,7 @@ jobs:
  labels: ${{ steps.meta.outputs.labels }}
 
  - name: Generate artifact attestation
- uses: actions/attest@v4
+ uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 #v4.1.0
  with:
  subject-name: ghcr.io/${{ github.repository }}
  subject-digest: ${{ steps.build-and-push.outputs.digest }}

.github/workflows/build-assets.yml

@@ -33,19 +33,20 @@ jobs:
  attestations: write
  steps:
  - name: Setup PHP
- uses: shivammathur/setup-php@v2
+ uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
  with:
  coverage: none
  tools: composer, box:4.7.x
  php-version: "${{ matrix.php-version }}"
- - uses: actions/checkout@v6
+ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
  with:
  fetch-depth: 0
+ persist-credentials: false
  # Fixes `git describe` picking the wrong tag - see https://github.com/php/pie/issues/307
  - run: git fetch --tags --force
  # Ensure some kind of previous tag exists, otherwise box fails
  - run: git describe --tags HEAD || git tag 0.0.0
- - uses: ramsey/composer-install@v4
+ - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
  - name: Build PHAR
  run: box compile
  - name: Check the PHAR executes
@@ -57,10 +58,10 @@ jobs:
  # code, which would store attestation that `php/pie` built the PHAR, and
  # it would look genuine. So this should NOT run for PR builds.
  if: github.event_name != 'pull_request' && github.event.repository.visibility == 'public'
- uses: actions/attest@v4
+ uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 #v4.1.0
  with:
  subject-path: '${{ github.workspace }}/pie.phar'
- - uses: actions/upload-artifact@v7
+ - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
  with:
  name: pie-${{ github.sha }}.phar
  path: pie.phar
@@ -87,7 +88,9 @@ jobs:
  # attestations:write is required for build provenance attestation.
  attestations: write
  steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+ with:
+ persist-credentials: false
 
  - name: Download SPC (non-Windows)
  if: runner.os != 'Windows'
@@ -129,28 +132,37 @@ jobs:
  echo "PIE_BINARY_OUTPUT=pie-${{ runner.os }}-${{ runner.arch }}.exe" >> $env:GITHUB_ENV
 
  - name: Check SPC version
- run: ${{ env.SPC_BINARY }} --version
+ env:
+ SPC_BINARY: ${{ env.SPC_BINARY }}
+ run: ${SPC_BINARY} --version
 
  - name: Grab the pie.phar from artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
  with:
  name: pie-${{ github.sha }}.phar
 
  - name: Build for ${{ runner.os }} ${{ runner.arch }} on ${{ matrix.operating-system }}
- run: ${{ env.SPC_BINARY }} craft resources/spc/craft.yml
+ run: ${SPC_BINARY} craft resources/spc/craft.yml
  env:
+ SPC_BINARY: ${{ env.SPC_BINARY }}
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
  - name: Bundle pie.phar into executable PIE binary
- run: ${{ env.SPC_BINARY }} micro:combine pie.phar --output=${{ env.PIE_BINARY_OUTPUT }}
+ env:
+ PIE_BINARY_OUTPUT: ${{ env.PIE_BINARY_OUTPUT }}
+ SPC_BINARY: ${{ env.SPC_BINARY }}
+ run: ${SPC_BINARY} micro:combine pie.phar --output=${PIE_BINARY_OUTPUT}
 
  - name: Setup PHP
- uses: shivammathur/setup-php@v2
+ uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
  with:
  coverage: none
  tools: composer
  php-version: "7.4"
  - name: Quick validation that the binary runs
- run: ./${{ env.PIE_BINARY_OUTPUT }} show --all
+ env:
+ PIE_BINARY_OUTPUT: ${{ env.PIE_BINARY_OUTPUT }}
+ run: ./${PIE_BINARY_OUTPUT} show --all
 
  - name: Generate build provenance attestation
  # It does not make sense to do this for PR builds, nor do contributors
@@ -159,11 +171,11 @@ jobs:
  # code, which would store attestation that `php/pie` built the binaries,
  # and it would look genuine. So this should NOT run for PR builds.
  if: github.event_name != 'pull_request' && github.event.repository.visibility == 'public'
- uses: actions/attest@v4
+ uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 #v4.1.0
  with:
- subject-path: '${{ github.workspace }}/${{ env.PIE_BINARY_OUTPUT }}'
+ subject-path: ${{ github.workspace }}/${{ env.PIE_BINARY_OUTPUT }}
 
- - uses: actions/upload-artifact@v7
+ - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
  with:
  name: pie-${{ github.sha }}-${{ runner.os }}-${{ runner.arch }}.bin
  path: ${{ env.PIE_BINARY_OUTPUT }}

.github/workflows/continuous-integration.yml

@@ -23,14 +23,16 @@ jobs:
  - '8.5'
  steps:
  - name: Setup PHP
- uses: shivammathur/setup-php@v2
+ uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
  with:
  php-version: ${{ matrix.php-versions }}
  extensions: intl, sodium, zip
  env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- - uses: actions/checkout@v6
- - uses: ramsey/composer-install@v4
+ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+ with:
+ persist-credentials: false
+ - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
  - name: GH token (non-Windows)
  if: matrix.operating-system != 'windows-latest'
  run: sudo composer config --global --auth github-oauth.github.com ${{ secrets.GITHUB_TOKEN }}
@@ -102,12 +104,14 @@ jobs:
  DIST_URL=`curl -fsSL "https://www.php.net/releases/index.php?json&max=1&version=${{ matrix.php-versions }}" | jq -r '.[].source[]|select(.filename|endswith(".gz")).filename'`
  echo "php_src_download_url=https://www.php.net/distributions/$DIST_URL" >> $GITHUB_ENV
  - name: "Install PHP ${{ matrix.php-versions }}"
+ env:
+ php_src_download_url: ${{ env.php_src_download_url }}
  run: |
  mkdir -p /tmp/php
  mkdir -p /tmp/php.ini.d
  cd /tmp/php
- echo "Downloading release from ${{ env.php_src_download_url }} ..."
- wget -O php.tgz ${{ env.php_src_download_url }}
+ echo "Downloading release from ${php_src_download_url} ..."
+ wget -O php.tgz ${php_src_download_url}
  tar zxf php.tgz
  rm php.tgz
  ls -l
@@ -118,7 +122,9 @@ jobs:
  make -j$(nproc)
  sudo make install
  cd $GITHUB_WORKSPACE
- - uses: actions/checkout@v6
+ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+ with:
+ persist-credentials: false
  - name: Composer Install
  run: composer install --ignore-platform-reqs
  - name: Run bundled PHP install test
@@ -129,14 +135,15 @@ jobs:
  end-to-end-tests:
  runs-on: ubuntu-latest
  steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
  with:
  fetch-depth: 0
+ persist-credentials: false
  # Fixes `git describe` picking the wrong tag - see https://github.com/php/pie/issues/307
  - run: git fetch --tags --force
  # Ensure some kind of previous tag exists, otherwise box fails
  - run: git describe --tags HEAD || git tag 0.0.0
- - uses: ramsey/composer-install@v4
+ - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
  - name: Run the tests
  env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -154,14 +161,15 @@ jobs:
  - '8.3'
  - '8.4'
  steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
  with:
  fetch-depth: 0
+ persist-credentials: false
  # Fixes `git describe` picking the wrong tag - see https://github.com/php/pie/issues/307
  - run: git fetch --tags --force
  # Ensure some kind of previous tag exists, otherwise box fails
  - run: git describe --tags HEAD || git tag 0.0.0
- - uses: ramsey/composer-install@v4
+ - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
  - name: Build
  env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -175,29 +183,33 @@ jobs:
  runs-on: ubuntu-latest
  steps:
  - name: Setup PHP
- uses: shivammathur/setup-php@v2
+ uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
  with:
  php-version: 8.1
  extensions: intl, sodium, zip
  env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- - uses: actions/checkout@v6
- - uses: ramsey/composer-install@v4
+ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+ with:
+ persist-credentials: false
+ - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
  - name: Run PHPCS
  run: vendor/bin/phpcs
 
  static-analysis:
  runs-on: ubuntu-latest
  steps:
  - name: Setup PHP
- uses: shivammathur/setup-php@v2
+ uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
  with:
  php-version: 8.5
  extensions: intl, sodium, zip
  env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- - uses: actions/checkout@v6
- - uses: ramsey/composer-install@v4
+ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+ with:
+ persist-credentials: false
+ - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
  - name: Validate the composer configuration
  run: composer validate --strict
  - name: Run phpstan
@@ -207,20 +219,32 @@ jobs:
  runs-on: ubuntu-latest
  steps:
  - name: Setup PHP
- uses: shivammathur/setup-php@v2
+ uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
  with:
  php-version: 8.4
  extensions: intl, sodium, zip
  tools: infection
  env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- - uses: actions/checkout@v6
- - uses: ramsey/composer-install@v4
+ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+ with:
+ persist-credentials: false
+ - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
  - name: Run infection
  env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  run: sudo infection --min-msi=68 --min-covered-msi=68 --threads=max --show-mutations=max --no-progress
 
+ zizmor:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+ with:
+ persist-credentials: false
+ - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d #v0.5.6
+ with:
+ advanced-security: false
+
  build-assets:
  needs:
  - unit-tests

.github/workflows/docs.yml

@@ -33,15 +33,17 @@ jobs:
  - build-assets
  steps:
  - name: Checkout
- uses: actions/checkout@v6
+ uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+ with:
+ persist-credentials: false
  - name: Build documentation
  run: .github/docs/build-docs.sh
  - name: Fetch built PHAR from artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
  with:
  name: pie-${{ github.sha }}.phar
  - name: Fetch the executable PIEs from artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
  with:
  path: executable-pie-binaries
  pattern: pie-${{ github.sha }}-*.bin
@@ -57,7 +59,7 @@ jobs:
  - name: Copy executables into docs
  run: cp executable-pie-binaries/* docs-package/
  - name: Upload artifact
- uses: actions/upload-pages-artifact@v5
+ uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 #v5.0.0
  with:
  path: docs-package
 
@@ -77,4 +79,4 @@ jobs:
  steps:
  - name: Deploy to GitHub Pages
  id: deployment
- uses: actions/deploy-pages@v5
+ uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 #v5.0.0