Skip to content

Commit b136659

Browse files
SMillerDevSMillerDev
authored
feat: update CI setup (#679)
1 parent b48b893 commit b136659

File tree

4 files changed

+55
-29
lines changed

4 files changed

+55
-29
lines changed

‎.github/workflows/docker.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,26 +19,26 @@ jobs:
1919
packages: write
2020
steps:
2121
- name: Checkout repository
22-
uses: actions/checkout@v4
22+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2323
with:
2424
fetch-tags: true
2525
fetch-depth: 0
2626

2727
- name: Log in to the Container registry
28-
uses: docker/login-action@master
28+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
2929
with:
3030
registry: ${{ env.REGISTRY }}
3131
username: ${{ github.actor }}
3232
password: ${{ secrets.GITHUB_TOKEN }}
3333

3434
- name: Extract metadata (tags, labels) for Drafter
3535
id: meta-drafter
36-
uses: docker/metadata-action@master
36+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
3737
with:
3838
images: ${{ env.REGISTRY }}/${{ github.repository }}/drafter
3939

4040
- name: Build and push drafter Docker image
41-
uses: docker/build-push-action@master
41+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
4242
with:
4343
context: .
4444
push: true
@@ -50,7 +50,7 @@ jobs:
5050

5151
- name: Extract metadata (tags, labels) for PHPDraft
5252
id: meta
53-
uses: docker/metadata-action@master
53+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
5454
with:
5555
images: ${{ env.REGISTRY }}/${{ github.repository }}
5656

@@ -60,7 +60,7 @@ jobs:
6060
echo "latest=$(git describe --tags --always --abbrev=0)" >> "$GITHUB_OUTPUT"
6161
6262
- name: Build and push PHPDraft Docker image
63-
uses: docker/build-push-action@master
63+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
6464
with:
6565
push: true
6666
tags: ${{ steps.meta.outputs.tags }}

‎.github/workflows/release.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ jobs:
99
runs-on: ubuntu-latest
1010
steps:
1111
- name: Checkout
12-
uses: actions/checkout@v4
12+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1313

1414
- name: Setup PHP
15-
uses: shivammathur/setup-php@v2
15+
uses: shivammathur/setup-php@0f7f1d08e3e32076e51cae65eb0b0c871405b16e # 2.34.1
1616
with:
1717
php-version: 8.2
1818
ini-values: assert.exception=1, phar.readonly=0, zend.assertions=1
@@ -25,7 +25,7 @@ jobs:
2525
run: echo "::set-output name=dir::$(composer config cache-files-dir)"
2626

2727
- name: Cache dependencies
28-
uses: actions/cache@v4
28+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
2929
with:
3030
path: ${{ steps.composer-cache.outputs.dir }}
3131
key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -44,7 +44,7 @@ jobs:
4444
run: sha256sum build/out/*
4545

4646
- name: Upload binary to release
47-
uses: svenstaro/[email protected]
47+
uses: svenstaro/upload-release-action@81c65b7cd4de9b2570615ce3aad67a41de5b1a13 # 2.11.2
4848
with:
4949
repo_token: ${{ secrets.GITHUB_TOKEN }}
5050
file: build/out/phpdraft-${{ github.event.release.tag_name }}.phar
@@ -53,7 +53,7 @@ jobs:
5353
overwrite: false
5454

5555
- name: Upload library to release
56-
uses: svenstaro/[email protected]
56+
uses: svenstaro/upload-release-action@81c65b7cd4de9b2570615ce3aad67a41de5b1a13 # 2.11.2
5757
with:
5858
repo_token: ${{ secrets.GITHUB_TOKEN }}
5959
file: build/out/phpdraft-library-${{ github.event.release.tag_name }}.phar

‎.github/workflows/test.yml

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -23,25 +23,25 @@ jobs:
2323
experimental: true
2424
steps:
2525
- name: Checkout
26-
uses: actions/checkout@v4
26+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2727

2828
- name: Setup cache environment
2929
id: extcache
30-
uses: shivammathur/cache-extensions@v1
30+
uses: shivammathur/cache-extensions@270463ea3e30925f5661b16e508feab532dbf309 # 1.12.0
3131
with:
3232
php-version: ${{ matrix.php-versions }}
3333
extensions: ${{ env.extensions }}
3434
key: ${{ env.key }}
3535

3636
- name: Cache extensions
37-
uses: actions/cache@v4
37+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
3838
with:
3939
path: ${{ steps.extcache.outputs.dir }}
4040
key: ${{ steps.extcache.outputs.key }}
4141
restore-keys: ${{ steps.extcache.outputs.key }}
4242

4343
- name: Setup PHP
44-
uses: shivammathur/setup-php@v2
44+
uses: shivammathur/setup-php@0f7f1d08e3e32076e51cae65eb0b0c871405b16e # 2.34.1
4545
env:
4646
COMPOSER_TOKEN: ${{ secrets.GITHUB_TOKEN }}
4747
with:
@@ -55,7 +55,7 @@ jobs:
5555
run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
5656

5757
- name: Cache dependencies
58-
uses: actions/cache@v4
58+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
5959
with:
6060
path: ${{ steps.composer-cache.outputs.dir }}
6161
key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -80,7 +80,7 @@ jobs:
8080
run: phpcs --standard=tests/phpcs.xml --ignore=\*Minifier.php src/ | cs2pr
8181

8282
- name: Upload coverage result
83-
uses: actions/upload-artifact@v4
83+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
8484
with:
8585
name: coverage-${{ matrix.php-versions }}
8686
path: coverage.xml
@@ -98,27 +98,27 @@ jobs:
9898
php-versions: [ '8.3' ]
9999
steps:
100100
- name: Checkout
101-
uses: actions/checkout@v4
101+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
102102
with:
103103
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
104104

105105
- name: Setup cache environment
106106
id: extcache
107-
uses: shivammathur/cache-extensions@v1
107+
uses: shivammathur/cache-extensions@270463ea3e30925f5661b16e508feab532dbf309 # 1.12.0
108108
with:
109109
php-version: ${{ matrix.php-versions }}
110110
extensions: ${{ env.extensions }}
111111
key: ${{ env.key }}
112112

113113
- name: Cache extensions
114-
uses: actions/cache@v4
114+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
115115
with:
116116
path: ${{ steps.extcache.outputs.dir }}
117117
key: ${{ steps.extcache.outputs.key }}
118118
restore-keys: ${{ steps.extcache.outputs.key }}
119119

120120
- name: Setup PHP
121-
uses: shivammathur/setup-php@v2
121+
uses: shivammathur/setup-php@0f7f1d08e3e32076e51cae65eb0b0c871405b16e # 2.34.1
122122
with:
123123
php-version: ${{ matrix.php-versions }}
124124
extensions: ${{ env.extensions }}
@@ -130,7 +130,7 @@ jobs:
130130
run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
131131

132132
- name: Cache dependencies
133-
uses: actions/cache@v4
133+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
134134
with:
135135
path: ${{ steps.composer-cache.outputs.dir }}
136136
key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -181,27 +181,27 @@ jobs:
181181
php-versions: ['8.3']
182182
steps:
183183
- name: Checkout
184-
uses: actions/checkout@v4
184+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
185185
with:
186186
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
187187

188188
- name: Setup cache environment
189189
id: extcache
190-
uses: shivammathur/cache-extensions@v1
190+
uses: shivammathur/cache-extensions@270463ea3e30925f5661b16e508feab532dbf309 # 1.12.0
191191
with:
192192
php-version: ${{ matrix.php-versions }}
193193
extensions: ${{ env.extensions }}
194194
key: ${{ env.key }}
195195

196196
- name: Cache extensions
197-
uses: actions/cache@v4
197+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
198198
with:
199199
path: ${{ steps.extcache.outputs.dir }}
200200
key: ${{ steps.extcache.outputs.key }}
201201
restore-keys: ${{ steps.extcache.outputs.key }}
202202

203203
- name: Setup PHP
204-
uses: shivammathur/setup-php@v2
204+
uses: shivammathur/setup-php@0f7f1d08e3e32076e51cae65eb0b0c871405b16e # 2.34.1
205205
with:
206206
php-version: ${{ matrix.php-versions }}
207207
extensions: ${{ env.extensions }}
@@ -213,7 +213,7 @@ jobs:
213213
run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
214214

215215
- name: Cache dependencies
216-
uses: actions/cache@v4
216+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
217217
with:
218218
path: ${{ steps.composer-cache.outputs.dir }}
219219
key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -229,7 +229,7 @@ jobs:
229229
run: ./vendor/phpunit/phpunit/phpunit --configuration tests/phpunit.xml --exclude-group twig --coverage-clover=./var/coverage/clover.xml
230230

231231
- name: Code coverage Scan
232-
uses: codecov/codecov-action@v5
232+
uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
233233
with:
234234
token: ${{ secrets.CODECOV_TOKEN }}
235235

@@ -239,7 +239,7 @@ jobs:
239239
mv ./var/coverage/clover.xml coverage.xml
240240
241241
- name: SonarCloud Scan
242-
uses: sonarsource/sonarcloud-github-action@v5.0
242+
uses: sonarsource/sonarqube-scan-action@2500896589ef8f7247069a56136f8dc177c27ccf # v5.2.0
243243
env:
244244
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
245245
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

‎.github/workflows/zizmor.yml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: GitHub Actions Security Analysis with zizmor 🌈
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
pull_request:
7+
branches: ["**"]
8+
9+
permissions: {}
10+
11+
jobs:
12+
zizmor:
13+
name: Run zizmor 🌈
14+
runs-on: ubuntu-latest
15+
permissions:
16+
security-events: write
17+
contents: read # only needed for private repos
18+
actions: read # only needed for private repos
19+
steps:
20+
- name: Checkout repository
21+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
22+
with:
23+
persist-credentials: false
24+
25+
- name: Run zizmor 🌈
26+
uses: zizmorcore/zizmor-action@f52a838cfabf134edcbaa7c8b3677dde20045018 # v0.1.1

0 commit comments

Comments
 (0)