Merge branch 'main' into feat/org-name-support

.github/workflows/cron_semgrep.yml

@@ -0,0 +1,27 @@
+name: "Semgrep (Scheduled)"
+
+# This workflow will run after a push to the main branch and as a scheduled job.
+
+on:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "30 0 1,15 * *"
+
+permissions: {}
+
+jobs:
+  semgrep:
+    name: "Scan"
+    runs-on: ubuntu-latest
+
+    container:
+      image: returntocorp/semgrep
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - run: semgrep ci
+        env:
+          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

.github/workflows/cron_snyk.yml

@@ -4,7 +4,10 @@ name: "Snyk (Scheduled)"
 
 on:
   push:
-    branches: ["master", "main"]
+    branches:
+      - main
+  schedule:
+    - cron: "30 0 1,15 * *"
 
 permissions: {}
 
@@ -14,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@4bd44f22a98a19e0950cbad5f31095157cc9621b # [email protected]
         with:
           php-version: "8.1"
           coverage: none
@@ -26,7 +29,7 @@ jobs:
 
       - run: composer install --no-progress
 
-      - uses: snyk/actions/php@master
+      - uses: snyk/actions/php@b98d498629f1c368650224d6d212bf7dfa89e4bf # [email protected]
         continue-on-error: true
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

.github/workflows/pr_await_changes.yml

@@ -4,7 +4,11 @@ name: "Pull Request Changes"
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened, closed]
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - closed
 
 permissions: {}
 

.github/workflows/pr_composer.yml

@@ -4,7 +4,8 @@ on:
   pull_request:
   merge_group:
   push:
-    branches: ["master", "main"]
+    branches:
+      - main
 
 permissions: {}
 

.github/workflows/pr_pest.yml

@@ -4,7 +4,8 @@ on:
   pull_request:
   merge_group:
   push:
-    branches: ["master", "main"]
+    branches:
+      - main
 
 permissions: {}
 
@@ -16,7 +17,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@4bd44f22a98a19e0950cbad5f31095157cc9621b # [email protected]
         with:
           php-version: "8.1"
           coverage: pcov
@@ -25,7 +26,7 @@ jobs:
 
       - run: vendor/bin/pest --order-by random --fail-on-risky --stop-on-defect --coverage --parallel
 
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # [email protected]
         with:
           directory: ./coverage/
           flags: unittests

.github/workflows/pr_phpcsf.yml

@@ -4,7 +4,8 @@ on:
   pull_request:
   merge_group:
   push:
-    branches: ["master", "main"]
+    branches:
+      - main
 
 permissions: {}
 
@@ -16,7 +17,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@4bd44f22a98a19e0950cbad5f31095157cc9621b # [email protected]
         with:
           php-version: "8.1"
 

.github/workflows/pr_phpstan.yml

@@ -4,7 +4,8 @@ on:
   pull_request:
   merge_group:
   push:
-    branches: ["master", "main"]
+    branches:
+      - main
 
 permissions: {}
 
@@ -16,10 +17,10 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@4bd44f22a98a19e0950cbad5f31095157cc9621b # [email protected]
         with:
           php-version: "8.1"
 
       - run: composer install --no-progress
 
-      # - run: vendor/bin/phpstan analyze --no-ansi --no-progress --debug
+      - run: vendor/bin/phpstan analyze --no-ansi --no-progress --debug

.github/workflows/pr_psalm.yml

@@ -4,7 +4,8 @@ on:
   pull_request:
   merge_group:
   push:
-    branches: ["master", "main"]
+    branches:
+      - main
 
 permissions: {}
 
@@ -16,10 +17,10 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@4bd44f22a98a19e0950cbad5f31095157cc9621b # [email protected]
         with:
           php-version: "8.1"
 
       - run: composer install --no-progress
 
-      # - run: vendor/bin/psalm
+      - run: vendor/bin/psalm

.github/workflows/pr_rector.yml

@@ -4,7 +4,8 @@ on:
   pull_request:
   merge_group:
   push:
-    branches: ["master", "main"]
+    branches:
+      - main
 
 permissions: {}
 
@@ -16,7 +17,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@4bd44f22a98a19e0950cbad5f31095157cc9621b # [email protected]
         with:
           php-version: "8.1"
 

.github/workflows/pr_semgrep.yml

@@ -0,0 +1,27 @@
+name: "Semgrep"
+
+on:
+  workflow_run:
+    workflows: ["Pull Request Changes"]
+    types:
+      - completed
+
+permissions: {}
+
+jobs:
+  wait:
+    name: "Scan"
+    runs-on: ubuntu-latest
+
+    container:
+      image: returntocorp/semgrep
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - run: semgrep ci
+        env:
+          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

.github/workflows/pr_snyk.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@4bd44f22a98a19e0950cbad5f31095157cc9621b # [email protected]
         with:
           php-version: "8.1"
           coverage: none
@@ -29,7 +29,7 @@ jobs:
 
       - run: composer install --no-progress
 
-      - uses: snyk/actions/php@master
+      - uses: snyk/actions/php@b98d498629f1c368650224d6d212bf7dfa89e4bf # [email protected]
         continue-on-error: true
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}