From 1641426093259c0e21bdd9717ca7c110d7e52ae4 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 01:39:42 +0300 Subject: [PATCH 01/22] Harden GitHub workflows --- .github/workflows/bc.yml | 5 ++++- .github/workflows/bench.yml | 5 ++++- .github/workflows/build.yml | 7 +++++-- .github/workflows/composer-require-checker.yml | 5 ++++- .github/workflows/mutation.yml | 5 ++++- .github/workflows/rector-cs.yml | 4 ++-- .github/workflows/static.yml | 5 ++++- 7 files changed, 27 insertions(+), 9 deletions(-) diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml index 4b1d0ed93..68947986d 100644 --- a/.github/workflows/bc.yml +++ b/.github/workflows/bc.yml @@ -1,3 +1,6 @@ +permissions: + contents: read + on: pull_request: paths-ignore: @@ -25,7 +28,7 @@ name: backwards compatibility jobs: roave_bc_check: - uses: yiisoft/actions/.github/workflows/bc.yml@master + uses: yiisoft/actions/.github/workflows/bc.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: os: >- ['ubuntu-latest'] diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml index 063602778..07513ad49 100644 --- a/.github/workflows/bench.yml +++ b/.github/workflows/bench.yml @@ -1,3 +1,6 @@ +permissions: + contents: read + on: pull_request: paths-ignore: @@ -24,7 +27,7 @@ name: build jobs: phpbench: - uses: yiisoft/actions/.github/workflows/phpbench.yml@master + uses: yiisoft/actions/.github/workflows/phpbench.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: os: >- ['ubuntu-latest', 'windows-latest'] diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6454b92ea..e892f6376 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,3 +1,6 @@ +permissions: + contents: read + on: pull_request: paths-ignore: @@ -24,7 +27,7 @@ name: build jobs: phpunit: - uses: yiisoft/actions/.github/workflows/phpunit.yml@master + uses: yiisoft/actions/.github/workflows/phpunit.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: extensions: intl,fileinfo coverage: xdebug @@ -33,7 +36,7 @@ jobs: php: >- ['8.1', '8.2', '8.3', '8.4', '8.5'] phpunit-without-intl: - uses: yiisoft/actions/.github/workflows/phpunit.yml@master + uses: yiisoft/actions/.github/workflows/phpunit.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: phpunitConfig: phpunit-without-intl.xml extensions: :intl diff --git a/.github/workflows/composer-require-checker.yml b/.github/workflows/composer-require-checker.yml index 3796ad599..7062fe6da 100644 --- a/.github/workflows/composer-require-checker.yml +++ b/.github/workflows/composer-require-checker.yml @@ -1,3 +1,6 @@ +permissions: + contents: read + on: pull_request: paths-ignore: @@ -26,7 +29,7 @@ name: Composer require checker jobs: composer-require-checker: - uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@master + uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: os: >- ['ubuntu-latest'] diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml index 57ecb4719..6c5bcc806 100644 --- a/.github/workflows/mutation.yml +++ b/.github/workflows/mutation.yml @@ -1,3 +1,6 @@ +permissions: + contents: read + on: pull_request: paths-ignore: @@ -22,7 +25,7 @@ name: mutation test jobs: mutation: - uses: yiisoft/actions/.github/workflows/infection.yml@master + uses: yiisoft/actions/.github/workflows/infection.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: os: >- ['ubuntu-latest'] diff --git a/.github/workflows/rector-cs.yml b/.github/workflows/rector-cs.yml index 69a1310cf..f53721fa6 100644 --- a/.github/workflows/rector-cs.yml +++ b/.github/workflows/rector-cs.yml @@ -1,7 +1,7 @@ name: Rector + PHP CS Fixer on: - pull_request_target: + pull_request: paths-ignore: - 'docs/**' - 'README.md' @@ -20,7 +20,7 @@ concurrency: jobs: rector: - uses: yiisoft/actions/.github/workflows/rector-cs.yml@master + uses: yiisoft/actions/.github/workflows/rector-cs.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 secrets: token: ${{ secrets.YIISOFT_GITHUB_TOKEN }} with: diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml index b56464d6a..fb59a5daa 100644 --- a/.github/workflows/static.yml +++ b/.github/workflows/static.yml @@ -1,3 +1,6 @@ +permissions: + contents: read + on: pull_request: paths-ignore: @@ -24,7 +27,7 @@ name: static analysis jobs: psalm: - uses: yiisoft/actions/.github/workflows/psalm.yml@master + uses: yiisoft/actions/.github/workflows/psalm.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 with: os: >- ['ubuntu-latest'] From 51d55606c8f7b918e0c3074d513e9763a1bb505b Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 02:09:23 +0300 Subject: [PATCH 02/22] Add zizmorify configuration --- .github/dependabot.yml | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index db86156d1..6cc00712d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,16 +1,8 @@ version: 2 updates: - # Maintain dependencies for GitHub Actions. - package-ecosystem: "github-actions" directory: "/" schedule: - interval: "daily" - # Too noisy. See https://github.community/t/increase-if-necessary-for-github-actions-in-dependabot/179581 - open-pull-requests-limit: 0 - - # Maintain dependencies for Composer - - package-ecosystem: "composer" - directory: "/" - schedule: - interval: "daily" - versioning-strategy: increase-if-necessary + interval: "weekly" + cooldown: + default-days: 7 From 7e84f1c2de7ecae495bf369e0635f424b6dc8216 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 02:33:07 +0300 Subject: [PATCH 03/22] Add zizmorify workflow --- .github/workflows/zizmor.yml | 37 ++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 000000000..e9b7e067e --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,37 @@ +name: GitHub Actions Security Analysis with zizmor 🌈 + +on: + push: + branches: + - main + paths: + - '.github/**.yml' + - '.github/**.yaml' + pull_request: + paths: + - '.github/**.yml' + - '.github/**.yaml' + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + zizmor: + name: Run zizmor 🌈 + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Run zizmor 🌈 + uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 + with: + advanced-security: false + annotations: true + persona: 'pedantic' From 3ae60fdc864efed741a1294ac31b7b6f659c3255 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 12:02:11 +0300 Subject: [PATCH 04/22] Restore Dependabot non-GitHub-Actions updates --- .github/dependabot.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6cc00712d..b185d4255 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,5 +1,11 @@ version: 2 updates: + # Maintain dependencies for GitHub Actions. + - package-ecosystem: "composer" + directory: "/" + schedule: + interval: "daily" + versioning-strategy: increase-if-necessary - package-ecosystem: "github-actions" directory: "/" schedule: From fc62410a927ad54e5d480ddb23658dfc4b3fd48a Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 12:10:53 +0300 Subject: [PATCH 05/22] Restore Dependabot non-GitHub-Actions updates --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b185d4255..988aa61a3 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,6 +1,8 @@ version: 2 updates: # Maintain dependencies for GitHub Actions. + + # Maintain dependencies for Composer - package-ecosystem: "composer" directory: "/" schedule: From 630ed50823c280cf411267eae5117e176dc82fea Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 12:17:51 +0300 Subject: [PATCH 06/22] Restore Dependabot non-GitHub-Actions updates --- .github/dependabot.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 988aa61a3..41b2db687 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,6 +1,5 @@ version: 2 updates: - # Maintain dependencies for GitHub Actions. # Maintain dependencies for Composer - package-ecosystem: "composer" From 4125cfb1cbdbf46cd4ec62812e852590a8e0efe6 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 12:25:05 +0300 Subject: [PATCH 07/22] Restore Dependabot non-GitHub-Actions updates --- .github/dependabot.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 41b2db687..00889484f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,6 +1,5 @@ version: 2 updates: - # Maintain dependencies for Composer - package-ecosystem: "composer" directory: "/" From dca913a395544af5d6be561c1ba194c8734bc64c Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 12:42:31 +0300 Subject: [PATCH 08/22] Remove Rector pull_request_target inputs --- .github/workflows/rector-cs.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/rector-cs.yml b/.github/workflows/rector-cs.yml index f53721fa6..b5c57a934 100644 --- a/.github/workflows/rector-cs.yml +++ b/.github/workflows/rector-cs.yml @@ -21,8 +21,5 @@ concurrency: jobs: rector: uses: yiisoft/actions/.github/workflows/rector-cs.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 - secrets: - token: ${{ secrets.YIISOFT_GITHUB_TOKEN }} with: - repository: ${{ github.event.pull_request.head.repo.full_name }} php: '8.1' From 9319e7d4647411b5f5542c87803395102d0a5468 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Fri, 19 Jun 2026 12:42:36 +0300 Subject: [PATCH 09/22] Remove Rector pull_request_target inputs --- .github/workflows/rector-cs.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/rector-cs.yml b/.github/workflows/rector-cs.yml index 69a1310cf..dcdcfc99d 100644 --- a/.github/workflows/rector-cs.yml +++ b/.github/workflows/rector-cs.yml @@ -21,8 +21,5 @@ concurrency: jobs: rector: uses: yiisoft/actions/.github/workflows/rector-cs.yml@master - secrets: - token: ${{ secrets.YIISOFT_GITHUB_TOKEN }} with: - repository: ${{ github.event.pull_request.head.repo.full_name }} php: '8.1' From d4bfb409c7b9f08bea004bef5c8e06c1e51c44c4 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sat, 20 Jun 2026 11:39:20 +0300 Subject: [PATCH 10/22] Use master for yiisoft actions --- .github/workflows/bc.yml | 2 +- .github/workflows/bench.yml | 2 +- .github/workflows/build.yml | 4 ++-- .github/workflows/composer-require-checker.yml | 2 +- .github/workflows/mutation.yml | 2 +- .github/workflows/rector-cs.yml | 2 +- .github/workflows/static.yml | 2 +- .github/zizmor.yml | 5 +++++ 8 files changed, 13 insertions(+), 8 deletions(-) create mode 100644 .github/zizmor.yml diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml index 68947986d..7d57ef475 100644 --- a/.github/workflows/bc.yml +++ b/.github/workflows/bc.yml @@ -28,7 +28,7 @@ name: backwards compatibility jobs: roave_bc_check: - uses: yiisoft/actions/.github/workflows/bc.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/bc.yml@master with: os: >- ['ubuntu-latest'] diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml index 07513ad49..08db924b3 100644 --- a/.github/workflows/bench.yml +++ b/.github/workflows/bench.yml @@ -27,7 +27,7 @@ name: build jobs: phpbench: - uses: yiisoft/actions/.github/workflows/phpbench.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/phpbench.yml@master with: os: >- ['ubuntu-latest', 'windows-latest'] diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e892f6376..5d0802225 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -27,7 +27,7 @@ name: build jobs: phpunit: - uses: yiisoft/actions/.github/workflows/phpunit.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/phpunit.yml@master with: extensions: intl,fileinfo coverage: xdebug @@ -36,7 +36,7 @@ jobs: php: >- ['8.1', '8.2', '8.3', '8.4', '8.5'] phpunit-without-intl: - uses: yiisoft/actions/.github/workflows/phpunit.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/phpunit.yml@master with: phpunitConfig: phpunit-without-intl.xml extensions: :intl diff --git a/.github/workflows/composer-require-checker.yml b/.github/workflows/composer-require-checker.yml index 7062fe6da..156287cea 100644 --- a/.github/workflows/composer-require-checker.yml +++ b/.github/workflows/composer-require-checker.yml @@ -29,7 +29,7 @@ name: Composer require checker jobs: composer-require-checker: - uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@master with: os: >- ['ubuntu-latest'] diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml index 6c5bcc806..ce6170ad5 100644 --- a/.github/workflows/mutation.yml +++ b/.github/workflows/mutation.yml @@ -25,7 +25,7 @@ name: mutation test jobs: mutation: - uses: yiisoft/actions/.github/workflows/infection.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/infection.yml@master with: os: >- ['ubuntu-latest'] diff --git a/.github/workflows/rector-cs.yml b/.github/workflows/rector-cs.yml index b5c57a934..53d2c77bf 100644 --- a/.github/workflows/rector-cs.yml +++ b/.github/workflows/rector-cs.yml @@ -20,6 +20,6 @@ concurrency: jobs: rector: - uses: yiisoft/actions/.github/workflows/rector-cs.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/rector-cs.yml@master with: php: '8.1' diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml index fb59a5daa..09dc6d456 100644 --- a/.github/workflows/static.yml +++ b/.github/workflows/static.yml @@ -27,7 +27,7 @@ name: static analysis jobs: psalm: - uses: yiisoft/actions/.github/workflows/psalm.yml@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2 + uses: yiisoft/actions/.github/workflows/psalm.yml@master with: os: >- ['ubuntu-latest'] diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 000000000..85ca7982a --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,5 @@ +rules: + unpinned-uses: + config: + policies: + "yiisoft/*": any From d00a6285046ec8ee15239f8a487d418ba775607d Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sat, 20 Jun 2026 11:39:25 +0300 Subject: [PATCH 11/22] Use master for yiisoft actions --- .github/zizmor.yml | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .github/zizmor.yml diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 000000000..85ca7982a --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,5 @@ +rules: + unpinned-uses: + config: + policies: + "yiisoft/*": any From d391723071eb0291eaadfa6e2b7c5723bcadf00e Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sat, 20 Jun 2026 12:08:57 +0300 Subject: [PATCH 12/22] Use master for yiisoft actions --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index db86156d1..7da1f95c3 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,8 @@ updates: open-pull-requests-limit: 0 # Maintain dependencies for Composer + ignore: + - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: From 6d36c63e5a8ee054fc72e22f28b840472a076c32 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sat, 20 Jun 2026 12:09:02 +0300 Subject: [PATCH 13/22] Use master for yiisoft actions --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 00889484f..0510f8520 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -12,3 +12,5 @@ updates: interval: "weekly" cooldown: default-days: 7 + ignore: + - dependency-name: "yiisoft/*" From 50681d1cc181bfd6a6f1944a9f9ba73e42a3edb4 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Sun, 21 Jun 2026 15:13:29 +0300 Subject: [PATCH 14/22] Remove redundant zizmor config --- .github/zizmor.yml | 5 ----- 1 file changed, 5 deletions(-) delete mode 100644 .github/zizmor.yml diff --git a/.github/zizmor.yml b/.github/zizmor.yml deleted file mode 100644 index 85ca7982a..000000000 --- a/.github/zizmor.yml +++ /dev/null @@ -1,5 +0,0 @@ -rules: - unpinned-uses: - config: - policies: - "yiisoft/*": any From 6fffb030f901db42da2d8daacfe07f52596d1fa2 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Wed, 24 Jun 2026 15:57:58 +0300 Subject: [PATCH 15/22] Remove redundant dependabot change --- .github/dependabot.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 7da1f95c3..db86156d1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,8 +9,6 @@ updates: open-pull-requests-limit: 0 # Maintain dependencies for Composer - ignore: - - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: From 4541033fc4691a2d2898bdf0ba9c4fe555546d51 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Wed, 24 Jun 2026 16:38:59 +0300 Subject: [PATCH 16/22] Revert "Remove redundant dependabot change" This reverts commit 6fffb030f901db42da2d8daacfe07f52596d1fa2. --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index db86156d1..7da1f95c3 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,8 @@ updates: open-pull-requests-limit: 0 # Maintain dependencies for Composer + ignore: + - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: From 1b39a4f58707a2fb9a62a9591bea280fa201fc15 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Wed, 24 Jun 2026 17:33:33 +0300 Subject: [PATCH 17/22] Fix dependabot.yml --- .github/dependabot.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 27962406f..2f805f9d6 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,8 +1,5 @@ version: 2 updates: - # Maintain dependencies for Composer - ignore: - - dependency-name: "yiisoft/*" - package-ecosystem: "composer" directory: "/" schedule: From cf42606774a9b3c851553b060076cbc40a6dc0d4 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Wed, 24 Jun 2026 18:01:43 +0300 Subject: [PATCH 18/22] Normalize Dependabot GitHub Actions updates --- .github/dependabot.yml | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 2f805f9d6..6d4f88ad0 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,15 +1,8 @@ version: 2 updates: - - package-ecosystem: "composer" + # Maintain dependencies for GitHub Actions. + - package-ecosystem: "github-actions"\n directory: "/"\n schedule:\n interval: "weekly"\n cooldown:\n default-days: 7\n ignore:\n - dependency-name: "yiisoft/*"\n - package-ecosystem: "composer" directory: "/" schedule: interval: "daily" versioning-strategy: increase-if-necessary - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - cooldown: - default-days: 7 - ignore: - - dependency-name: "yiisoft/*" From 3c3254c31cf4413a5ba7bab6dccebabb935c148e Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Wed, 24 Jun 2026 22:40:12 +0300 Subject: [PATCH 19/22] Fix Dependabot GitHub Actions updates --- .github/dependabot.yml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6d4f88ad0..a47ec9b47 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,7 +1,17 @@ version: 2 updates: # Maintain dependencies for GitHub Actions. - - package-ecosystem: "github-actions"\n directory: "/"\n schedule:\n interval: "weekly"\n cooldown:\n default-days: 7\n ignore:\n - dependency-name: "yiisoft/*"\n - package-ecosystem: "composer" + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7 + ignore: + - dependency-name: "yiisoft/*" + + # Maintain dependencies for Composer + - package-ecosystem: "composer" directory: "/" schedule: interval: "daily" From 6ac9a2002863454918356de439762310e47d59bb Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Thu, 25 Jun 2026 00:45:37 +0300 Subject: [PATCH 20/22] Fix zizmor workflow findings --- .github/dependabot.yml | 2 ++ .github/workflows/zizmor.yml | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a47ec9b47..10f7e30bf 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -15,4 +15,6 @@ updates: directory: "/" schedule: interval: "daily" + cooldown: + default-days: 7 versioning-strategy: increase-if-necessary diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 94658469a..430255de4 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -14,8 +14,8 @@ on: - '.github/**.yaml' permissions: - actions: read - contents: read + actions: read # Required by zizmor when reading workflow metadata through the API. + contents: read # Required to read workflow files. jobs: zizmor: From 063793ad960c92476148143c88129aa51d63e9d7 Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Thu, 2 Jul 2026 22:04:14 +0300 Subject: [PATCH 21/22] Fix CI workflow failures --- .github/workflows/build.yml | 4 ++++ .github/workflows/docs.yml | 6 +++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 5d0802225..19ebb2944 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -28,6 +28,8 @@ name: build jobs: phpunit: uses: yiisoft/actions/.github/workflows/phpunit.yml@master + secrets: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: extensions: intl,fileinfo coverage: xdebug @@ -37,6 +39,8 @@ jobs: ['8.1', '8.2', '8.3', '8.4', '8.5'] phpunit-without-intl: uses: yiisoft/actions/.github/workflows/phpunit.yml@master + secrets: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: phpunitConfig: phpunit-without-intl.xml extensions: :intl diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 9851b9dbb..60bf90694 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -16,6 +16,10 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: check-docs: name: Check docs @@ -42,7 +46,7 @@ jobs: name: Update docs if: github.event_name == 'push' permissions: - contents: write + contents: write # Required to push generated docs translation updates. runs-on: ubuntu-latest steps: - name: Checkout From 972f7bee264ad1ff12c5b2981ed7dc8f9a84839c Mon Sep 17 00:00:00 2001 From: Alexander Makarov Date: Thu, 2 Jul 2026 22:05:37 +0300 Subject: [PATCH 22/22] Fix Rector workflow permissions --- .github/workflows/rector-cs.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/rector-cs.yml b/.github/workflows/rector-cs.yml index 53d2c77bf..dae5dca8e 100644 --- a/.github/workflows/rector-cs.yml +++ b/.github/workflows/rector-cs.yml @@ -21,5 +21,7 @@ concurrency: jobs: rector: uses: yiisoft/actions/.github/workflows/rector-cs.yml@master + permissions: + contents: write # Required by the reusable workflow to push Rector and PHP CS Fixer changes. with: php: '8.1'