[dependabot]

Bumps Pollora/harness/.github/workflows/php-package.yml from 0.1.8 to 0.1.10.

Release notes

Sourced from Pollora/harness/.github/workflows/php-package.yml's releases.

v0.1.10

Added

• template.yml, a reusable workflow for a template (the skeleton, a theme, a plugin, a module): secrets, code style, security patterns and dependency audit, run from the outside. The template installs nothing and carries no .harness.json: it only adds .github/workflows/harness.yml, so nothing of the harness is copied into the projects built from it. mode: enforce blocks a merge, observe reports

v0.1.9

See CHANGELOG.md.

Changelog

Sourced from Pollora/harness/.github/workflows/php-package.yml's changelog.

[0.1.10] - 2026-10-27

Added

• template.yml, a reusable workflow for a template (the skeleton, a theme, a plugin, a module): secrets, code style, security patterns and dependency audit, run from the outside. The template installs nothing and carries no .harness.json: it only adds .github/workflows/harness.yml, so nothing of the harness is copied into the projects built from it. mode: enforce blocks a merge, observe reports

[0.1.9] - 2026-10-27

Changed

• Rector is pinned to ~2.8.1. Every Rector minor adds rules to the prepared sets, so a floating version turned the Rector gate red on repositories that had not changed (2.8.1: ExplicitNullableObjectInstanceRector). A Rector upgrade is now a harness release, with the new rules reviewed once

Commits

• 7c2f88b Merge pull request #23 from Pollora/chore/release-0.1.10
• dbaaefe chore: release v0.1.10
• 5b87494 Merge pull request #22 from Pollora/feat/template-workflow
• 7f6806a fix: audit the lock file, nothing is installed in the job
• 32b3f72 feat: a reusable workflow for templates
• b04b4ad Merge pull request #21 from Pollora/chore/release-0.1.9
• 5ce8003 chore: release v0.1.9
• f4defa5 Merge pull request #20 from Pollora/fix/pin-rector
• 13e7142 chore: follow Rector 2.8.1 in SurfaceExtractor
• e4c8306 chore: pin Rector to ~2.8.1
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: automerge. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like Pollora/harness/.github/workflows/php-package.yml is up-to-date now, so this is no longer needed.