From acfd2a1fd259e9d5cfa3c71518881f380504115c Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 15:25:39 +0000 Subject: [PATCH] Pin the GitHub Actions to commit SHAs actions/checkout and shivammathur/setup-php were referenced by tag (@v7, @v2), which whoever controls those repositories can move: the next run would execute what they put there. They are pinned to the commits of v7.0.1 and 2.40.0, with the release in a comment; Dependabot (github-actions) proposes the updates. tests/lint/check-workflows.php, run by the lint job, fails on a reference that is not pinned. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01LhhhdjhErC9ZiaS4HyRjsh --- .github/workflows/ci.yml | 16 ++++---- .github/workflows/dependencies.yml | 4 +- tests/README.md | 8 ++-- tests/lint/check-workflows.php | 62 ++++++++++++++++++++++++++++++ 4 files changed, 78 insertions(+), 12 deletions(-) create mode 100644 tests/lint/check-workflows.php diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1906ccb..689b6b7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,8 +14,8 @@ jobs: name: Manifest, language and package checks runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: shivammathur/setup-php@v2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: '8.4' coverage: none @@ -26,6 +26,8 @@ jobs: sudo apt-get install -y -q libxml2-utils > /dev/null } find . -name '*.xml' -not -path './.git/*' -print0 | xargs -0 xmllint --noout + - name: Actions are pinned to commit SHAs + run: php tests/lint/check-workflows.php - name: Language files run: php tests/lint/check-language.php bfstop.xml PLG_SYSTEM_BFSTOP - name: Composer manifest is valid @@ -49,8 +51,8 @@ jobs: matrix: php: ['8.1', '8.4'] steps: - - uses: actions/checkout@v7 - - uses: shivammathur/setup-php@v2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php }} tools: phpunit:11 @@ -85,7 +87,7 @@ jobs: run: | echo "JOOMLA_ROOT=$RUNNER_TEMP/joomla" >> "$GITHUB_ENV" echo "COM_BFSTOP_ROOT=$RUNNER_TEMP/com_bfstop" >> "$GITHUB_ENV" - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # the component is tested together with the plugin: use its branch of # the same name if there is one (for changes spanning both), else main @@ -98,7 +100,7 @@ jobs: else echo "ref=main" >> "$GITHUB_OUTPUT" fi - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: codeling/com_bfstop ref: ${{ steps.com.outputs.ref }} @@ -106,7 +108,7 @@ jobs: - name: Move com_bfstop checkout out of the plugin's run: mv com_bfstop "$COM_BFSTOP_ROOT" - - uses: shivammathur/setup-php@v2 + - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php }} extensions: mysqli, pdo_mysql, pgsql, pdo_pgsql, zip, mbstring, intl, gd diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml index 92f61d8..5c4d057 100644 --- a/.github/workflows/dependencies.yml +++ b/.github/workflows/dependencies.yml @@ -18,8 +18,8 @@ jobs: name: maxmind-db/reader is current and free of advisories runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: shivammathur/setup-php@v2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: '8.4' coverage: none diff --git a/tests/README.md b/tests/README.md index 0901b63..8aa839f 100644 --- a/tests/README.md +++ b/tests/README.md @@ -19,9 +19,11 @@ The classes under test are always loaded from this checkout (and the component checkout), not from the copies installed into the Joomla site, so the site only needs to be set up again when the database schema changes. -- `lint/`: checks of the language files (`check-language.php`) and of the - release zip built by `deploy.sh zip` (`check-zip.php`); both scripts are - kept identical in the com_bfstop repository. +- `lint/`: checks of the language files (`check-language.php`), of the + release zip built by `deploy.sh zip` (`check-zip.php`) and of the GitHub + Actions workflows (`check-workflows.php`: every action pinned to a commit + SHA, with its release in a comment; Dependabot proposes the updates); the + scripts are kept identical in the com_bfstop repository. - `performance/`: not a test, a comparison of what two versions of the plugin (by default 1.5.2 and the checkout) cost a Joomla site, see its README. Not run by phpunit or CI. diff --git a/tests/lint/check-workflows.php b/tests/lint/check-workflows.php new file mode 100644 index 0000000..92f1877 --- /dev/null +++ b/tests/lint/check-workflows.php @@ -0,0 +1,62 @@ + $line) + { + if (!preg_match('/^\s*(?:-\s*)?uses:\s*(\S+)(.*)$/', $line, $m)) + { + continue; + } + $name = $file; + $name = substr($name, strlen($root) + 1).':'.($number + 1); + $target = $m[1]; + if (strpos($target, './') === 0) + { + continue; // an action of this repository + } + ++$references; + if (!preg_match('#^[\w.-]+/[\w./-]+@[0-9a-f]{40}$#', $target)) + { + echo "ERROR: $name: '$target' is not pinned to a commit SHA\n"; + ++$errors; + } + elseif (!preg_match('/^\s*#\s*v?\d+\.\d+/', $m[2])) + { + echo "ERROR: $name: '$target' has no comment naming the release (# v1.2.3)\n"; + ++$errors; + } + } +} +echo "$references action reference(s) in ".count($files)." file(s) checked, $errors error(s)\n"; +exit($errors > 0 ? 1 : 0);