CI: pin the GitHub Actions to commit SHAs

.github/workflows/ci.yml

@@ -14,8 +14,8 @@ jobs:
     name: Manifest, language and package checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: shivammathur/setup-php@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: '8.4'
           coverage: none
@@ -26,6 +26,8 @@ jobs:
             sudo apt-get install -y -q libxml2-utils > /dev/null
           }
           find . -name '*.xml' -not -path './.git/*' -print0 | xargs -0 xmllint --noout
+      - name: Actions are pinned to commit SHAs
+        run: php tests/lint/check-workflows.php
       - name: Language files
         run: php tests/lint/check-language.php bfstop.xml PLG_SYSTEM_BFSTOP
       - name: Composer manifest is valid
@@ -49,8 +51,8 @@ jobs:
       matrix:
         php: ['8.1', '8.4']
     steps:
-      - uses: actions/checkout@v7
-      - uses: shivammathur/setup-php@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php }}
           tools: phpunit:11
@@ -85,7 +87,7 @@ jobs:
         run: |
           echo "JOOMLA_ROOT=$RUNNER_TEMP/joomla" >> "$GITHUB_ENV"
           echo "COM_BFSTOP_ROOT=$RUNNER_TEMP/com_bfstop" >> "$GITHUB_ENV"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # the component is tested together with the plugin: use its branch of
       # the same name if there is one (for changes spanning both), else main
@@ -98,15 +100,15 @@ jobs:
           else
             echo "ref=main" >> "$GITHUB_OUTPUT"
           fi
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: codeling/com_bfstop
           ref: ${{ steps.com.outputs.ref }}
           path: com_bfstop
       - name: Move com_bfstop checkout out of the plugin's
         run: mv com_bfstop "$COM_BFSTOP_ROOT"
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php }}
           extensions: mysqli, pdo_mysql, pgsql, pdo_pgsql, zip, mbstring, intl, gd

.github/workflows/dependencies.yml

@@ -18,8 +18,8 @@ jobs:
     name: maxmind-db/reader is current and free of advisories
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: shivammathur/setup-php@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: '8.4'
           coverage: none

tests/README.md

@@ -19,9 +19,11 @@ The classes under test are always loaded from this checkout (and the
 component checkout), not from the copies installed into the Joomla site, so
 the site only needs to be set up again when the database schema changes.
 
-- `lint/`: checks of the language files (`check-language.php`) and of the
-  release zip built by `deploy.sh zip` (`check-zip.php`); both scripts are
-  kept identical in the com_bfstop repository.
+- `lint/`: checks of the language files (`check-language.php`), of the
+  release zip built by `deploy.sh zip` (`check-zip.php`) and of the GitHub
+  Actions workflows (`check-workflows.php`: every action pinned to a commit
+  SHA, with its release in a comment; Dependabot proposes the updates); the
+  scripts are kept identical in the com_bfstop repository.
 - `performance/`: not a test, a comparison of what two versions of the plugin
   (by default 1.5.2 and the checkout) cost a Joomla site, see its README. Not
   run by phpunit or CI.

tests/lint/check-workflows.php

@@ -0,0 +1,62 @@
+<?php
+/*
+ * @package BFStop Plugin (bfstop) for Joomla!
+ * @author Bernhard Froehler
+ * @copyright (C) Bernhard Froehler
+ * @license GNU/GPLv3 http://www.gnu.org/licenses/gpl-3.0.html
+**/
+// Usage: php tests/lint/check-workflows.php
+//
+// Every action a GitHub Actions workflow uses has to be pinned to the full
+// commit SHA of a release, with the release in a comment:
+//
+//   - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+//
+// A tag like @v7 can be moved by whoever controls the action's repository (or
+// whoever took it over): the next run of our workflows would run what they
+// put there, with this repository's token and in its checkouts. Dependabot
+// (github-actions in .github/dependabot.yml) proposes the updates of pinned
+// actions. Kept identical in the com_bfstop repository.
+//
+// Exits with status 1 if a reference is not pinned.
+
+$root = dirname(__DIR__, 2);
+$files = array_merge(glob($root.'/.github/workflows/*.yml'), glob($root.'/.github/workflows/*.yaml'),
+	glob($root.'/.github/actions/*/action.yml'));
+if (count($files) === 0)
+{
+	fwrite(STDERR, "No workflow files found in $root/.github\n");
+	exit(1);
+}
+$errors = 0;
+$references = 0;
+foreach ($files as $file)
+{
+	foreach (file($file) as $number => $line)
+	{
+		if (!preg_match('/^\s*(?:-\s*)?uses:\s*(\S+)(.*)$/', $line, $m))
+		{
+			continue;
+		}
+		$name = $file;
+		$name = substr($name, strlen($root) + 1).':'.($number + 1);
+		$target = $m[1];
+		if (strpos($target, './') === 0)
+		{
+			continue; // an action of this repository
+		}
+		++$references;
+		if (!preg_match('#^[\w.-]+/[\w./-]+@[0-9a-f]{40}$#', $target))
+		{
+			echo "ERROR: $name: '$target' is not pinned to a commit SHA\n";
+			++$errors;
+		}
+		elseif (!preg_match('/^\s*#\s*v?\d+\.\d+/', $m[2]))
+		{
+			echo "ERROR: $name: '$target' has no comment naming the release (# v1.2.3)\n";
+			++$errors;
+		}
+	}
+}
+echo "$references action reference(s) in ".count($files)." file(s) checked, $errors error(s)\n";
+exit($errors > 0 ? 1 : 0);