From 5fdb82c21406c71820fbdd89951086c5b5cf62c6 Mon Sep 17 00:00:00 2001 From: jrfnl Date: Fri, 19 Sep 2025 20:05:56 +0200 Subject: [PATCH 1/2] GH Actions: add new "pinact" job In a previous PR, all action runners used in GH Actions workflows where "pinned" to precise versions for security reasons. However, that doesn't prevent new jobs, or changes to existing jobs, from being introduced which do not correctly pin action runners. This commit introduces a new GHA job which runs the `pinact` tooling via a reusable workflow as available since the `PHPCSStandards/.github` 1.3.0 release. Pinact is a tool which can be used to: * Update the action runner references in existing workflows to commit-hash "pinned" versions. * Verify that the commit hash to which an action runner is pinned is valid. * Verify that a "pinned" commit-hash matches the version number in the comment following the action runner reference. * Verify that a mandatory "minimum age" (`cooldown`) period is respected. The default `min-age` setting is 7 days. * Safeguard that any changes in workflows do not introduce new unpinned action runner references. The pinact action runner can also push a new commit to open PRs if the "verification"checks fail, however I do not think this is necessary at this time. The inline annotations in a PR and the failing build should be sufficient to prevent new issues from entering the workflows. Notes: * I've added a `.pinact.yaml` file. This is required for the reusable workflow to run, but also ensures that running the tool locally vs running it in CI will yield the same results. * In the configuration, I've set the "min-age" for dependencies to 3 days (default = 7) to be in line with the GitHub default `cooldown` setting. At a later point in time we may want to increase this number. This should be done in conjunction with the `cooldown` setting in the `dependabot.yml` configuration. Includes ignoring the new config file for dist packages via `.gitattributes`. Refs: * https://github.com/PHPCSStandards/.github/releases/tag/v1.3.0 * https://github.com/suzuki-shunsuke/pinact * https://github.com/suzuki-shunsuke/pinact#configuration * https://github.com/suzuki-shunsuke/pinact-action --- .gitattributes | 9 +++++---- .github/workflows/reusable-qa-checks.yml | 7 +++++++ .pinact.yaml | 8 ++++++++ 3 files changed, 20 insertions(+), 4 deletions(-) create mode 100644 .pinact.yaml diff --git a/.gitattributes b/.gitattributes index adc149e..a6f5475 100644 --- a/.gitattributes +++ b/.gitattributes @@ -2,10 +2,11 @@ # Exclude these files from release archives. # https://blog.madewithlove.be/post/gitattributes/ # -/.gitattributes export-ignore -/.gitignore export-ignore -/.github/ export-ignore -/Test/ export-ignore +.gitattributes export-ignore +.gitignore export-ignore +.pinact.yaml export-ignore +/.github/ export-ignore +/Test/ export-ignore # # Auto detect text files and perform LF normalization diff --git a/.github/workflows/reusable-qa-checks.yml b/.github/workflows/reusable-qa-checks.yml index 1e37e8c..e609cbe 100644 --- a/.github/workflows/reusable-qa-checks.yml +++ b/.github/workflows/reusable-qa-checks.yml @@ -7,6 +7,13 @@ on: permissions: {} jobs: + pinact: + permissions: + contents: read # To clone the repo. + + name: 'Run Pinact' + uses: PHPCSStandards/.github/.github/workflows/reusable-pinact.yml@5a8a6fcf1ac33b3ec6d7b826c0f319eaa83581ff # v1.3.1 + xmllint: permissions: contents: read # To clone the repo. diff --git a/.pinact.yaml b/.pinact.yaml new file mode 100644 index 0000000..2816e56 --- /dev/null +++ b/.pinact.yaml @@ -0,0 +1,8 @@ +# yaml-language-server: $schema=https://raw.githubusercontent.com/suzuki-shunsuke/pinact/refs/heads/main/json-schema/pinact.json +# pinact - https://github.com/suzuki-shunsuke/pinact + +version: 3 + +min_age: + value: 3 # Default is 7 days + always: true # Always check this, not just when updating pins. From 3d44b77af71b530abfe5e75c2deecade9839c1d2 Mon Sep 17 00:00:00 2001 From: jrfnl Date: Sat, 24 Oct 2026 07:10:42 +0200 Subject: [PATCH 2/2] GH Actions: add Yamllint to `validate` workflow ... to loosely safeguard valid and consistent yaml files. Includes adding a configuration file which loosens up the `default` ruleset to a degree I'm comfortable with. Ref: https://yamllint.readthedocs.io/ --- .gitattributes | 1 + .github/workflows/reusable-qa-checks.yml | 9 +++++++++ .yamllint.yml | 22 ++++++++++++++++++++++ 3 files changed, 32 insertions(+) create mode 100644 .yamllint.yml diff --git a/.gitattributes b/.gitattributes index a6f5475..e37fdcf 100644 --- a/.gitattributes +++ b/.gitattributes @@ -5,6 +5,7 @@ .gitattributes export-ignore .gitignore export-ignore .pinact.yaml export-ignore +.yamllint.yml export-ignore /.github/ export-ignore /Test/ export-ignore diff --git a/.github/workflows/reusable-qa-checks.yml b/.github/workflows/reusable-qa-checks.yml index e609cbe..90e1b71 100644 --- a/.github/workflows/reusable-qa-checks.yml +++ b/.github/workflows/reusable-qa-checks.yml @@ -14,6 +14,15 @@ jobs: name: 'Run Pinact' uses: PHPCSStandards/.github/.github/workflows/reusable-pinact.yml@5a8a6fcf1ac33b3ec6d7b826c0f319eaa83581ff # v1.3.1 + yamllint: + permissions: + contents: read # To clone the repo. + + name: 'Lint Yaml' + uses: PHPCSStandards/.github/.github/workflows/reusable-yamllint.yml@5a8a6fcf1ac33b3ec6d7b826c0f319eaa83581ff # v1.3.1 + with: + strict: true + xmllint: permissions: contents: read # To clone the repo. diff --git a/.yamllint.yml b/.yamllint.yml new file mode 100644 index 0000000..8dc953f --- /dev/null +++ b/.yamllint.yml @@ -0,0 +1,22 @@ +# Details on the default config: +# https://yamllint.readthedocs.io/en/stable/configuration.html#default-configuration +extends: default + +yaml-files: + - '*.yaml' + - '*.yml' + - '.yamllint' + +# Rule documentation: https://yamllint.readthedocs.io/en/stable/rules.html +rules: + colons: + max-spaces-after: -1 # Disabled to allow aligning of values. + comments: + min-spaces-from-content: 1 + comments-indentation: {} + document-start: + present: false + line-length: + max: 145 + truthy: + allowed-values: ["true", "false", "on", "off"]