Repository navigation
Drop the bare command aliases, and group dependabot action updates - #15
Merged
Merged
Conversation
imanimanyara
force-pushed
the
ci/alias-and-dependabot
branch
2 times, most recently
from
September 16, 2026 15:05
a14a7e3 to
1c1d667
Compare
️✅ There are no secrets present in this pull request anymore.If these secrets were true positive and are still valid, we highly recommend you to revoke them. 🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request. |
imanimanyara
force-pushed
the
ci/alias-and-dependabot
branch
3 times, most recently
from
September 16, 2026 16:18
29cd782 to
d9b5ea0
Compare
**Style.** `vendor/bin/laranail-pint` resolves the one config in vendor/laranail/package-tools and errors when it is absent. Bare `vendor/bin/pint` takes a `--config` path that does not exist, silently falls back to its own defaults and exits 0 -- so twelve workflows in this family were reporting "code style clean" against a rule set no other package uses. Those now call laranail-pint, and this is what the shared config actually wanted: import order, `.` spacing, `=>` alignment, brace position, single-line empty bodies, phpdoc alignment. No behaviour changes; the suites are unchanged and green. **Pins.** The release.yml consistency pass had copied one repo's pins over fourteen others, and that repo was behind: `softprops/action-gh-release` went v3.0.3 -> v3.0.2 (v3.0.3 -> v2 in enumerator) and `anchore/sbom-action` went v0.24.2 -> v0.24.0. Pinning to a SHA is a supply-chain control, so a pin moving backwards is the one direction that must never happen by accident -- and nothing catches it, because the pin check verifies the SHA against its comment, not that the version moved forward. Both are on one pin family-wide now, at the newest release, with the exact release tag in the comment rather than a moving major. **And the alias debris.** Where the `$commandAliases` declarations were deleted, this also fixes the two command bases that read `$this->commandAliases` without declaring it (an `Undefined property` at construction, which took out `artisan package:discover`), a command that called a sibling by its deleted alias, a success message naming a command that no longer exists, and the docs that still documented the aliases as the way in.
imanimanyara
force-pushed
the
ci/alias-and-dependabot
branch
from
September 16, 2026 16:37
d9b5ea0 to
06abc2f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two changes, both about names that live in a flat global registry.
The bare command aliases are gone. Every alias this package declared was an unscoped, generic name —
env:set,make:crud,license,tidy. Artisan keeps command names in a flat map, so a second package claiming one does not collide loudly: it silently replaces the first, and the damage surfaces far away as the wrong code running under a familiar name. That is exactly the collisionlaranail::<slug>.<command>exists to prevent, and an unscoped alias hands it straight back. 127 of them across twelve packages, and not one was vendor-scoped.The primary name is unchanged, so every command is still reachable as
laranail::<slug>.<command>. The trait still applies$commandAliaseswhen a command declares one, so a vendor-scoped alias remains possible where a short form genuinely earns it. Breaking for anyone typing an old short name.Dependabot now groups action updates.
github/codeql-action/initand/analyzemust be the same version — CodeQL fails with "Loaded a configuration file for version X, but running version Y" — and dependabot proposed each subpath as its own pull request, so each one alone left the pair mismatched and red.laranail/confettihad two such PRs open, both failing, neither wrong on its own. Grouping fixes that for any paired action, not just CodeQL.