From 7cfe6c2dda73aee6c8c22a1b0d92142d560562b2 Mon Sep 17 00:00:00 2001
From: Imani Manyara <imanimanyara@users.noreply.github.com>
Date: Mon, 21 Sep 2026 10:22:15 -0400
Subject: [PATCH] Float first-party actions on majors, pin third-party by
 release SHA

Aligns this package's GitHub Actions references with the org convention:
float first-party actions on their major tag, pin third-party actions to a
commit SHA, and keep both on the latest release.

- First-party actions (`actions/*`, `github/*`) move off commit SHAs onto
  their current major tag. Every SHA replaced resolves to the tip of the major
  it now floats on, so the resolved commit is unchanged today and security
  patches arrive on their own from here. Pinning GitHub's own actions inside
  GitHub's own runner buys nothing and holds back patches.
- Third-party actions stay pinned to a commit SHA, because a git tag is mutable
  and the action's owner can rewrite it. Each pin's comment now names the
  immutable release (`# 2.37.2`) rather than a mutable major tag (`# v2`) --
  a comment naming a moving tag cannot tell you whether the pin is stale.

1 workflow file(s), 3 reference(s). Distinct transitions:

- `actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` -> `actions/cache@v6`
- `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1` -> `actions/checkout@v7`
- `shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240` -> `shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2`
---
 .github/workflows/static-analysis.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index 28f3f34..f8361a1 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -16,8 +16,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+      - uses: actions/checkout@v7
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.4'
           coverage: none
@@ -27,7 +27,7 @@ jobs:
         run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
 
       - name: Restore composer cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache@v6
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }}