From b703eaf692f5e6c4afb79abbcbb72331d96107d1 Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Mon, 21 Sep 2026 10:25:09 -0400 Subject: [PATCH] Float first-party actions on majors, pin third-party by release SHA Aligns this package's GitHub Actions references with the org convention: float first-party actions on their major tag, pin third-party actions to a commit SHA, and keep both on the latest release. - First-party actions (`actions/*`, `github/*`) move off commit SHAs onto their current major tag. Every SHA replaced resolves to the tip of the major it now floats on, so the resolved commit is unchanged today and security patches arrive on their own from here. Pinning GitHub's own actions inside GitHub's own runner buys nothing and holds back patches. - Third-party actions stay pinned to a commit SHA, because a git tag is mutable and the action's owner can rewrite it. Each pin's comment now names the immutable release (`# 2.37.2`) rather than a mutable major tag (`# v2`) -- a comment naming a moving tag cannot tell you whether the pin is stale. 12 workflow file(s), 34 reference(s). Distinct transitions: - `actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` -> `actions/cache@v6` - `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1` -> `actions/checkout@v7` - `actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` -> `actions/download-artifact@v8` - `actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` -> `actions/upload-artifact@v7` - `peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9` -> `peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0` - `peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad` -> `peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0` - `shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240` -> `shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2` - `stefanzweifel/changelog-updater-action@a938690fad7edf25368f37e43a1ed1b34303eb36` -> `stefanzweifel/changelog-updater-action@a938690fad7edf25368f37e43a1ed1b34303eb36 # v1.12.0` - `stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d` -> `stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0` --- .github/workflows/benchmark-comment.yml | 6 +++--- .github/workflows/benchmark.yml | 8 ++++---- .github/workflows/fix-php-code-style-issues.yml | 6 +++--- .github/workflows/laravel-13-dev.yml | 6 +++--- .github/workflows/mutation.yml | 6 +++--- .github/workflows/phpstan.yml | 6 +++--- .github/workflows/rector.yml | 8 ++++---- .github/workflows/release-benchmark.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- .github/workflows/run-tests.yml | 6 +++--- .github/workflows/tag-currency.yml | 2 +- .github/workflows/update-changelog.yml | 6 +++--- 12 files changed, 34 insertions(+), 34 deletions(-) diff --git a/.github/workflows/benchmark-comment.yml b/.github/workflows/benchmark-comment.yml index 87eeecf..2e03997 100644 --- a/.github/workflows/benchmark-comment.yml +++ b/.github/workflows/benchmark-comment.yml @@ -22,7 +22,7 @@ jobs: steps: - name: Download benchmark result - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + uses: actions/download-artifact@v8 with: name: benchmark-result run-id: ${{ github.event.workflow_run.id }} @@ -36,7 +36,7 @@ jobs: tail -n +2 benchmark-result.md > benchmark-comment.md - name: Find existing comment - uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4 + uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0 id: find with: issue-number: ${{ steps.meta.outputs.number }} @@ -44,7 +44,7 @@ jobs: body-includes: '${{ steps.meta.outputs.heading }}' - name: Post or update comment - uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5 + uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0 with: issue-number: ${{ steps.meta.outputs.number }} comment-id: ${{ steps.find.outputs.comment-id }} diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index e7da8b9..184d454 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -21,12 +21,12 @@ jobs: steps: - name: Checkout base branch - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.base.sha }} - name: Setup PHP - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: '8.5' coverage: none @@ -41,7 +41,7 @@ jobs: run: cp benchmark-snapshot.json ${{ runner.temp }}/benchmark-snapshot.json - name: Checkout PR - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7 - name: Install PR dependencies uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0 @@ -55,7 +55,7 @@ jobs: php benchmark.php --ci >> benchmark-result.md - name: Upload benchmark result - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@v7 with: name: benchmark-result path: benchmark-result.md diff --git a/.github/workflows/fix-php-code-style-issues.yml b/.github/workflows/fix-php-code-style-issues.yml index e98df82..1e0c1c1 100644 --- a/.github/workflows/fix-php-code-style-issues.yml +++ b/.github/workflows/fix-php-code-style-issues.yml @@ -20,7 +20,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7 with: ref: ${{ github.head_ref }} @@ -42,7 +42,7 @@ jobs: run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT" - name: Restore composer cache - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6 with: path: ${{ steps.composer-cache.outputs.dir }} key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }} @@ -74,6 +74,6 @@ jobs: git stash pop || true - name: Commit changes - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7 + uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0 with: commit_message: 'chore: pint' diff --git a/.github/workflows/laravel-13-dev.yml b/.github/workflows/laravel-13-dev.yml index 55ce9ed..04c0847 100644 --- a/.github/workflows/laravel-13-dev.yml +++ b/.github/workflows/laravel-13-dev.yml @@ -43,10 +43,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7 - name: Setup PHP - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: 8.5 extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick, fileinfo @@ -64,7 +64,7 @@ jobs: run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT" - name: Restore composer cache - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6 with: path: ${{ steps.composer-cache.outputs.dir }} key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }} diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml index 69983af..5fcd205 100644 --- a/.github/workflows/mutation.yml +++ b/.github/workflows/mutation.yml @@ -44,9 +44,9 @@ jobs: name: mutate ${{ matrix.path }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7 - - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: "8.5" coverage: xdebug @@ -58,7 +58,7 @@ jobs: run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT" - name: Restore composer cache - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6 with: path: ${{ steps.composer-cache.outputs.dir }} key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }} diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml index 866781c..fefec7e 100644 --- a/.github/workflows/phpstan.yml +++ b/.github/workflows/phpstan.yml @@ -21,10 +21,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7 - name: Setup PHP - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: '8.5' coverage: none @@ -33,7 +33,7 @@ jobs: uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0 - name: Cache PHPStan results - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 + uses: actions/cache@v6 with: path: .cache/phpstan/ key: phpstan-result-cache-${{ hashFiles('composer.lock', 'phpstan.neon.dist') }} diff --git a/.github/workflows/rector.yml b/.github/workflows/rector.yml index 25e4c0c..25fa606 100644 --- a/.github/workflows/rector.yml +++ b/.github/workflows/rector.yml @@ -21,12 +21,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7 with: ref: ${{ github.head_ref }} - name: Setup PHP - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: '8.5' coverage: none @@ -35,7 +35,7 @@ jobs: uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0 - name: Cache Rector results - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 + uses: actions/cache@v6 with: path: .cache/rector/ key: rector-cache-${{ hashFiles('rector.php') }} @@ -55,6 +55,6 @@ jobs: git stash pop || true - name: Commit changes - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7 + uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0 with: commit_message: 'chore: rector' diff --git a/.github/workflows/release-benchmark.yml b/.github/workflows/release-benchmark.yml index d0c90c2..2094c07 100644 --- a/.github/workflows/release-benchmark.yml +++ b/.github/workflows/release-benchmark.yml @@ -27,12 +27,12 @@ jobs: steps: - name: Checkout release - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7 with: ref: ${{ github.event.release.tag_name || inputs.tag }} - name: Setup PHP - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: '8.5' coverage: none diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d8d5723..c8ab652 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,7 +18,7 @@ jobs: contents: write steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7 # The release body IS the CHANGELOG section for this version — a # release without a real description is incomplete (org standard). @@ -41,7 +41,7 @@ jobs: # these markers after publish — never paste numbers by hand. printf '\n\n\n' >> release-body.md - - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: "8.5" coverage: none diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml index 26f15ba..411d829 100644 --- a/.github/workflows/run-tests.yml +++ b/.github/workflows/run-tests.yml @@ -31,10 +31,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7 - name: Setup PHP - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: ${{ matrix.php }} extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick, fileinfo @@ -65,7 +65,7 @@ jobs: run: composer show -D - name: Cache PHPUnit results - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 + uses: actions/cache@v6 with: path: .cache/phpunit/ key: phpunit-cache-${{ matrix.php }}-${{ matrix.laravel }}-${{ matrix.stability }}-${{ matrix.os }}-${{ hashFiles('tests/**') }} diff --git a/.github/workflows/tag-currency.yml b/.github/workflows/tag-currency.yml index fbacd05..c3173f1 100644 --- a/.github/workflows/tag-currency.yml +++ b/.github/workflows/tag-currency.yml @@ -35,7 +35,7 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7 with: # The whole history and every tag. The default shallow checkout has # neither, and `git merge-base --is-ancestor` on a graph that stops at diff --git a/.github/workflows/update-changelog.yml b/.github/workflows/update-changelog.yml index 3227109..227fb2e 100644 --- a/.github/workflows/update-changelog.yml +++ b/.github/workflows/update-changelog.yml @@ -23,7 +23,7 @@ jobs: # sha, which is not a branch anything can commit to. That is exactly # how the v0.1.1 run failed. - name: Checkout code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7 with: ref: main @@ -42,14 +42,14 @@ jobs: - name: Update Changelog if: steps.existing.outputs.present == 'false' - uses: stefanzweifel/changelog-updater-action@a938690fad7edf25368f37e43a1ed1b34303eb36 # v1 + uses: stefanzweifel/changelog-updater-action@a938690fad7edf25368f37e43a1ed1b34303eb36 # v1.12.0 with: latest-version: ${{ github.event.release.tag_name }} release-notes: ${{ github.event.release.body }} - name: Commit updated CHANGELOG if: steps.existing.outputs.present == 'false' - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7 + uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0 with: branch: main commit_message: Update CHANGELOG