Skip to content

Float first-party actions, advance the OSV pin, scope the token #28

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
imanimanyara merged 1 commit into from
Nov 13, 2026
Merged

Float first-party actions, advance the OSV pin, scope the token #28

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 15 additions & 9 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,15 +20,21 @@ on:
A caller must pass `secrets: inherit` for it to arrive at all.
required: false

# Least privilege. Without this the jobs inherit the calling repository's default token scope,
# which on an older repository is still read/write on everything. Every job here only reads the
# tree; the ggshield step authenticates to GitGuardian with its own key, not with GITHUB_TOKEN.
permissions:
contents: read

jobs:
composer-audit:
name: composer audit
runs-on: ubuntu-latest
timeout-minutes: 20
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/checkout@v7

- uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
- uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
with:
php-version: ${{ inputs.php-version }}
extensions: ${{ inputs.php-extensions }}
Expand All @@ -47,12 +53,12 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 20
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/checkout@v7

- name: Install dependencies (generate composer.lock)
# OSV-Scanner reads `composer.lock`. Repos in this suite don't
# commit lock files (libraries), so generate one before scanning.
uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
- name: Set up PHP
# OSV-Scanner reads `composer.lock`. Repos in this suite don't commit lock files
# (libraries), so the next step generates one before scanning.
uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
with:
php-version: '8.4'
tools: composer:v2
Expand All @@ -61,7 +67,7 @@ jobs:
run: composer install --no-interaction --no-progress --prefer-dist

- name: Run OSV-Scanner
uses: google/osv-scanner-action/osv-scanner-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0
uses: google/osv-scanner-action/osv-scanner-action@32d3cd482bdadfb38b186c0ad1b031902d55d932 # v2.7.1
with:
# OSV-scanner v2 changed both flags:
# - `--skip-git` removed (binary auto-ignores .git/).
Expand All @@ -77,7 +83,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/checkout@v7
with:
# ggshield scans the range a pull request adds, so it needs the history to diff against.
fetch-depth: 0
Expand Down
Loading