ci: harden workflow and Dependabot against supply-chain attacks

Merged
MA
13d ago
+20-3

Summary

Hardens the CI workflow and the Dependabot configuration against supply-chain attacks.

.github/workflows/ci.yml

  • permissions: contents: read — the default GITHUB_TOKEN no longer inherits the repository's default (possibly write) scope.
  • persist-credentials: false on checkout — the token is not left in the runner's git config, where any later step (Composer scripts included) could read it.
  • Every action pinned to a full commit SHA, with the release in a trailing comment. Tags are mutable; SHAs are not. Dependabot updates the SHA and the comment together.
    • actions/checkout → v7.0.1 (supersedes #3)
    • shivammathur/setup-php → 2.40.0
    • ramsey/composer-install → 4.0.0
  • concurrency cancels superseded runs on pull requests; pushes to main always run to completion.

.github/dependabot.yml

  • cooldown: default-days: 7 for both ecosystems, so a freshly published (and possibly compromised, later yanked) release is not proposed immediately.
  • GitHub Actions updates grouped into a single monthly PR.

Test plan

  • CI passes on PHP 8.2–8.5 with the pinned actions.
  • Dependabot closes #3 as superseded once this is merged.

🤖 Generated with Claude Code

Summary by cubic

Hardens the CI workflow and Dependabot configuration against supply-chain attacks.

  • Restricts the default GITHUB_TOKEN to contents: read and checks out with persist-credentials: false so later steps can't read the token.
  • Pins every action to a full commit SHA with the release in a trailing comment; bumps actions/checkout to v7.0.1, shivammathur/setup-php to 2.40.0, and ramsey/composer-install to 4.0.0.
  • Adds a concurrency group so superseded pull-request runs are cancelled while pushes to main always run to completion.
  • Adds a 7-day Dependabot cooldown for both ecosystems and groups GitHub Actions updates into a single monthly PR.