From 1dbb45157934d7c61634a833d7c99af83a093170 Mon Sep 17 00:00:00 2001 From: rockwellll Date: Fri, 24 Jul 2026 19:40:51 -0300 Subject: [PATCH] Harden GitHub Actions workflows --- .github/workflows/php.yml | 14 ++++++++++---- .github/workflows/release.yml | 6 ++++-- 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/.github/workflows/php.yml b/.github/workflows/php.yml index 52c8b1d..578255e 100644 --- a/.github/workflows/php.yml +++ b/.github/workflows/php.yml @@ -20,9 +20,11 @@ jobs: steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2 with: php-version: ${{ matrix.php }} coverage: none @@ -39,9 +41,11 @@ jobs: steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2 with: php-version: "8.2" @@ -56,10 +60,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 + with: + persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2 with: php-version: "8.2" coverage: none diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2997dc5..08eee6a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -10,9 +10,11 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2 with: php-version: "8.2" @@ -27,7 +29,7 @@ jobs: zip -r hellotext-wordpress.zip hellotext-wordpress - name: Create GitHub Release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: files: release/hellotext-wordpress.zip generate_release_notes: true