From 1b1891a09aaa4e43b7df7a66089f6d91b414737e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rabbi=20Islam=20Rony=20=E2=9A=A1=EF=B8=8F?=
 <35329385+RabbiIslamRony@users.noreply.github.com>
Date: Sun, 2 Aug 2026 11:38:57 +0600
Subject: [PATCH] fix: secure PHPCS pull request workflow

---
 .github/workflows/phpcs.yml | 41 ++++++++++++++++++++++++++++---------
 1 file changed, 31 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/phpcs.yml b/.github/workflows/phpcs.yml
index cf9be521dc..77dfb466fa 100644
--- a/.github/workflows/phpcs.yml
+++ b/.github/workflows/phpcs.yml
@@ -1,9 +1,13 @@
 name: PHPCS Check
 
 on:
-  pull_request_target:
+  pull_request:
     paths:
-      - '**/*.php'  # Run only when PHP files change
+      - '**/*.php'  # Run when PHP files change
+      - '.github/workflows/phpcs.yml'
+
+permissions:
+  contents: read
 
 # Concurrency: Ensure only one instance of this workflow runs per pull request or commit. 
 # If a new workflow for the same pull request/commit is triggered, the previous one will be canceled.
@@ -16,13 +20,12 @@ jobs:
     name: PHPCS Check
     runs-on: ubuntu-latest
     steps:
-        # Step 1: Checkout the code from the pull request base branch to ensure we're analyzing the correct changes.
+        # Step 1: Checkout the unprivileged pull request merge commit.
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
-          # checkout the PR branch, not the base
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0        # ensures full history
+          fetch-depth: 0
+          persist-credentials: false
   
         # Step 2: Set up PHP 7.4 with necessary configurations. Also, install the "cs2pr" tool for converting PHPCS output into annotations.
       - name: Setup PHP
@@ -35,8 +38,26 @@ jobs:
 
         # Step 3: Install all required Composer dependencies for the project.
       - name: Install Composer dependencies
-        run: composer install
+        run: composer install --no-interaction --prefer-dist --no-progress
+
+        # Step 4: Collect changed PHP files without losing special characters in filenames.
+      - name: Detect changed PHP files
+        id: changed-php
+        shell: bash
+        run: |
+          git diff --name-only -z --diff-filter=ACMRT \
+            "${{ github.event.pull_request.base.sha }}...HEAD" -- '*.php' \
+            > "$RUNNER_TEMP/php-files"
+
+          if [[ -s "$RUNNER_TEMP/php-files" ]]; then
+            echo "has_files=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_files=false" >> "$GITHUB_OUTPUT"
+          fi
 
-        # Step 4: Run the PHPCS check using the "composer phpcs" command to detect coding standard violations.
+        # Step 5: Run PHPCS only against PHP files changed by this pull request.
       - name: Run PHPCS checks
-        run: composer phpcs
+        if: steps.changed-php.outputs.has_files == 'true'
+        shell: bash
+        run: |
+          xargs -0 composer phpcs -- --warning-severity=0 -- < "$RUNNER_TEMP/php-files"