From 1fe012757e35f996c6b21769f1f68d1408d2959a Mon Sep 17 00:00:00 2001 From: Saed Yousef Date: Wed, 28 Oct 2026 14:03:36 +0100 Subject: [PATCH] Harden GitHub Actions workflows and prepare v1.0.3 Closes #5 --- .gitattributes | 10 ++++++++++ .github/dependabot.yml | 18 ++++++++++++++++++ .github/workflows/ci.yml | 22 ++++++++++++++++------ .github/workflows/post-ci-build.yml | 24 ++++++++++++++++++------ CHANGELOG.md | 12 ++++++++++++ SECURITY.md | 3 ++- 6 files changed, 76 insertions(+), 13 deletions(-) create mode 100644 .gitattributes create mode 100644 .github/dependabot.yml diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..f6ff6b4 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,10 @@ +# Exclude development files from Composer dist archives. +/.github export-ignore +/tests export-ignore +/.gitattributes export-ignore +/.gitignore export-ignore +/CODE_OF_CONDUCT.md export-ignore +/CONTRIBUTING.md export-ignore +/phpcs.xml.dist export-ignore +/phpstan.neon.dist export-ignore +/phpunit.xml export-ignore diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..62e2562 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,18 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + groups: + github-actions: + patterns: + - '*' + + - package-ecosystem: composer + directory: / + schedule: + interval: weekly + groups: + composer-dev: + dependency-type: development diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2ded2f4..4680721 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,6 +4,9 @@ on: push: pull_request: +permissions: + contents: read + jobs: check: name: PHP ${{ matrix.php }} @@ -20,10 +23,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php }} coverage: none @@ -35,16 +40,21 @@ jobs: - name: Run checks run: composer check + - name: Audit dependencies + run: composer audit --no-interaction + coverage: name: Coverage runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: '8.5' coverage: xdebug @@ -62,7 +72,7 @@ jobs: test -s coverage/clover.xml - name: Upload coverage - uses: codecov/codecov-action@v4 + uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1 with: files: coverage/clover.xml token: ${{ secrets.CODECOV_TOKEN }} @@ -79,7 +89,7 @@ jobs: steps: - name: Dispatch post-CI build workflow - uses: saedyousef/repository-dispatch@v0.2 + uses: saedyousef/repository-dispatch@f1fe69b136238dffd6a66eb3e6989f778650eaf8 # v0.2 with: token: ${{ secrets.REPOSITORY_DISPATCH_TOKEN }} owner: ${{ github.repository_owner }} diff --git a/.github/workflows/post-ci-build.yml b/.github/workflows/post-ci-build.yml index fcbb8d5..d16ecc1 100644 --- a/.github/workflows/post-ci-build.yml +++ b/.github/workflows/post-ci-build.yml @@ -13,14 +13,26 @@ jobs: name: Build Composer archive runs-on: ubuntu-latest + env: + # Pass the dispatch payload through env, never interpolate it into scripts. + DISPATCH_SHA: ${{ github.event.client_payload.sha }} + steps: + - name: Validate dispatched commit SHA + run: | + if [[ ! "$DISPATCH_SHA" =~ ^[0-9a-f]{40}$ ]]; then + echo "::error::Invalid commit SHA in dispatch payload" + exit 1 + fi + - name: Checkout dispatched commit - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: ${{ github.event.client_payload.sha }} + ref: ${{ env.DISPATCH_SHA }} + persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: '8.4' coverage: none @@ -32,11 +44,11 @@ jobs: - name: Build Composer archive run: | mkdir -p dist - composer archive --format=zip --file="dist/php-n8n-client-${{ github.event.client_payload.sha }}" + composer archive --format=zip --file="dist/php-n8n-client-${DISPATCH_SHA}" - name: Upload package archive - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: - name: php-n8n-client-${{ github.event.client_payload.sha }} + name: php-n8n-client-${{ env.DISPATCH_SHA }} path: dist/*.zip if-no-files-found: error diff --git a/CHANGELOG.md b/CHANGELOG.md index db7f0d9..3186ed2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,16 @@ https://php-n8n.com This project follows [Semantic Versioning](https://semver.org/). +## v1.0.3 - 2026-10-28 + +- Pinned all GitHub Actions to full commit SHAs. +- Upgraded `actions/checkout`, `actions/upload-artifact`, and `codecov/codecov-action` to v7. +- Fixed a template injection in the post-CI build workflow by passing the dispatch payload through `env` and validating the commit SHA. +- Restricted the default `GITHUB_TOKEN` permissions in CI to read-only and disabled checkout credential persistence. +- Added `composer audit` to CI. +- Added Dependabot for GitHub Actions and Composer dependency updates. +- Excluded development files (tests, CI config, tooling config) from Composer dist archives. + ## v1.0.2 - 2026-06-03 - Added a security policy with supported versions and private vulnerability reporting instructions. @@ -27,6 +37,8 @@ This project follows [Semantic Versioning](https://semver.org/). ## Release Notes +`v1.0.3` hardens the CI/CD workflows and adds automated dependency updates. It does not change the runtime API. + `v1.0.2` adds the security policy and vulnerability reporting process. It does not change the runtime API. `v1.0.1` is a maintenance release focused on CI/CD orchestration. It does not change the runtime API. diff --git a/SECURITY.md b/SECURITY.md index 8c50d15..74988ff 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,7 +6,8 @@ Security updates are provided for the latest stable release of the library. | Version | Supported | | ------- | --------- | -| v1.0.2 | ✅ | +| v1.0.3 | ✅ | +| v1.0.2 | ❌ | | v1.0.1 | ❌ | | v1.0.0 | ❌ |