Harden GitHub Actions workflows and prepare v1.0.3

.gitattributes

@@ -0,0 +1,10 @@
+# Exclude development files from Composer dist archives.
+/.github            export-ignore
+/tests              export-ignore
+/.gitattributes     export-ignore
+/.gitignore         export-ignore
+/CODE_OF_CONDUCT.md export-ignore
+/CONTRIBUTING.md    export-ignore
+/phpcs.xml.dist     export-ignore
+/phpstan.neon.dist  export-ignore
+/phpunit.xml        export-ignore

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - '*'
+
+  - package-ecosystem: composer
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      composer-dev:
+        dependency-type: development

.github/workflows/ci.yml

@@ -4,6 +4,9 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   check:
     name: PHP ${{ matrix.php }}
@@ -20,10 +23,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php }}
           coverage: none
@@ -35,16 +40,21 @@ jobs:
       - name: Run checks
         run: composer check
 
+      - name: Audit dependencies
+        run: composer audit --no-interaction
+
   coverage:
     name: Coverage
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: '8.5'
           coverage: xdebug
@@ -62,7 +72,7 @@ jobs:
           test -s coverage/clover.xml
 
       - name: Upload coverage
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           files: coverage/clover.xml
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -79,7 +89,7 @@ jobs:
 
     steps:
       - name: Dispatch post-CI build workflow
-        uses: saedyousef/repository-dispatch@v0.2
+        uses: saedyousef/repository-dispatch@f1fe69b136238dffd6a66eb3e6989f778650eaf8 # v0.2
         with:
           token: ${{ secrets.REPOSITORY_DISPATCH_TOKEN }}
           owner: ${{ github.repository_owner }}

.github/workflows/post-ci-build.yml

@@ -13,14 +13,26 @@ jobs:
     name: Build Composer archive
     runs-on: ubuntu-latest
 
+    env:
+      # Pass the dispatch payload through env, never interpolate it into scripts.
+      DISPATCH_SHA: ${{ github.event.client_payload.sha }}
+
     steps:
+      - name: Validate dispatched commit SHA
+        run: |
+          if [[ ! "$DISPATCH_SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "::error::Invalid commit SHA in dispatch payload"
+            exit 1
+          fi
+
       - name: Checkout dispatched commit
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event.client_payload.sha }}
+          ref: ${{ env.DISPATCH_SHA }}
+          persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: '8.4'
           coverage: none
@@ -32,11 +44,11 @@ jobs:
       - name: Build Composer archive
         run: |
           mkdir -p dist
-          composer archive --format=zip --file="dist/php-n8n-client-${{ github.event.client_payload.sha }}"
+          composer archive --format=zip --file="dist/php-n8n-client-${DISPATCH_SHA}"
 
       - name: Upload package archive
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: php-n8n-client-${{ github.event.client_payload.sha }}
+          name: php-n8n-client-${{ env.DISPATCH_SHA }}
           path: dist/*.zip
           if-no-files-found: error

CHANGELOG.md

@@ -7,6 +7,16 @@ https://php-n8n.com
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## v1.0.3 - 2026-10-28
+
+- Pinned all GitHub Actions to full commit SHAs.
+- Upgraded `actions/checkout`, `actions/upload-artifact`, and `codecov/codecov-action` to v7.
+- Fixed a template injection in the post-CI build workflow by passing the dispatch payload through `env` and validating the commit SHA.
+- Restricted the default `GITHUB_TOKEN` permissions in CI to read-only and disabled checkout credential persistence.
+- Added `composer audit` to CI.
+- Added Dependabot for GitHub Actions and Composer dependency updates.
+- Excluded development files (tests, CI config, tooling config) from Composer dist archives.
+
 ## v1.0.2 - 2026-06-03
 
 - Added a security policy with supported versions and private vulnerability reporting instructions.
@@ -27,6 +37,8 @@ This project follows [Semantic Versioning](https://semver.org/).
 
 ## Release Notes
 
+`v1.0.3` hardens the CI/CD workflows and adds automated dependency updates. It does not change the runtime API.
+
 `v1.0.2` adds the security policy and vulnerability reporting process. It does not change the runtime API.
 
 `v1.0.1` is a maintenance release focused on CI/CD orchestration. It does not change the runtime API.

SECURITY.md

@@ -6,7 +6,8 @@ Security updates are provided for the latest stable release of the library.
 
 | Version | Supported |
 | ------- | --------- |
-| v1.0.2  | ✅        |
+| v1.0.3  | ✅        |
+| v1.0.2  | ❌        |
 | v1.0.1  | ❌        |
 | v1.0.0  | ❌        |