From 1e4c012c6856636f69cc479ae345fff2ed40814e Mon Sep 17 00:00:00 2001
From: Matteo Milesi <matteo.milesi@hotmail.it>
Date: Thu, 15 Oct 2026 10:36:05 +0200
Subject: [PATCH] ci: harden workflow and Dependabot against supply-chain
 attacks

- Restrict the default GITHUB_TOKEN to contents: read.
- Check out with persist-credentials: false so the token is not left
  in the runner's git config for later steps (Composer scripts
  included).
- Pin every action to a full commit SHA with the release as a
  comment; Dependabot keeps both in sync. Bumps actions/checkout to
  v7.0.1.
- Cancel superseded runs on pull requests.
- Dependabot: wait 7 days before proposing a new release (cooldown)
  and group GitHub Actions updates into a single PR.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml   |  8 ++++++++
 .github/workflows/ci.yml | 15 ++++++++++++---
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9eb891d..5a0ada9 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,6 +5,8 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
     labels:
       - dependencies
     groups:
@@ -18,6 +20,12 @@ updates:
     directory: /
     schedule:
       interval: monthly
+    cooldown:
+      default-days: 7
     labels:
       - dependencies
       - github-actions
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 54d5dd6..28bb93e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,13 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   qa:
     name: PHP ${{ matrix.php }}
@@ -15,10 +22,12 @@ jobs:
         php: ['8.2', '8.3', '8.4', '8.5']
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php }}
           extensions: dom, libxml, mbstring, xmlreader, zip
@@ -26,7 +35,7 @@ jobs:
           tools: composer:v2
 
       - name: Install dependencies
-        uses: ramsey/composer-install@v4
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
 
       - name: Lint (Laravel Pint)
         run: vendor/bin/pint --test