ci: Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 in the github-actions group #40
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| workflow_dispatch: | |
| # Minimal token: nothing here writes to the repo. | |
| permissions: | |
| contents: read | |
| # Bound runner usage: a newer push/PR update cancels the still-running one. | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| # The PHP matrix is hand-listed in several places; the Makefile's | |
| # PHP_VERSIONS is the single source of truth. Assert every workflow that | |
| # repeats it (this file, release.yml, security-scan.yml) and the | |
| # check-upstream.yml PHP_LINES completeness gate agree with it, so a drift | |
| # cannot silently build, scan, or release a different PHP set than the bump | |
| # bot verifies. Each list is reduced to its sorted X.Y tokens and compared. | |
| - name: check PHP matrix is in sync | |
| run: | | |
| set -euo pipefail | |
| norm() { grep -oE '[0-9]+\.[0-9]+' | sort -u | tr '\n' ' '; } | |
| expected=$(sed -n 's/^PHP_VERSIONS ?= //p' Makefile | norm) | |
| : "${expected:?could not read PHP_VERSIONS from Makefile}" | |
| echo "expected (Makefile PHP_VERSIONS): [${expected}]" | |
| status=0 | |
| check() { # <file> <line-pattern> <label> | |
| local got | |
| got=$(grep -E "$2" "$1" | norm) | |
| if [ "$got" != "$expected" ]; then | |
| echo "::error file=$1::PHP matrix [${got}] != Makefile [${expected}] ($3)" | |
| status=1 | |
| else | |
| echo "ok: $1 ($3)" | |
| fi | |
| } | |
| check .github/workflows/ci.yml '^[[:space:]]*php: \[' 'build-test matrix' | |
| check .github/workflows/release.yml '^[[:space:]]*php: \[' 'images matrix' | |
| check .github/workflows/security-scan.yml '^[[:space:]]*php: \[' 'trivy matrix' | |
| check .github/workflows/check-upstream.yml '^[[:space:]]*PHP_LINES:' 'completeness gate' | |
| exit "$status" | |
| - name: hadolint | |
| uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 | |
| with: | |
| dockerfile: Dockerfile | |
| # Pin shellcheck to the version used locally so CI mirrors `make lint`. | |
| # The runner's bundled shellcheck is older and emits false positives that | |
| # current releases correctly suppress: SC2120/SC2119 on the library's | |
| # optional-argument functions (called with args only from child hooks | |
| # shellcheck cannot see) and SC2317 on trap/dispatch-invoked functions. | |
| # Fetch the official static binary and verify its SHA256, mirroring how the | |
| # Dockerfile fetches and checks its release assets. | |
| - name: shellcheck | |
| env: | |
| SHELLCHECK_VERSION: v0.11.0 | |
| SHELLCHECK_SHA256: 8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198 | |
| run: | | |
| set -euo pipefail | |
| tarball="shellcheck-${SHELLCHECK_VERSION}.linux.x86_64.tar.xz" | |
| curl -fsSL -o "$tarball" \ | |
| "https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION}/${tarball}" | |
| echo "${SHELLCHECK_SHA256} ${tarball}" | sha256sum -c - | |
| tar -xJf "$tarball" | |
| "shellcheck-${SHELLCHECK_VERSION}/shellcheck" --version | |
| "shellcheck-${SHELLCHECK_VERSION}/shellcheck" rootfs/*.sh test/*.sh | |
| - name: typos | |
| uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0 | |
| - name: actionlint | |
| uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0 | |
| # zizmor (workflow security audit) and rumdl (markdown) both ship on PyPI; | |
| # install them with pipx (preinstalled on the runner) at the same versions | |
| # used locally so CI mirrors `make lint`. GH_TOKEN lets zizmor run its | |
| # online audits (known-vulnerable action checks). | |
| - name: zizmor (workflow security) | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| pipx install zizmor==1.25.2 | |
| zizmor .github/workflows | |
| - name: rumdl (markdown) | |
| run: | | |
| pipx install rumdl==0.2.9 | |
| rumdl check ./*.md ./examples/*.md ./examples/*/*.md | |
| build-test: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read # checkout | |
| security-events: write # upload the trivy SARIF to code scanning | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| php: ["8.3", "8.4", "8.5"] | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: set up buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| # Builds php<ver> and runs the end-to-end smoke test against it. The | |
| # Makefile forwards DOCKER_BUILD_EXTRA to `docker build`, so wire buildx's | |
| # GitHub Actions layer cache here: --load drops the built image into the | |
| # local daemon (the smoke test and trivy run `docker run`/scan against it), | |
| # and a per-PHP cache scope keeps the matrix legs from clobbering each | |
| # other's apt/download layers across runs. | |
| - name: build + smoke test | |
| env: | |
| DOCKER_BUILD_EXTRA: >- | |
| --load | |
| --cache-from type=gha,scope=php${{ matrix.php }} | |
| --cache-to type=gha,mode=max,scope=php${{ matrix.php }} | |
| run: make test DEFAULT_PHP=${{ matrix.php }} | |
| # Report-only CVE scan, reusing the image just built on the 8.4 leg (the | |
| # base layers are shared, so one representative variant suffices) instead | |
| # of a separate job that rebuilds from scratch. Emit SARIF and upload it to | |
| # code scanning so findings land in the Security tab and are tracked over | |
| # time, instead of scrolling past in the build log. Base-image / sury CVEs | |
| # are outside this repo's control, so a finding informs (exit-code 0) | |
| # rather than blocks; tighten to exit-code 1 if desired. | |
| - name: trivy image scan | |
| if: matrix.php == '8.4' | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: freeunit-php:trixie-php8.4 | |
| severity: HIGH,CRITICAL | |
| exit-code: "0" | |
| format: sarif | |
| output: trivy-results.sarif | |
| - name: upload trivy SARIF | |
| if: matrix.php == '8.4' | |
| uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 | |
| with: | |
| sarif_file: trivy-results.sarif | |
| category: trivy-image |