From e5f3bffb214270e6b6f755dd41a1954d60afc7e1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 19 Oct 2026 15:25:42 +0000
Subject: [PATCH] Pin the GitHub Actions to commit SHAs

actions/checkout and shivammathur/setup-php were referenced by tag (@v7, @v2),
which whoever controls those repositories can move: the next run would execute
what they put there. They are pinned to the commits of v7.0.1 and 2.40.0, with
the release in a comment; Dependabot (github-actions, new here) proposes the
updates. tests/lint/check-workflows.php (identical to the one in bfstop), run
by the lint job, fails on a reference that is not pinned.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhhhdjhErC9ZiaS4HyRjsh
---
 .github/dependabot.yml         |  9 +++++
 .github/workflows/ci.yml       | 16 +++++----
 tests/lint/check-workflows.php | 62 ++++++++++++++++++++++++++++++++++
 3 files changed, 80 insertions(+), 7 deletions(-)
 create mode 100644 .github/dependabot.yml
 create mode 100644 tests/lint/check-workflows.php

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..1a74371
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,9 @@
+version: 2
+updates:
+  # the actions the workflows use are pinned to commit SHAs (checked by
+  # tests/lint/check-workflows.php); Dependabot proposes updates of the pins
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels: [dependencies]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6011bbe..b559bf7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,8 +17,8 @@ jobs:
     name: Manifest, language and package checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: shivammathur/setup-php@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: '8.4'
           coverage: none
@@ -29,6 +29,8 @@ jobs:
             sudo apt-get install -y -q libxml2-utils > /dev/null
           }
           find . -name '*.xml' -not -path './.git/*' -print0 | xargs -0 xmllint --noout
+      - name: Actions are pinned to commit SHAs
+        run: php tests/lint/check-workflows.php
       - name: Language files
         run: php tests/lint/check-language.php bfstop.xml COM_BFSTOP
       - name: Release zip contains everything the manifest references
@@ -44,8 +46,8 @@ jobs:
       matrix:
         php: ['8.1', '8.4']
     steps:
-      - uses: actions/checkout@v7
-      - uses: shivammathur/setup-php@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php }}
           coverage: none
@@ -76,7 +78,7 @@ jobs:
             echo "COM_BFSTOP_ROOT=$GITHUB_WORKSPACE"
             echo "PLUGIN_ROOT=$RUNNER_TEMP/bfstop"
           } >> "$GITHUB_ENV"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # use the plugin's branch of the same name if there is one (for changes
       # spanning both), else main
@@ -89,7 +91,7 @@ jobs:
           else
             echo "ref=main" >> "$GITHUB_OUTPUT"
           fi
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: codeling/bfstop
           ref: ${{ steps.plugin.outputs.ref }}
@@ -97,7 +99,7 @@ jobs:
       - name: Move bfstop checkout out of the component's
         run: mv bfstop "$PLUGIN_ROOT"
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php }}
           extensions: mysqli, pdo_mysql, pgsql, pdo_pgsql, zip, mbstring, intl, gd
diff --git a/tests/lint/check-workflows.php b/tests/lint/check-workflows.php
new file mode 100644
index 0000000..92f1877
--- /dev/null
+++ b/tests/lint/check-workflows.php
@@ -0,0 +1,62 @@
+<?php
+/*
+ * @package BFStop Plugin (bfstop) for Joomla!
+ * @author Bernhard Froehler
+ * @copyright (C) Bernhard Froehler
+ * @license GNU/GPLv3 http://www.gnu.org/licenses/gpl-3.0.html
+**/
+// Usage: php tests/lint/check-workflows.php
+//
+// Every action a GitHub Actions workflow uses has to be pinned to the full
+// commit SHA of a release, with the release in a comment:
+//
+//   - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+//
+// A tag like @v7 can be moved by whoever controls the action's repository (or
+// whoever took it over): the next run of our workflows would run what they
+// put there, with this repository's token and in its checkouts. Dependabot
+// (github-actions in .github/dependabot.yml) proposes the updates of pinned
+// actions. Kept identical in the com_bfstop repository.
+//
+// Exits with status 1 if a reference is not pinned.
+
+$root = dirname(__DIR__, 2);
+$files = array_merge(glob($root.'/.github/workflows/*.yml'), glob($root.'/.github/workflows/*.yaml'),
+	glob($root.'/.github/actions/*/action.yml'));
+if (count($files) === 0)
+{
+	fwrite(STDERR, "No workflow files found in $root/.github\n");
+	exit(1);
+}
+$errors = 0;
+$references = 0;
+foreach ($files as $file)
+{
+	foreach (file($file) as $number => $line)
+	{
+		if (!preg_match('/^\s*(?:-\s*)?uses:\s*(\S+)(.*)$/', $line, $m))
+		{
+			continue;
+		}
+		$name = $file;
+		$name = substr($name, strlen($root) + 1).':'.($number + 1);
+		$target = $m[1];
+		if (strpos($target, './') === 0)
+		{
+			continue; // an action of this repository
+		}
+		++$references;
+		if (!preg_match('#^[\w.-]+/[\w./-]+@[0-9a-f]{40}$#', $target))
+		{
+			echo "ERROR: $name: '$target' is not pinned to a commit SHA\n";
+			++$errors;
+		}
+		elseif (!preg_match('/^\s*#\s*v?\d+\.\d+/', $m[2]))
+		{
+			echo "ERROR: $name: '$target' has no comment naming the release (# v1.2.3)\n";
+			++$errors;
+		}
+	}
+}
+echo "$references action reference(s) in ".count($files)." file(s) checked, $errors error(s)\n";
+exit($errors > 0 ? 1 : 0);