CI: pin the GitHub Actions to commit SHAs

.github/dependabot.yml

@@ -0,0 +1,9 @@
+version: 2
+updates:
+  # the actions the workflows use are pinned to commit SHAs (checked by
+  # tests/lint/check-workflows.php); Dependabot proposes updates of the pins
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels: [dependencies]

.github/workflows/ci.yml

@@ -17,8 +17,8 @@ jobs:
     name: Manifest, language and package checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: shivammathur/setup-php@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: '8.4'
           coverage: none
@@ -29,6 +29,8 @@ jobs:
             sudo apt-get install -y -q libxml2-utils > /dev/null
           }
           find . -name '*.xml' -not -path './.git/*' -print0 | xargs -0 xmllint --noout
+      - name: Actions are pinned to commit SHAs
+        run: php tests/lint/check-workflows.php
       - name: Language files
         run: php tests/lint/check-language.php bfstop.xml COM_BFSTOP
       - name: Release zip contains everything the manifest references
@@ -44,8 +46,8 @@ jobs:
       matrix:
         php: ['8.1', '8.4']
     steps:
-      - uses: actions/checkout@v7
-      - uses: shivammathur/setup-php@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php }}
           coverage: none
@@ -76,7 +78,7 @@ jobs:
             echo "COM_BFSTOP_ROOT=$GITHUB_WORKSPACE"
             echo "PLUGIN_ROOT=$RUNNER_TEMP/bfstop"
           } >> "$GITHUB_ENV"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # use the plugin's branch of the same name if there is one (for changes
       # spanning both), else main
@@ -89,15 +91,15 @@ jobs:
           else
             echo "ref=main" >> "$GITHUB_OUTPUT"
           fi
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: codeling/bfstop
           ref: ${{ steps.plugin.outputs.ref }}
           path: bfstop
       - name: Move bfstop checkout out of the component's
         run: mv bfstop "$PLUGIN_ROOT"
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php }}
           extensions: mysqli, pdo_mysql, pgsql, pdo_pgsql, zip, mbstring, intl, gd

tests/lint/check-workflows.php

@@ -0,0 +1,62 @@
+<?php
+/*
+ * @package BFStop Plugin (bfstop) for Joomla!
+ * @author Bernhard Froehler
+ * @copyright (C) Bernhard Froehler
+ * @license GNU/GPLv3 http://www.gnu.org/licenses/gpl-3.0.html
+**/
+// Usage: php tests/lint/check-workflows.php
+//
+// Every action a GitHub Actions workflow uses has to be pinned to the full
+// commit SHA of a release, with the release in a comment:
+//
+//   - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+//
+// A tag like @v7 can be moved by whoever controls the action's repository (or
+// whoever took it over): the next run of our workflows would run what they
+// put there, with this repository's token and in its checkouts. Dependabot
+// (github-actions in .github/dependabot.yml) proposes the updates of pinned
+// actions. Kept identical in the com_bfstop repository.
+//
+// Exits with status 1 if a reference is not pinned.
+
+$root = dirname(__DIR__, 2);
+$files = array_merge(glob($root.'/.github/workflows/*.yml'), glob($root.'/.github/workflows/*.yaml'),
+	glob($root.'/.github/actions/*/action.yml'));
+if (count($files) === 0)
+{
+	fwrite(STDERR, "No workflow files found in $root/.github\n");
+	exit(1);
+}
+$errors = 0;
+$references = 0;
+foreach ($files as $file)
+{
+	foreach (file($file) as $number => $line)
+	{
+		if (!preg_match('/^\s*(?:-\s*)?uses:\s*(\S+)(.*)$/', $line, $m))
+		{
+			continue;
+		}
+		$name = $file;
+		$name = substr($name, strlen($root) + 1).':'.($number + 1);
+		$target = $m[1];
+		if (strpos($target, './') === 0)
+		{
+			continue; // an action of this repository
+		}
+		++$references;
+		if (!preg_match('#^[\w.-]+/[\w./-]+@[0-9a-f]{40}$#', $target))
+		{
+			echo "ERROR: $name: '$target' is not pinned to a commit SHA\n";
+			++$errors;
+		}
+		elseif (!preg_match('/^\s*#\s*v?\d+\.\d+/', $m[2]))
+		{
+			echo "ERROR: $name: '$target' has no comment naming the release (# v1.2.3)\n";
+			++$errors;
+		}
+	}
+}
+echo "$references action reference(s) in ".count($files)." file(s) checked, $errors error(s)\n";
+exit($errors > 0 ? 1 : 0);