pin workflow action versions to sha hash, tighten permissions #869

	name: PHP coding standards

	on:
	push:
	branches:
	- main
	pull_request:
	workflow_dispatch:

	# Cancels all previous workflow runs for pull requests that have not completed.
	concurrency:
	# The concurrency group contains the workflow name and the branch name for pull requests
	# or the commit hash for any other events.
	group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref \|\| github.sha }}
	cancel-in-progress: true

	# Disable permissions for all available scopes by default.
	# Any needed permissions should be configured at the job level.
	permissions: {}

	jobs:
	lint:
	name: Run coding standards checks
	runs-on: ubuntu-latest
	permissions:
	contents: read

	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
	with:
	persist-credentials: false

	- name: Setup cache
	uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
	with:
	key: ${{ runner.os }}-${{ hashFiles('composer.json') }} # Note that lock file will change between runs.
	path: .cache

	- name: Set up PHP
	uses: shivammathur/setup-php@cf4cade2721270509d5b1c766ab3549210a39a2a # v2.33.0

	- name: Install dependencies
	run: composer install

	- name: Lint PHP
	run: composer run lint

Navigation Menu