PHPCSStandards / PHPCSUtils / 39531296772
100%

DEFAULT BRANCH: develop
Ran
Jobs 8
Files 52
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 99.719%. Remained the same
39531296772

push

github

web-flow 
GH Actions: add new "pinact" job (#792)

In a previous PR, all action runners used in GH Actions workflows where "pinned" to precise versions for security reasons.
However, that doesn't prevent new jobs, or changes to existing jobs, from being introduced which do not correctly pin action runners.

This commit introduces a new GHA job which runs the `pinact` tooling via a reusable workflow as available since the `PHPCSStandards/.github` 1.3.0 release.

Pinact is a tool which can be used to:
* Update the action runner references in existing workflows to commit-hash "pinned" versions.
* Verify that the commit hash to which an action runner is pinned is valid.
* Verify that a "pinned" commit-hash matches the version number in the comment following the action runner reference.
* Verify that a mandatory "minimum age" (`cooldown`) period is respected. The default `min-age` setting is 7 days.
* Safeguard that any changes in workflows do not introduce new unpinned action runner references.

The pinact action runner can also push a new commit to open PRs if the "verification"checks fail, however I do not think this is necessary at this time.
The inline annotations in a PR and the failing build should be sufficient to prevent new issues from entering the workflows.

Notes:
* I've added a `.pinact.yaml` file. This is required for the reusable workflow to run, but also ensures that running the tool locally vs running it in CI will yield the same results.
* In the configuration, I've set the "min-age" for dependencies to 3 days (default = 7) to be in line with the GitHub default `cooldown` setting.
    At a later point in time we may want to increase this number. This should be done in conjunction with the `cooldown` setting in the `dependabot.yml` configuration.

Includes ignoring the new config file for dist packages via `.gitattributes`.

Refs:
* https://github.com/PHPCSStandards/.github/releases/tag/v1.3.0
* https://github.com/suzuki-shunsuke/pinact
* https://g... (continued)

3906 of 3917 relevant lines covered (99.72%)

288.08 hits per line

Jobs
ID Job ID Ran Files Coverage
1 php-8.5-phpcs-4.0.2 - 39531296772.1 52
98.8
GitHub Action Run
2 php-8.5-phpcs-3.x-dev - 39531296772.2 52
99.03
GitHub Action Run
3 php-8.5-phpcs-4.x-dev - 39531296772.3 52
98.8
GitHub Action Run
4 php-5.4-phpcs-3.x-dev - 39531296772.4 52
97.8
GitHub Action Run
5 php-8.5-phpcs-lowest - 39531296772.5 52
99.03
GitHub Action Run
6 php-7.2-phpcs-4.0.2 - 39531296772.6 52
98.51
GitHub Action Run
7 php-5.4-phpcs-lowest - 39531296772.7 52
97.8
GitHub Action Run
8 php-7.2-phpcs-4.x-dev - 39531296772.8 52
98.51
GitHub Action Run
Source Files on build 39531296772