Security: untrack composer.lock, pin guzzlehttp/psr7, add CI audit gate #13
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Laravel Package | |
| on: | |
| push: | |
| branches: [ master ] | |
| pull_request: | |
| branches: [ master ] | |
| jobs: | |
| laravel-tests: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| php: ['8.2', '8.3', '8.4', '8.5'] | |
| laravel: ['11.*', '12.*', '13.*'] | |
| exclude: | |
| - php: '8.5' | |
| laravel: '11.*' | |
| - php: '8.2' | |
| laravel: '13.*' | |
| include: | |
| - laravel: '11.*' | |
| testbench: '9.*' | |
| - laravel: '12.*' | |
| testbench: '10.*' | |
| - laravel: '13.*' | |
| testbench: '11.*' | |
| name: PHP ${{ matrix.php }} / Laravel ${{ matrix.laravel }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Cache dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.composer/cache | |
| key: dependencies-php-${{ matrix.php }}-laravel-${{ matrix.laravel }}-composer-${{ hashFiles('composer.json') }} | |
| restore-keys: | | |
| dependencies-php-${{ matrix.php }}-laravel-${{ matrix.laravel }}-composer- | |
| - name: Setup PHP ${{ matrix.php }} | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: ${{ matrix.php }} | |
| extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite | |
| coverage: ${{ matrix.php == '8.5' && matrix.laravel == '13.*' && 'xdebug' || 'none' }} | |
| - name: Install specific Laravel version | |
| run: | | |
| composer require "illuminate/support:${{ matrix.laravel }}" "illuminate/cache:${{ matrix.laravel }}" "orchestra/testbench:${{ matrix.testbench }}" --no-update --no-interaction | |
| - name: Install Dependencies | |
| run: composer update --no-ansi --no-interaction --no-scripts --no-progress --prefer-dist | |
| - name: Execute tests via Pest | |
| run: vendor/bin/pest --configuration phpunit.xml ${{ matrix.php == '8.5' && matrix.laravel == '13.*' && '--coverage-clover coverage.xml' || '' }} | |
| - name: Upload coverage to Codecov | |
| if: matrix.php == '8.5' && matrix.laravel == '13.*' | |
| uses: codecov/codecov-action@v5 | |
| with: | |
| files: coverage.xml | |
| fail_ci_if_error: false | |
| env: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| security-audit: | |
| runs-on: ubuntu-latest | |
| name: Security Audit | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup PHP | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: '8.4' | |
| extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite | |
| # Resolve the latest versions allowed by composer.json (matching how | |
| # consumers and CI install this package), then fail the build on any known | |
| # vulnerability. --abandoned=ignore keeps the gate scoped to security | |
| # advisories rather than the unrelated abandoned-package notice. | |
| - name: Install Dependencies | |
| run: composer update --no-ansi --no-interaction --no-scripts --no-progress --prefer-dist | |
| - name: Audit dependencies for known vulnerabilities | |
| run: composer audit --no-ansi --no-interaction --abandoned=ignore |