Chore/supply chain security - #6
Merged
Merged
Conversation
added 4 commits
September 16, 2026 10:57
- Pin actions/checkout@v7 and shivammathur/setup-php@v2 to immutable 40-character commit SHAs across all three workflow files to prevent supply-chain attacks via tag hijacking (ref: tj-actions/changed-files, March 2025). - Add Dependabot cooldown blocks (patch ≥3d, minor ≥5d, major ≥7d) for both composer and github-actions ecosystems to reduce exposure to newly compromised releases (ref: xz-utils backdoor, 2024). Closes plumb checks: actions-sha-pinned, dependency-update-cooldown
Cooldown was accidentally dropped during branch creation. Adds minimum wait times before Dependabot proposes updates: patch ≥3d, minor ≥5d, major ≥7d (both composer and github-actions).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supply Chain Security Hardening
Addresses all failing Plumb
security checks and brings repository hygiene in line with current
open-source best practices for a publicly distributed Composer library.
What changed and why
1. GitHub Actions pinned to full commit SHA
Files:
.github/workflows/run-tests.yml,phpstan.yml,fix-style.ymlTags like
actions/checkout@v7are mutable — anyone with write access tothat repository can silently redirect the tag to different code. The
tj-actions/changed-filesincident (March 2025) showed this is an activeattack vector that leaks CI secrets from thousands of repositories.
Every third-party
uses:reference is now pinned to its 40-characterimmutable commit SHA, with the human-readable tag preserved as a comment
for Dependabot to track: