[ondrejmirtes]

Fixes everything reported by the linters in lint-workflows.yml. Each was run locally with the same versions and flags as CI.

Linter	Before	After
actionlint 1.7.12	clean	clean
octoscan (scans all triggers, as configured)	1 finding	clean
poutine 1.1.4	17 notes	0
zizmor 1.31.1 --persona=auditor, online audits	39 + 5 findings (exit 13, so the job was red)	no findings

Changes

• Checkout credentials (artipacked): every actions/checkout now sets persist-credentials: false.
  • In create-tag.yml, rickstaa/action-create-tag used to push the tag with the bot token persisted by checkout. That token now goes to the action through github_token: ${{ secrets.PHPSTAN_BOT_TOKEN }}. The tag is still pushed by the bot, so it still triggers release.yml.
• Permissions: workflow-level permissions: {} where defaults were used before. Jobs get only what they need (contents: read for checkout; lock keeps issues: write).
• Concurrency: every workflow has a concurrency group.
  • PR/push CI cancels superseded runs only on pull requests, so pushes to 1.4.x still all run.
  • Release workflows are grouped per tag or release, so separate releases never cancel each other.
• secrets-outside-env: jobs that read secrets (create-tag, release, toot, tweet) now run in a release environment. Repository secrets still resolve there, so nothing breaks, and GitHub creates the environment on first use.
  • Follow-up (repo settings): to get the real benefit, move PHPSTAN_BOT_TOKEN, MASTODON_ACCESS_TOKEN and the TWITTER_* secrets into the release environment, and optionally restrict it to tags and 1.4.x.
• superfluous-actions: softprops/action-gh-release is replaced with gh release create --verify-tag, using the same token, title and notes. The changelog is passed through env, not interpolated into the script.
• ref-version-mismatch: the setup-php pin comment is now # 2.40.0. The upstream tag has no v prefix; the SHA is unchanged and verified.
• octoscan dangerous-checkout: the phpstan/build-cs checkout with ref: 2.x is replaced by the existing make cs-install target, which does the same thing. Verified locally: make cs-install && make cs passes.
• poutine unverified_script_exec: actionlint is now downloaded from a pinned release (1.7.12) and checked with sha256sum, instead of piping download-actionlint.bash from main. Bumping actionlint now means updating the version and checksum.
• poutine github_action_from_unverified_creator_used: the reviewed, SHA-pinned third-party actions are acknowledged per action in .github/poutine.yml, so any newly added action is still reported. It lives under .github, so it stays out of the dist archive.
• Jobs that had no name (actionlint, toot, tweet, lock) now have one.

Note: octoscan was run locally from the v0.1.7 release binary. CI uses ghcr.io/synacktiv/octoscan:latest, which may include a few newer commits.