ondrejmirtes · Nov 1, 2026
diff --git a/.github/poutine.yml b/.github/poutine.yml
@@ -0,0 +1,17 @@
+# https://github.com/boostsecurityio/poutine#acknowledging-findings
+skip:
+  # Third-party actions from creators that are not GitHub-verified.
+  # They have been reviewed and are pinned to full commit SHAs.
+  # New actions are still reported until they are added here.
+  - rule: github_action_from_unverified_creator_used
+    purl:
+      - pkg:githubactions/astral-sh/setup-uv
+      - pkg:githubactions/cbrgm/mastodon-github-action
+      - pkg:githubactions/dessant/lock-threads
+      - pkg:githubactions/eomm/why-don-t-you-tweet
+      - pkg:githubactions/metcalfc/changelog-generator
+      - pkg:githubactions/rickstaa/action-create-tag
+      - pkg:githubactions/shivammathur/setup-php
+      - pkg:githubactions/synacktiv/action-octoscan
+      - pkg:githubactions/wyrihaximus/github-action-get-previous-tag
+      - pkg:githubactions/wyrihaximus/github-action-next-semvers
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -11,6 +11,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   lint:
     name: "Lint"
@@ -35,9 +39,11 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # v2.40.0
+        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
         with:
           coverage: "none"
           php-version: "${{ matrix.php-version }}"
@@ -64,16 +70,11 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: "Checkout build-cs"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          repository: "phpstan/build-cs"
-          path: "build-cs"
-          ref: "2.x"
+          persist-credentials: false
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # v2.40.0
+        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
         with:
           coverage: "none"
           php-version: "8.2"
@@ -84,9 +85,8 @@ jobs:
       - name: "Install dependencies"
         run: "composer install --no-interaction --no-progress"
 
-      - name: "Install build-cs dependencies"
-        working-directory: "build-cs"
-        run: "composer install --no-interaction --no-progress"
+      - name: "Install build-cs"
+        run: "make cs-install"
 
       - name: "Lint"
         run: "make lint"
@@ -121,9 +121,11 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # v2.40.0
+        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
         with:
           coverage: "none"
           php-version: "${{ matrix.php-version }}"

diff --git a/.github/workflows/create-tag.yml b/.github/workflows/create-tag.yml
@@ -15,10 +15,19 @@ on:
           - patch
           - minor
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
 jobs:
   create-tag:
     name: "Create tag"
     runs-on: "ubuntu-latest"
+    environment: release
+    permissions:
+      contents: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
@@ -28,6 +37,7 @@ jobs:
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
           token: ${{ secrets.PHPSTAN_BOT_TOKEN }}
 
@@ -49,10 +59,12 @@ jobs:
         with:
           tag: ${{ steps.semvers.outputs.minor }}
           message: ${{ steps.semvers.outputs.minor }}
+          github_token: ${{ secrets.PHPSTAN_BOT_TOKEN }}
 
       - name: "Create new patch tag"
         uses: rickstaa/action-create-tag@a1c7777fcb2fee4f19b0f283ba888afa11678b72 # v1.7.2
         if: inputs.version == 'patch'
         with:
           tag: ${{ steps.semvers.outputs.patch }}
           message: ${{ steps.semvers.outputs.patch }}
+          github_token: ${{ secrets.PHPSTAN_BOT_TOKEN }}
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
@@ -14,6 +14,10 @@ env:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   integration-test:
     name: "Integration test"
@@ -43,9 +47,11 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # v2.40.0
+        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
         with:
           coverage: "none"
           php-version: "${{ matrix.php-version }}"
@@ -96,9 +102,11 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # v2.40.0
+        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
         with:
           coverage: "none"
           php-version: "${{ matrix.php-version }}"

diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
@@ -10,8 +10,13 @@ on:
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   actionlint:
+    name: Actionlint
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -20,11 +25,18 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Check workflow files
         run: |
           echo "::add-matcher::.github/actionlint-matcher.json"
-          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+          curl -fsSL -o actionlint.tar.gz "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          echo "${ACTIONLINT_SHA256}  actionlint.tar.gz" | sha256sum --check --strict
+          tar -xzf actionlint.tar.gz actionlint
           ./actionlint -color
+        env:
+          ACTIONLINT_VERSION: "1.7.12"
+          ACTIONLINT_SHA256: "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8"
         shell: bash
 
   octoscan:
@@ -40,6 +52,8 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Run octoscan
         id: octoscan
         uses: synacktiv/action-octoscan@6b1cf2343893dfb9e5f75652388bd2dc83f456b0 # v1.0.0

diff --git a/.github/workflows/lock-closed-issues.yml b/.github/workflows/lock-closed-issues.yml
@@ -4,11 +4,15 @@ on:
   schedule:
     - cron: '13 0 * * *'
 
-permissions:
-  contents: read
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
 
 jobs:
   lock:
+    name: Lock closed issues
     permissions:
       issues: write  # for dessant/lock-threads to lock issues
     runs-on: ubuntu-latest

diff --git a/.github/workflows/release-toot.yml b/.github/workflows/release-toot.yml
@@ -6,9 +6,17 @@ on:
   release:
     types: [published]
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.release.tag_name }}
+  cancel-in-progress: true
+
 jobs:
   toot:
+    name: Toot
     runs-on: ubuntu-latest
+    environment: release
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3

diff --git a/.github/workflows/release-tweet.yml b/.github/workflows/release-tweet.yml
@@ -6,9 +6,17 @@ on:
   release:
     types: [published]
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.release.tag_name }}
+  cancel-in-progress: true
+
 jobs:
   tweet:
+    name: Tweet
     runs-on: ubuntu-latest
+    environment: release
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -7,10 +7,19 @@ on:
     tags:
       - '*'
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   deploy:
     name: "Deploy"
     runs-on: "ubuntu-latest"
+    environment: release
+    permissions:
+      contents: read
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -20,6 +29,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Generate changelog
         id: changelog
@@ -28,9 +39,8 @@ jobs:
           myToken: ${{ secrets.PHPSTAN_BOT_TOKEN }}
 
       - name: "Create release"
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
-        with:
-          token: ${{ secrets.PHPSTAN_BOT_TOKEN }}
-          tag_name: ${{ github.ref_name }}
-          name: ${{ github.ref_name }}
-          body: ${{ steps.changelog.outputs.changelog }}
+        run: gh release create "$TAG_NAME" --repo "$GITHUB_REPOSITORY" --verify-tag --title "$TAG_NAME" --notes "$RELEASE_NOTES"
+        env:
+          GH_TOKEN: ${{ secrets.PHPSTAN_BOT_TOKEN }}
+          TAG_NAME: ${{ github.ref_name }}
+          RELEASE_NOTES: ${{ steps.changelog.outputs.changelog }}