Pin GitHub Actions to commit SHAs

[stixx]

Follows #42, which turned on Dependabot's github-actions updates. This removes the remaining exposure those updates cannot address.

Why

Actions were referenced by floating major tags:

actions/checkout@v7
shivammathur/setup-php@v2
actions/cache@v6

A tag is mutable. Whoever controls the action repository — or anyone who compromises it — can repoint v7 at a different commit, and CI will run that code with the repository's credentials on the next build. That is the mechanism behind the 2025 tj-actions/changed-files compromise, where a moved tag exfiltrated secrets from every workflow using it. Dependabot version updates do not help: they keep the tag current, but the tag is the thing that moves.

Pinning to a commit SHA means the workflow runs the exact tree that was reviewed.

What changed

actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240  # 2.37.2
actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0

Same versions currently in use — no upgrade is bundled in here.

The trailing comment is not decoration: Dependabot reads it to know the current release, and updates the SHA and the comment together. So this keeps working with the config added in #42, and updates arrive as reviewable diffs showing both the old and new commit.

Verification

Each pinned SHA was resolved back through the GitHub API and confirmed to be the commit its tag points at. That check caught one error before it shipped: shivammathur/setup-php tags without a v prefix, so the comment reads 2.37.2, not v2.37.2. A wrong comment would have left Dependabot unable to track the version.

[coderabbitai]

Warning

Review limit reached

Next included review available in 4 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: db6024ce-82ae-4c82-87bf-eaa95ff150e9

📥 Commits

Reviewing files that changed from the base of the PR and between ace7595 and b35c159.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[stixx]

Closing: SHA-pinning is not the convention in this ecosystem. Nelmio, maker-bundle and DoctrineBundle all use floating tags; api-platform/core is the outlier that pins.

The tj-actions reasoning holds in general, but it matters most where CI holds credentials worth stealing. This repository's CI has no deploy keys or publish tokens — Packagist releases run off a webhook — so the exposure is smaller than the generic argument assumes, and it is not worth diverging from what the surrounding ecosystem does.

Dependabot's github-actions updates from #42 stay in place and keep the tags current.