Skip to content
Draft
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions .github/workflows/pull_request.yml
Original file line number Diff line number Diff line change
Expand Up @@ -31,3 +31,21 @@
- name: Setup tmate session
if: ${{ github.event.inputs.tmate_enabled == 1 }}
uses: mxschmitt/action-tmate@v3

tests:
name: Unit tests
runs-on: ubuntu-latest
strategy:
matrix:
php-version: [8.2, 8.3, 8.4]
steps:
- name: Checkout
uses: actions/checkout@v5
- name: Setup PHP
uses: shivammathur/setup-php@v2

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Pull Request' step
Uses Step
uses 'shivammathur/setup-php' with ref 'v2', not a pinned commit hash
with:
php-version: ${{ matrix.php-version }}
- name: Composer install
run: composer install
- name: Run tests
run: composer run-script code:test
Comment on lines +36 to +51

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 17 days ago

To address the problem, you should add a permissions block at the root level of the workflow file (.github/workflows/pull_request.yml). The block should grant only the minimal access required for the jobs within this workflow. Looking at the workflow, both job sections (linting, tests) only interact with the source code, they do not push commits, create comments, or open/close PRs, so the only permission strictly required is contents: read. The permissions block must be inserted after the name and before on, or at least before the jobs key, as per GitHub Actions YAML structure recommendations.

No additional methods, imports, or changes are necessary apart from adding this permissions block.


Suggested changeset 1
.github/workflows/pull_request.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -1,4 +1,6 @@
 name: Pull Request
+permissions:
+  contents: read
 on:
   pull_request:
     branches:
EOF
@@ -1,4 +1,6 @@
name: Pull Request
permissions:
contents: read
on:
pull_request:
branches:
Copilot is powered by AI and may make mistakes. Always verify output.
6 changes: 5 additions & 1 deletion composer.json
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,8 @@
},
"require-dev": {
"drupal/coder": "^8.3",
"squizlabs/php_codesniffer": "^3.4"
"squizlabs/php_codesniffer": "^3.4",
"phpunit/phpunit": "^12.4"
},
"scripts": {
"codesniff": [
Expand All @@ -39,6 +40,9 @@
"vendor/bin/phpcbf . --ignore=vendor src"
],
"code:lint": "find src -name '*.php' -print0 | xargs -0 -n1 php -l",
"code:test" : [
"vendor/bin/phpunit -c ./phpunit.xml"
],
"pre-commit": [
"composer validate --strict",
"@codesniff",
Expand Down
12 changes: 12 additions & 0 deletions phpunit.xml
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
<phpunit
beStrictAboutTestsThatDoNotTestAnything="true"
beStrictAboutOutputDuringTests="true"
beStrictAboutChangesToGlobalState="true"
failOnWarning="true"
cacheResult="false">
<testsuites>
<testsuite name="unit">
<directory>./tests/src/</directory>
</testsuite>
</testsuites>
</phpunit>
Loading