chore(main): release 0.2.4 #14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: security-scan | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| psalm: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: '8.4' | |
| tools: composer | |
| - run: composer install --no-interaction --no-progress | |
| # continue-on-error so a failing scan doesn't skip the SARIF upload below - | |
| # findings should reach the Security tab even when they fail the job. | |
| - name: Run Psalm taint analysis | |
| id: psalm | |
| run: vendor/bin/psalm --taint-analysis --no-progress --report=psalm-results.sarif | |
| continue-on-error: true | |
| # continue-on-error too: GITHUB_TOKEN is forced read-only on pull_request | |
| # runs triggered from forks, regardless of the security-events: write | |
| # permission declared above, so this step fails on every fork PR | |
| # (this repo has external contributors - see PR #5) for a reason | |
| # unrelated to Psalm's actual findings. Without this, that failure | |
| # would be indistinguishable from a real security finding. | |
| - name: Upload results to code scanning | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: psalm-results.sarif | |
| continue-on-error: true | |
| - name: Fail the job if Psalm found issues | |
| if: steps.psalm.outcome == 'failure' | |
| run: exit 1 |