chore(deps): update konradmichalik/reusable-github-actions action to v0.1.0 - autoclosed

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
konradmichalik/reusable-github-actions	workflow	minor	0.0.1 → 0.1.0

---

Release Notes

konradmichalik/reusable-github-actions (konradmichalik/reusable-github-actions)

v0.1.0: — first real release

Compare Source

The first real release. 0.0.1 was a freeze marker with no functional change; everything below landed behind it, so no consumer has seen any of it yet.

Every consumer is currently pinned to 0.0.1. Bumping is deliberate and one repository at a time — this list is what to check before you do.

Consumer-visible behaviour changes

Read these before bumping. Everything else in this release is invisible from the outside.

Runs are now capped in time

Every job previously used the GitHub default of 360 minutes. Jobs now cap at 10–25 minutes depending on kind. A job that legitimately takes longer than its cap will now be killed rather than hanging — if any of your test suites run long, check them first.

Superseded runs are cancelled for CGL and Security

cgl.yml, cgl-test.yml and security.yml now cancel their own in-flight runs when a newer commit arrives on the same ref. Release and Scorecard deliberately do not cancel. The three test workflows manage no concurrency at all — that stays yours to set, and is the one place you should.

Coveralls became opt-out, and skips fork pull requests

The upload used to run unconditionally, so repositories not registered on Coveralls got a failing job. It now has a coveralls input, defaulting to true — unchanged for the 22 repositories that use it. If yours is not on Coveralls, set coveralls: false.

It is also skipped on pull requests from forks, where the upload cannot succeed and its failure used to mark an otherwise fine contribution red.

CodeClimate reporting removed

The step is gone. It had never actually run — the secret guarding it was never declared in the reusable workflows, so it never reached them — and it could not run today regardless: Code Climate's coverage API was shut down on 2025-07-18 and the product moved to Qlty. If you set CC_TEST_REPORTER_ID on a repository, it is inert and can be deleted.

Coverage path rewriting removed, and the directory is now an input

The Fix coverage path step rewrote a path that never appeared in the report — verified against a real clover.xml, which contains /home/runner/work/<repo>/<repo>, already exactly github.workspace. Both copies were no-ops and are gone.

The coverage directory is now the coverage-dir input, defaulting to today's value per workflow: .build/coverage for tests-php.yml, .Build/coverage for tests-typo3.yml. Only set it if your test:coverage script writes somewhere else.

Scorecard never publishes from a private repository

publish_results was hardcoded true, which fails on a private repository and would be a disclosure if it did not. Visibility now decides, and a new publish-results input can narrow it further for a public repository that wants scoring without the badge. Scoring and the SARIF upload are unaffected.

This fixes a weekly failure that had been red for over a month.

Release tags are validated properly

The tag check used unescaped dots, so 1x2x3 and 1-2-3 passed and got released. Both release workflows now validate identically against github.ref_name:

N.N.N   each part 1 to 3 digits

v1.2.3, 1.2, 1.2.3-rc1 and 1.0.1000 are rejected, with an annotation naming the tag instead of a bare exit 1. No existing tag has the offending shape, so nothing breaks retroactively — this only affects tags created from here on.

tests.yml is deprecated

Superseded by tests-typo3.yml, removal planned for 0.3.0. Runs now emit a warning annotation and a job-summary notice. Migration is a one-line change of the uses: path: the input blocks and the job names are identical, so composed check-run names do not change and branch protection rules keep matching.

Checkouts no longer persist git credentials

All 22 checkouts now set persist-credentials: false. Every git call inside these workflows is local, so nothing here needed it. The one thing that could bite: if your composer.json has a "type": "vcs" repository pointing at a private GitHub repository, composer install used to succeed on the persisted credential and will now fail. One consumer has such an entry and its target is public, so nothing is currently affected.

Security

• Template injection closed. Every ${{ }} expression that reached a run: block in the two release workflows now goes through env: and is referenced as a quoted shell variable. A tag name containing shell metacharacters was executable code; quoting in place did not help, because substitution happens before the shell parses the line.
• All third-party actions pinned to full commit SHAs, with a check-action-pins job that fails the build if any regresses to a floating tag.
• Least-privilege permissions. Every workflow starts from permissions: {} and each job declares exactly what it needs. Effective permissions are unchanged — no job lost a scope it was using.

New inputs

Workflow	Input	Default
tests-php.yml	coverage-dir	.build/coverage
tests-php.yml	coveralls	true
tests-typo3.yml	coverage-dir	.Build/coverage
tests-typo3.yml	coveralls	true
scorecard.yml	publish-results	true, ignored on private repositories

All optional; leaving them unset keeps today's behaviour.

Bumping

Pin by full commit SHA with the version as a trailing comment, which is what Renovate reads:

uses: konradmichalik/reusable-github-actions/.github/workflows/cgl.yml@<sha> # 0.1.0

No Renovate configuration is needed — the github-actions manager handles job-level reusable-workflow references and rewrites the SHA and the comment together. The version must start the comment: # 0.1.0 is read, # pinned to 0.1.0 is not.

See docs/stability.md for the full policy and docs/inventory.md for who references what.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: c0c00ab0-21b4-4319-a942-c87f4b804079

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}