ci: harden security-core-gates against resource kills

Author: c15k0

.github/workflows/security-pipeline.yml

@@ -13,6 +13,10 @@ env:
 jobs:
   security-core-gates:
     runs-on: ubuntu-latest
+    env:
+      DEBUG: ""
+      XDEBUG_MODE: off
+      COMPOSER_MEMORY_LIMIT: -1
 
     steps:
       - name: Checkout
@@ -24,30 +28,30 @@ jobs:
       - name: Install dependencies
         run: |
           PHP_CONTAINER="$(docker compose ps -q php)"
-          docker exec "$PHP_CONTAINER" composer install --no-interaction --prefer-dist
+          docker exec -e COMPOSER_MEMORY_LIMIT=-1 "$PHP_CONTAINER" composer install --no-interaction --prefer-dist
 
       - name: Run must-pass security tests
         run: |
           PHP_CONTAINER="$(docker compose ps -q php)"
-          docker exec "$PHP_CONTAINER" php vendor/bin/phpunit --colors=never --no-coverage --do-not-fail-on-warning --do-not-fail-on-risky --filter '/^.*AuthApiTest::testResolveApiTokenPrecedenceHeaderCookieAndQuery$/'
-          docker exec "$PHP_CONTAINER" php vendor/bin/phpunit --colors=never --no-coverage --do-not-fail-on-warning --do-not-fail-on-risky --filter '/^.*AuthApiTest::testResolveApiTokenRejectsMalformedHeaderTokenAndFallsBackToCookie$/'
-          docker exec "$PHP_CONTAINER" php vendor/bin/phpunit --colors=never --no-coverage --do-not-fail-on-warning --do-not-fail-on-risky --filter '/^.*RequestResponseSecurityContractTest::testCookiePayloadMatrixAndSecurityInterplay$/'
-          docker exec "$PHP_CONTAINER" php vendor/bin/phpunit --colors=never --no-coverage --do-not-fail-on-warning --do-not-fail-on-risky --filter '/^.*RequestResponseSecurityContractTest::testCheckCorsSetsHeadersForAllowedOriginOnGet$/'
+          docker exec -e XDEBUG_MODE=off "$PHP_CONTAINER" php vendor/bin/phpunit --colors=never --no-coverage --do-not-fail-on-warning --do-not-fail-on-risky --filter '/^.*AuthApiTest::testResolveApiTokenPrecedenceHeaderCookieAndQuery$/'
+          docker exec -e XDEBUG_MODE=off "$PHP_CONTAINER" php vendor/bin/phpunit --colors=never --no-coverage --do-not-fail-on-warning --do-not-fail-on-risky --filter '/^.*AuthApiTest::testResolveApiTokenRejectsMalformedHeaderTokenAndFallsBackToCookie$/'
+          docker exec -e XDEBUG_MODE=off "$PHP_CONTAINER" php vendor/bin/phpunit --colors=never --no-coverage --do-not-fail-on-warning --do-not-fail-on-risky --filter '/^.*RequestResponseSecurityContractTest::testCookiePayloadMatrixAndSecurityInterplay$/'
+          docker exec -e XDEBUG_MODE=off "$PHP_CONTAINER" php vendor/bin/phpunit --colors=never --no-coverage --do-not-fail-on-warning --do-not-fail-on-risky --filter '/^.*RequestResponseSecurityContractTest::testCheckCorsSetsHeadersForAllowedOriginOnGet$/'
 
       - name: Run dependency audit (SCA)
         run: |
           PHP_CONTAINER="$(docker compose ps -q php)"
-          docker exec "$PHP_CONTAINER" composer audit --no-interaction
+          docker exec -e COMPOSER_MEMORY_LIMIT=-1 "$PHP_CONTAINER" composer audit --no-interaction
 
       - name: Enforce hardening gate (P2)
         run: |
           PHP_CONTAINER="$(docker compose ps -q php)"
-          docker exec -e PSFS_SECURITY_STRICT=1 "$PHP_CONTAINER" php scripts/security/hardening_gate.php
+          docker exec -e PSFS_SECURITY_STRICT=1 -e XDEBUG_MODE=off "$PHP_CONTAINER" php scripts/security/hardening_gate.php
 
       - name: Enforce quality gate
         run: |
           PHP_CONTAINER="$(docker compose ps -q php)"
-          docker exec "$PHP_CONTAINER" php scripts/security/quality_gate.php
+          docker exec -e XDEBUG_MODE=off "$PHP_CONTAINER" php scripts/security/quality_gate.php
 
       - name: Upload quality gate report
         if: always()