fix(ci): stabilize Scrutinizer and pin actions

Author: c15k0

.github/workflows/security-pipeline.yml

@@ -16,10 +16,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup PHP 8.3 (no Docker)
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.3'
           coverage: none
@@ -53,15 +53,15 @@ jobs:
 
       - name: Upload quality gate report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: security-quality-gate
           path: security/reports/quality-gate.json
           if-no-files-found: ignore
 
       - name: Upload hardening gate report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: security-hardening-gate
           path: security/reports/hardening-gate.json
@@ -72,7 +72,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Run Semgrep (SAST)
         run: |
@@ -91,7 +91,7 @@ jobs:
 
       - name: Upload Gitleaks report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: security-gitleaks
           path: security/reports/gitleaks-report.json
@@ -105,15 +105,15 @@ jobs:
 
       - name: Upload Semgrep SARIF
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: security-semgrep
           path: security/reports/semgrep.sarif
           if-no-files-found: ignore
 
       - name: Upload SBOM
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: security-sbom
           path: security/reports/sbom.cyclonedx.json

.github/workflows/snyk-security.yml

@@ -10,7 +10,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Install Snyk CLI
         run: npm install -g snyk
@@ -21,6 +21,6 @@ jobs:
         run: snyk code test --sarif > snyk-code.sarif || true
 
       - name: Upload SARIF to GitHub Security
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9
         with:
-          sarif_file: snyk-code.sarif
+          sarif_file: snyk-code.sarif

.scrutinizer.yml

@@ -30,9 +30,12 @@ build:
       ini:
         memory_limit: "-1"
 
-        # PHPUnit runs tests in separate processes; Xdebug keeps coverage
-        # available across those process boundaries.
-        xdebug.mode: "coverage"
+        # PCOV keeps the full suite below Scrutinizer's command timeout.
+        # The few process-isolated tests may not contribute coverage, but the
+        # suite remains executable and the coverage report stays valid.
+        pcov.enabled: "1"
+        pcov.directory: "src"
+        xdebug.mode: "off"
         opcache.enable_cli: "0"
         opcache.jit: "0"
         opcache.jit_buffer_size: "0"
@@ -72,6 +75,8 @@ build:
 
       dependencies:
         override:
+          - pecl install pcov
+
           # ⚡ Optimized composer
           - composer install -o --no-interaction --no-progress --prefer-dist --classmap-authoritative
 
@@ -100,13 +105,13 @@ build:
         stop_on_failure: true
         override:
           - command: >
-              XDEBUG_MODE=coverage
+              php -d pcov.enabled=1
+              -d pcov.directory=src
               vendor/bin/phpunit
               --configuration phpunit.xml.dist
               --colors=never
               --stop-on-error
               --stop-on-failure
-              --debug
               --coverage-clover cache/coverage/coverage.xml
             idle_timeout: 1200
             coverage: