CI: consolidated workflow fixes (php-cs-fixer pwn-request, dead static-analysis reference, trigger hygiene) - #121
Merged
berfinyuksel merged 2 commits intoAug 26, 2026
Conversation
…t_target The inline php-cs-fixer workflow ran under pull_request_target with contents: write while checking out fork-controlled content, and php-cs-fixer executes .php-cs-fixer.dist.php, which is itself fork-controlled PHP. That combination allows an outside contributor's PR to influence what runs with a write-capable token. Replace it with the reusable caller already used on 5.2 and 6.1, which is push-only and never checks out fork content. File content is byte-identical to 6.1 so the forward merge is clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
reusable-static-analysis-centralized.yaml was retired in workflows-collection-public on 2025-12-09 (8007db80), so every run of this workflow since then has start-failed with zero jobs. Replace the caller with the unified pattern proven green on advanced-object-search 7.x, adapted only in paths-ignore (doc, public assets, markdown). Also scopes push to version branches and adds a concurrency group with cancel-in-progress, so PR-branch pushes no longer double-run and superseded runs are cancelled. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
berfinyuksel
deleted the
security/php-cs-fixer-drop-pull-request-target
branch
August 26, 2026 11:25
berfinyuksel
added
the
Skip Milestone Check
berfinyuksel
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidated per-repo CI fixes for
6.0. Refs pimcore/service-operations#1083, pimcore/DevOps-Tasks#47, pimcore/DevOps-Tasks#44.1. php-cs-fixer: remove pwn-request pattern —
pull_request_target+ fork checkout + fork-controlled.php-cs-fixer.dist.php+contents: write+ auto-commit, replaced by the push-only reusable caller already on5.2/6.1(byte-identical to6.1). Same as pimcore/tinymce-bundle#34.2. Static analysis: dead reference repointed — the caller referenced
reusable-static-analysis-centralized.yaml, retired 2025-12-09, so every run start-failed with zero jobs. Repointed to the unified pattern; this PR ran the repo's first passing PHPStan legs since December (8.3/lowest, 8.4/highest).3. Trigger hygiene (#44 ideas 1–3) — push scoped to version branches, concurrency + cancel-in-progress, paths-ignore doc/assets/markdown.
Post-merge verification: php-cs-fixer fired on push to 6.0 and passed, no PR-triggered run; upstream merge 6.0→6.1 pushed directly (dfa479d), php-cs-fixer diff empty as predicted.