Organization-wide workflows #15

Activity

1. phpstan-bot commented on Feb 19, 2026

   

   phpstan-bot

   on Feb 19, 2026

   Last edited by phpstan-bot

   Contributor

   More actions

   Claude finished @ondrejmirtes's task in 1m 31s —— View job • claude/issue-15-20260219-2134 • Create PR ➔

   ---

   Updated workflow references from #2 to #15

   • Gather context and understand repository structure
   • Update react-on-comment workflow to ignore Organization-wide workflows #15 instead of Organization-wide workflows #2
   • Update org-wide workflow to react on Organization-wide workflows #15 instead of Organization-wide workflows #2
   • Commit and push changes
   • Provide PR link

   Changes made

   • claude-react-on-comment.yml: Changed github.event.issue.number != 2 → != 15 — the react-on-comment workflow now skips this issue (Organization-wide workflows #15) instead of Organization-wide workflows #2
   • claude-org-wide.yml: Changed github.event.issue.number == 2 → == 15 — the org-wide workflow now triggers only on comments on this issue (Organization-wide workflows #15)
   • claude-org-wide.yml: Changed post-comment target from issues/2/comments → issues/15/comments — PR link summaries will be posted to this issue
2. ondrejmirtes

   pinned this issue on Feb 19, 2026
3. phpstan-bot

   added a commit that references this issue on Feb 19, 2026

   Update workflow references from issue #2 to issue #15

   ...

   c0f4445
4. ondrejmirtes

   added a commit that references this issue on Feb 19, 2026

   Update workflow references from issue #2 to issue #15

   ...

   568f690
5. ondrejmirtes commented on Feb 24, 2026

   

   ondrejmirtes

   on Feb 24, 2026

   MemberAuthor

   More actions

   @phpstan-bot Please introduce these files to the repository:

   .github/actionlint-matcher.json:

   {
     "problemMatcher": [
       {
         "owner": "actionlint",
         "pattern": [
           {
             "regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
             "file": 1,
             "line": 2,
             "column": 3,
             "message": 4,
             "code": 5
           }
         ]
       }
     ]
   }
   
   

   .github/actionlint.yaml:

   self-hosted-runner:
     # Labels of self-hosted runner in array of strings.
     labels: []
   
   # Configuration variables in array of strings defined in your repository or
   # organization. `null` means disabling configuration variables check.
   # Empty array means no configuration variable is allowed.
   config-variables: null
   
   # Configuration for file paths. The keys are glob patterns to match to file
   # paths relative to the repository root. The values are the configurations for
   # the file paths. Note that the path separator is always '/'.
   # The following configurations are available.
   #
   # "ignore" is an array of regular expression patterns. Matched error messages
   # are ignored. This is similar to the "-ignore" command line option.
   paths:
     .github/workflows/**/*.{yml,yaml}:
       # List of regular expressions to filter errors by the error messages.
       ignore:
         # Ignore the specific error from shellcheck
         - 'shellcheck reported issue in this script: SC2129:.+'
   
   

   .github/workflows/lint-workflows.yml:

   # Configuration from:
   # https://github.com/johnbillion/plugin-infrastructure/blob/571cba96190304963285181e2b928d941b9ec7c4/.github/workflows/reusable-workflow-lint.yml
   
   name: Lint GitHub Actions workflows
   on:
     pull_request:
     push:
       branches:
         - "main"
   
   permissions: {}
   
   jobs:
     actionlint:
       runs-on: ubuntu-latest
       steps:
         - name: Harden the runner (Audit all outbound calls)
           uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
           with:
             egress-policy: audit
   
         - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         - name: Check workflow files
           run: |
             echo "::add-matcher::.github/actionlint-matcher.json"
             bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
             ./actionlint -color
           shell: bash
   
     octoscan:
       name: Octoscan
       runs-on: ubuntu-latest
       permissions:
         security-events: write # Required for codeql-action/upload-sarif to upload SARIF files.
       timeout-minutes: 10
       steps:
         - name: Harden the runner (Audit all outbound calls)
           uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
           with:
             egress-policy: audit
   
         - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         - name: Run octoscan
           id: octoscan
           uses: synacktiv/action-octoscan@6b1cf2343893dfb9e5f75652388bd2dc83f456b0 # v1.0.0
           with:
             filter_triggers: ''
   
         - name: Upload SARIF file to GitHub
           uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
           with:
             sarif_file: "${{steps.octoscan.outputs.sarif_output}}"
             category: octoscan
             wait-for-processing: false
   
     poutine:
       name: Poutine
       runs-on: ubuntu-latest
       permissions:
         security-events: write # Required for codeql-action/upload-sarif to upload SARIF files.
       steps:
         - name: Harden the runner (Audit all outbound calls)
           uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
           with:
             egress-policy: audit
   
         - name: Checkout repository
           uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
           with:
             persist-credentials: false
   
         - name: Run Poutine
           uses: boostsecurityio/poutine-action@84c0a0d32e8d57ae12651222be1eb15351429228 # v0.15.2
   
         - name: Upload poutine SARIF file
           uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
           with:
             sarif_file: results.sarif
             category: poutine
             wait-for-processing: false
   
     zizmor:
       name: Zizmor
       runs-on: ubuntu-latest
       permissions:
         security-events: write # Required for codeql-action/upload-sarif to upload SARIF files.
       steps:
         - name: Harden the runner (Audit all outbound calls)
           uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
           with:
             egress-policy: audit
   
         - name: Checkout repository
           uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
           with:
             persist-credentials: false
   
         - name: Install the latest version of uv
           uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
           with:
             enable-cache: false
   
         - name: Run zizmor
           run: uvx zizmor@1.20.0 --persona=auditor --format=sarif --strict-collection . > results.sarif
           env:
             GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   
         - name: Upload SARIF file
           uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
           with:
             sarif_file: results.sarif
             category: zizmor
             wait-for-processing: false