Harden GitHub Actions workflows per zizmor, poutine and octoscan

.github/actions/downgrade-code/action.yml

@@ -18,9 +18,11 @@ runs:
     - name: "Transform source code"
       if: inputs.php-version == '7.4' || inputs.php-version == '8.0' || inputs.php-version == '8.1'
       shell: bash
+      env:
+        TARGET_PHP_VERSION: ${{ inputs.php-version }}
       run: |
         composer install --no-interaction --no-progress --working-dir=compiler
-        ./compiler/vendor/bin/simple-downgrade downgrade -c build/downgrade.php ${{ inputs.php-version }}
+        ./compiler/vendor/bin/simple-downgrade downgrade -c build/downgrade.php "$TARGET_PHP_VERSION"
         composer dump
 
     - name: "Re-store PHP version"

.github/poutine.yml

@@ -0,0 +1,34 @@
+# https://github.com/boostsecurityio/poutine/blob/main/.poutine.sample.yml
+
+rulesConfig:
+  pr_runs_on_self_hosted:
+    allowed_runners:
+      # GitHub-hosted arm64 runner, not a self-hosted one
+      - ubuntu-24.04-arm
+
+skip:
+  # Third-party actions in use, each pinned to a full commit SHA and reviewed
+  # whenever the pin is bumped. A newly added action still gets reported.
+  - rule: github_action_from_unverified_creator_used
+    purl:
+      - pkg:githubactions/astral-sh/setup-uv
+      - pkg:githubactions/baptiste0928/cargo-install
+      - pkg:githubactions/crate-ci/typos
+      - pkg:githubactions/crazy-max/ghaction-import-gpg
+      - pkg:githubactions/dorny/paths-filter
+      - pkg:githubactions/ilammy/msvc-dev-cmd
+      - pkg:githubactions/juliangruber/merge-pull-request-action
+      - pkg:githubactions/morishiri/block-merge-commits-action
+      - pkg:githubactions/peter-evans/create-or-update-comment
+      - pkg:githubactions/peter-evans/create-pull-request
+      - pkg:githubactions/peter-evans/repository-dispatch
+      - pkg:githubactions/ramsey/composer-install
+      - pkg:githubactions/rickstaa/action-create-tag
+      - pkg:githubactions/scholliyt/broken-links-crawler-action
+      - pkg:githubactions/shivammathur/setup-php
+      - pkg:githubactions/stefanzweifel/git-auto-commit-action
+      - pkg:githubactions/synacktiv/action-octoscan
+      - pkg:githubactions/typeddevs/bashunit
+      - pkg:githubactions/wyrihaximus/github-action-get-previous-tag
+      - pkg:githubactions/wyrihaximus/github-action-next-semvers
+      - pkg:githubactions/wyrihaximus/github-action-wait-for-status

.github/workflows/apiref-infra.yml

@@ -15,7 +15,11 @@ on:
       - '.github/workflows/apiref-infra.yml'
       - 'apigen/infra/**'
 
-concurrency: apiref-infra
+# deploys queue up instead of cancelling one another, so a CDK deployment is never interrupted
+concurrency: apiref-infra # zizmor: ignore[concurrency-limits]
+
+permissions:
+  contents: read
 
 jobs:
   test:
@@ -32,6 +36,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install Node"
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
@@ -62,7 +68,7 @@ jobs:
     needs: test
     if: "github.event_name == 'push' && github.ref == 'refs/heads/2.3.x'"
     permissions:
-      id-token: write
+      id-token: write # assumes the deploy role in AWS through OIDC
       contents: read
 
     steps:
@@ -73,6 +79,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install Node"
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0

.github/workflows/apiref.yml

@@ -21,6 +21,9 @@ concurrency:
   group: apigen-${{ github.ref }} # will be canceled on subsequent pushes in branch
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   apigen:
     name: "Run ApiGen"
@@ -36,6 +39,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -66,7 +71,7 @@ jobs:
     if: github.repository_owner == 'phpstan'
     runs-on: "ubuntu-latest"
     permissions:
-      id-token: write
+      id-token: write # assumes the deploy role in AWS through OIDC
       contents: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -87,16 +92,20 @@ jobs:
           aws-region: us-east-1
 
       - name: "Sync with S3"
+        env:
+          APIREF_BUCKET: ${{ vars.APIREF_BUCKET }}
         run: |
-          aws s3 sync ./docs "s3://${{ vars.APIREF_BUCKET }}/${{ github.ref_name }}" \
+          aws s3 sync ./docs "s3://${APIREF_BUCKET}/${GITHUB_REF_NAME}" \
             --exclude '.git*/*' \
             --follow-symlinks
 
       - name: "Invalidate CloudFront"
+        env:
+          APIREF_DISTRIBUTION_ID: ${{ vars.APIREF_DISTRIBUTION_ID }}
         run: |
           aws cloudfront create-invalidation \
-            --distribution-id "${{ vars.APIREF_DISTRIBUTION_ID }}" \
-            --paths "/${{ github.ref_name }}/*"
+            --distribution-id "${APIREF_DISTRIBUTION_ID}" \
+            --paths "/${GITHUB_REF_NAME}/*"
 
       - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:

.github/workflows/backward-compatibility.yml

@@ -34,6 +34,7 @@ jobs:
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: "Install PHP"

.github/workflows/bench.yml

@@ -35,6 +35,8 @@ jobs:
 
       - name: "Checkout base branch"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -73,6 +75,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0

.github/workflows/block-merge-commits.yml

@@ -2,6 +2,13 @@ on: pull_request
 
 name: Block merge commits
 
+concurrency:
+  group: block-merge-commits-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  pull-requests: read # Block Merge Commits lists the pull request's commits
+
 jobs:
   message-check:
     name: Block Merge Commits

.github/workflows/build-issue-bot.yml

@@ -43,6 +43,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -59,4 +61,6 @@ jobs:
 
       - name: "Tests"
         working-directory: "issue-bot"
-        run: ${{ matrix.script }}
+        env:
+          MATRIX_SCRIPT: ${{ matrix.script }}
+        run: '"$MATRIX_SCRIPT"'

.github/workflows/changelog-generator.yml

@@ -36,6 +36,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0

.github/workflows/claude-react-on-review-dispatch.yml

@@ -1,17 +1,20 @@
 name: "Claude React On Review Dispatch"
 
-on:
-  workflow_run:
+on: # zizmor: ignore[concurrency-limits] -- one run per submitted review, none supersedes another
+  workflow_run: # zizmor: ignore[dangerous-triggers] -- runs no code from the pull request, only forwards the review's numeric IDs as quoted gh arguments
     workflows: ["Claude React On Review"]
     types: [completed]
 
+permissions:
+  contents: read
+
 jobs:
   dispatch:
+    name: dispatch
     runs-on: ubuntu-latest
     if: github.event.workflow_run.conclusion == 'success'
     permissions:
-      contents: read
-      actions: write
+      actions: read # downloads the review-context artifact of the triggering run
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3

.github/workflows/claude-react-on-review.yml

@@ -1,11 +1,15 @@
 name: "Claude React On Review"
 
-on:
+on: # zizmor: ignore[concurrency-limits] -- every submitted review is handed to the dispatch workflow; a newer review does not supersede an older one
   pull_request_review:
     types: [submitted]
 
+# The artifact upload authenticates with the runner's own token, not the workflow token.
+permissions: {}
+
 jobs:
   save-context:
+    name: save-context
     runs-on: ubuntu-latest
     if: >
       github.event.pull_request.user.login == 'phpstan-bot'
@@ -19,9 +23,12 @@ jobs:
           egress-policy: audit
 
       - name: Save review context
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REVIEW_ID: ${{ github.event.review.id }}
         run: |
-          echo "${{ github.event.pull_request.number }}" > pr_number.txt
-          echo "${{ github.event.review.id }}" > review_id.txt
+          echo "$PR_NUMBER" > pr_number.txt
+          echo "$REVIEW_ID" > review_id.txt
 
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:

.github/workflows/claude-update-config-parameters-docs-on-change.yml

@@ -8,12 +8,18 @@ on:
       - '.github/workflows/claude-update-config-parameters-docs-on-change.yml'
       - 'conf/parametersSchema.neon'
 
+# The job only dispatches a workflow in phpstan-bot/phpstan-src with
+# PHPSTAN_BOT_TOKEN; it does not use the workflow token.
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
 jobs:
   fix:
+    name: "Update Config Parameters Docs"
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      actions: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3

.github/workflows/claude-update-phpdoc-tags-docs-on-change.yml

@@ -8,12 +8,18 @@ on:
       - '.github/workflows/claude-update-phpdoc-tags-docs-on-change.yml'
       - 'src/PhpDoc/PhpDocNodeResolver.php'
 
+# The job only dispatches a workflow in phpstan-bot/phpstan-src with
+# PHPSTAN_BOT_TOKEN; it does not use the workflow token.
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
 jobs:
   fix:
+    name: "Update PHPDoc Tags Docs"
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      actions: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3

.github/workflows/claude-update-phpdoc-types-docs-on-change.yml

@@ -8,12 +8,18 @@ on:
       - '.github/workflows/claude-update-phpdoc-types-docs-on-change.yml'
       - 'src/PhpDoc/TypeNodeResolver.php'
 
+# The job only dispatches a workflow in phpstan-bot/phpstan-src with
+# PHPSTAN_BOT_TOKEN; it does not use the workflow token.
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
 jobs:
   fix:
+    name: "Update PHPDoc Types Docs"
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      actions: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3

.github/workflows/close-issues-on-merge.yml

@@ -3,12 +3,16 @@
 name: Close issues from merged PRs
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] -- runs no code from the pull request (no checkout), only reads its body and closes issues with PHPSTAN_BOT_TOKEN
     branches:
       - "2.2.x"
     types:
       - closed
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -26,8 +30,10 @@ jobs:
       - name: "Find and close linked issues"
         env:
           GH_TOKEN: ${{ secrets.PHPSTAN_BOT_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
         run: |
-          PR_BODY=$(gh pr view ${{ github.event.pull_request.number }} --repo "${{ github.repository }}" --json body --jq '.body')
+          PR_BODY=$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --json body --jq '.body')
 
           # Parse "Closes/Fixes https://github.com/phpstan/phpstan/issues/123" and "Closes/Fixes phpstan/phpstan#123" patterns
           NUMBERS=$(echo "$PR_BODY" | grep -oiP '(?:closes?|fix(?:es)?)\s+(?:https://github\.com/phpstan/phpstan/issues/|phpstan/phpstan#)[0-9]+' | grep -oP '[0-9]+$' || true)
@@ -40,5 +46,5 @@ jobs:
 
           echo "$NUMBERS" | while read -r NUMBER; do
             echo "Closing phpstan/phpstan#${NUMBER}"
-            gh issue close "$NUMBER" --repo "phpstan/phpstan" --comment "Closed via merging ${{ github.event.pull_request.html_url }}"
+            gh issue close "$NUMBER" --repo "phpstan/phpstan" --comment "Closed via merging ${PR_URL}"
           done

.github/workflows/create-tag.yml

@@ -2,7 +2,7 @@
 
 name: "Create tag"
 
-on:
+on: # zizmor: ignore[concurrency-limits] -- manually dispatched one-off runs; a newer run does not supersede an older one
   # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_dispatch
   workflow_dispatch:
     inputs:
@@ -15,6 +15,9 @@ on:
           - patch
           - minor
 
+permissions:
+  contents: read
+
 jobs:
   create-tag:
     name: "Create tag"
@@ -26,7 +29,7 @@ jobs:
           egress-policy: audit
 
       - name: "Checkout"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # zizmor: ignore[artipacked] -- the persisted PHPSTAN_BOT_TOKEN credentials push the new tag
         with:
           fetch-depth: 0
           token: ${{ secrets.PHPSTAN_BOT_TOKEN }}