Update GH actions security

Author: danharrin

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+    labels:
+      - dependencies
+      - github_actions

.github/workflows/check-pr-maintainer-access.yml

@@ -1,18 +1,21 @@
 name: check-pr-maintainer-access
 
+# pull_request_target is safe here because this workflow never checks out
+# the PR's code — it only reads PR metadata via GraphQL and posts a comment.
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types:
       - opened
 
 permissions:
+  contents: read
   pull-requests: write
 
 jobs:
   notify-when-maintainers-cannot-edit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v3
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const query = `
@@ -48,14 +51,14 @@ jobs:
                 if (! pullRequest.maintainerCanModify) {
                     console.log('PR not owned by filamentphp and does not have maintainer edits enabled')
 
-                    await github.issues.createComment({
+                    await github.rest.issues.createComment({
                         issue_number: pullNumber,
                         owner: 'filamentphp',
                         repo: 'filament',
                         body: 'Thanks for submitting a PR!\n\nIn order to review and merge PRs most efficiently, we require that all PRs grant maintainer edit access before we review them. If your fork belongs to a GitHub organization, please move the repository to your personal account and try again. If you\'re already using a personal fork, you can learn how to enable maintainer access [in the GitHub documentation](https://docs.github.com/en/github/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork).'
                     })
 
-                    await github.issues.update({
+                    await github.rest.issues.update({
                         issue_number: pullNumber,
                         owner: 'filamentphp',
                         repo: context.repo.repo,

.github/workflows/docs-screenshots.yml

@@ -4,44 +4,54 @@ on:
   push:
     tags: '*'
 
+permissions:
+  contents: write
+
 jobs:
   take-screenshots:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
     steps:
-      - uses: actions/checkout@v2
-      - name: Cache dependencies
-        uses: actions/cache@v2
+      # persist-credentials: true is required so `git-auto-commit-action` below
+      # can push the new screenshots. Tag-only trigger means only maintainers
+      # invoke this workflow.
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked]
+      - name: Cache Composer dependencies
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.composer/cache/files
-          key: dependencies-composer-${{ hashFiles('composer.json') }}
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+          key: composer-screenshots-${{ hashFiles('docs-assets/app/composer.json') }}
+          restore-keys: |
+            composer-screenshots-
+      - name: Set up PHP
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
         with:
           php-version: 8.3
           extensions: mbstring, pdo, pdo_sqlite
           coverage: none
-      - name: Setup Node
-        uses: actions/setup-node@v2
-      - name: Install dependencies
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: lts/*
+      - name: Install screenshot dependencies
         run: |
           cd docs-assets/screenshots
-          npm ci
-      - name: Setup app
+          npm ci --ignore-scripts
+      - name: Set up app
         run: |
           cd docs-assets/app
-          composer install --no-interaction
-          npm ci && npm run build
+          composer install --no-interaction --no-scripts
+          npm ci --ignore-scripts && npm run build
           php artisan serve &
-      - name: Run script
+      - name: Take screenshots
         run: |
           cd docs-assets/screenshots
           node script
       - name: Pull changes
         run: git pull
       - name: Commit changes
-        uses: stefanzweifel/git-auto-commit-action@v4
+        uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
         with:
           commit_message: >
             chore: take docs screenshots

.github/workflows/fix-code-style.yml

@@ -3,30 +3,44 @@ name: fix-code-style
 on:
   push:
 
+permissions:
+  contents: write
+
 jobs:
   fix-code-style:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        # persist-credentials: true is required so `git-auto-commit-action` below
+        # can push reformatted files back. Trigger is `push:`, so this only runs
+        # on code that already reached a base-repo branch.
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked]
+      - name: Cache Composer dependencies
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
-          ref: ${{ github.head_ref }}
+          path: ~/.composer/cache/files
+          key: composer-cs-${{ hashFiles('composer.json') }}
+          restore-keys: |
+            composer-cs-
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
         with:
           php-version: 8.3
       - name: Set up Node
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: lts/*
+          cache: npm
       - name: Install dependencies
         run: |
-          composer install --no-interaction
-          npm ci
+          composer install --no-interaction --no-scripts
+          npm ci --ignore-scripts
       - name: Run Pint
         run: composer pint
       - name: Run Prettier
         run: npm run prettier
       - name: Commit changes
-        uses: stefanzweifel/git-auto-commit-action@v4
+        uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
         with:
           commit_message: >
             chore: fix code style

.github/workflows/manage-issue.yml

@@ -4,11 +4,15 @@ on:
   issues:
     types: [opened, edited]
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   check-repro:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v3
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const URL_REGEXP = /### Reproduction repository \(issue will be closed if this is not valid\)[\r\n]+([^#]+)###/m
@@ -51,7 +55,7 @@ jobs:
                     .join('\n')
                     .trim()
 
-                await github.issues.createComment({
+                await github.rest.issues.createComment({
                     issue_number: context.issue.number,
                     owner: context.repo.owner,
                     repo: context.repo.repo,
@@ -62,7 +66,7 @@ jobs:
             async function getGitHubActionComments() {
                 debug(`Loading existing comments...`)
 
-                const comments = await github.issues.listComments({
+                const comments = await github.rest.issues.listComments({
                     issue_number: context.issue.number,
                     owner: context.repo.owner,
                     repo: context.repo.repo,
@@ -75,7 +79,7 @@ jobs:
             }
 
             async function getIssueLabels() {
-                const issues = await github.issues.listLabelsOnIssue({
+                const issues = await github.rest.issues.listLabelsOnIssue({
                     issue_number: context.issue.number,
                     owner: context.repo.owner,
                     repo: context.repo.repo,
@@ -85,7 +89,7 @@ jobs:
             }
 
             async function updateIssue(state, state_reason = null) {
-                await github.issues.update({
+                await github.rest.issues.update({
                     owner: context.repo.owner,
                     repo: context.repo.repo,
                     issue_number: context.issue.number,
@@ -111,7 +115,7 @@ jobs:
 
                 debug(`Missing required information`)
 
-                await github.issues.addLabels({
+                await github.rest.issues.addLabels({
                     issue_number: context.issue.number,
                     owner: context.repo.owner,
                     repo: context.repo.repo,
@@ -149,7 +153,7 @@ jobs:
 
                 debug(`Reopening closed issue`)
 
-                await github.issues.removeLabel({
+                await github.rest.issues.removeLabel({
                     issue_number: context.issue.number,
                     owner: context.repo.owner,
                     repo: context.repo.repo,

.github/workflows/monorepo-split.yml

@@ -4,6 +4,9 @@ on:
   push:
     tags: '*'
 
+permissions:
+  contents: read
+
 jobs:
   split-monorepo:
     runs-on: ubuntu-latest
@@ -27,11 +30,13 @@ jobs:
           - widgets
           - upgrade
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - id: previous-tag
-        uses: 'WyriHaximus/github-action-get-previous-tag@master'
+        uses: WyriHaximus/github-action-get-previous-tag@61819f33034117e6c686e6a31dba995a85afc9de # v2.0.0
       - name: Monorepo Split of ${{ matrix.package }}
-        uses: danharrin/monorepo-split-github-action@v2.4.0
+        uses: danharrin/monorepo-split-github-action@f10477258c88013cc5902388ec47fe9457837041 # v2.4.4
         env:
           GITHUB_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
         with:

.github/workflows/npm-build.yml

@@ -7,25 +7,33 @@ on:
     types:
       - closed
 
+permissions:
+  contents: write
+
 jobs:
   npm-build:
     runs-on: ubuntu-latest
-    if: github.event.pull_request.merged == true
+    if: github.event.pull_request.merged == true && github.event.pull_request.head.repo.full_name == github.repository
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        # persist-credentials: true is required so `git-auto-commit-action` below
+        # can push the rebuilt dist files. Same-repo-PR gate above means the
+        # merged code came from a maintainer-authored branch.
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked]
         with:
           ref: 3.x
-      - name: Setup Node
-        uses: actions/setup-node@v2
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: lts/*
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
       - name: Build assets
         run: npm run build
       - name: Pull changes
         run: git pull
       - name: Commit changes
-        uses: stefanzweifel/git-auto-commit-action@v4
+        uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
         with:
           branch: 3.x
           commit_message: >

.github/workflows/phpstan.yml

@@ -4,6 +4,13 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   phpstan:
     runs-on: ubuntu-latest
@@ -22,14 +29,19 @@ jobs:
             testbench: 8.*
     name: P${{ matrix.php }} - L${{ matrix.laravel }} - ${{ matrix.dependency-version }}
     steps:
-      - uses: actions/checkout@v3
-      - name: Cache dependencies
-        uses: actions/cache@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Cache Composer dependencies
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.composer/cache/files
-          key: dependencies-laravel-${{ matrix.laravel }}-php-${{ matrix.php }}-composer-${{ hashFiles('composer.json') }}
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+          key: composer-${{ matrix.php }}-${{ matrix.laravel }}-${{ hashFiles('composer.json') }}
+          restore-keys: |
+            composer-${{ matrix.php }}-${{ matrix.laravel }}-
+            composer-${{ matrix.php }}-
+      - name: Set up PHP
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
         with:
           php-version: ${{ matrix.php }}
           extensions: mbstring, pdo, pdo_sqlite

.github/workflows/tests.yml

@@ -4,6 +4,13 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   run-tests:
     runs-on: ubuntu-latest
@@ -22,14 +29,19 @@ jobs:
             testbench: 8.*
     name: P${{ matrix.php }} - L${{ matrix.laravel }} - ${{ matrix.dependency-version }}
     steps:
-      - uses: actions/checkout@v3
-      - name: Cache dependencies
-        uses: actions/cache@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Cache Composer dependencies
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.composer/cache/files
-          key: dependencies-laravel-${{ matrix.laravel }}-php-${{ matrix.php }}-composer-${{ hashFiles('composer.json') }}
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+          key: composer-${{ matrix.php }}-${{ matrix.laravel }}-${{ hashFiles('composer.json') }}
+          restore-keys: |
+            composer-${{ matrix.php }}-${{ matrix.laravel }}-
+            composer-${{ matrix.php }}-
+      - name: Set up PHP
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
         with:
           php-version: ${{ matrix.php }}
           extensions: mbstring, pdo, pdo_sqlite