Merge pull request #274 from mimmi20/dependabot/composer/master/production-dependencies-4aba80a196

composer(deps): update laminas/laminas-view requirement from ^2.41.0 to ^2.42.0 in the production-dependencies group

Author: mimmi20

.github/workflows/cleanup-caches.yml

@@ -10,9 +10,12 @@ on:
       - "closed"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   cleanup:
-    runs-on: "ubuntu-24.04"
+    runs-on: "ubuntu-latest"
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v5"

.github/workflows/codeql.yml

@@ -27,10 +27,13 @@ on:
   schedule:
     - cron: "28 0 * * 0"
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: "Analyze"
-    runs-on: "ubuntu-24.04"
+    runs-on: "ubuntu-latest"
     permissions:
       actions: read
       contents: read

.github/workflows/continuous-integration.yml

@@ -95,7 +95,7 @@ jobs:
   tests-status:
     name: "Unit & Integration Tests Status"
 
-    runs-on: "ubuntu-24.04"
+    runs-on: "ubuntu-latest"
 
     if: always()
 

.github/workflows/dependency-review.yml

@@ -20,7 +20,7 @@ permissions:
 
 jobs:
   dependency-review:
-    runs-on: "ubuntu-24.04"
+    runs-on: "ubuntu-latest"
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v5"

.github/workflows/labels.yml

@@ -22,7 +22,7 @@ jobs:
     permissions:
       issues: write
 
-    runs-on: "ubuntu-24.04"
+    runs-on: "ubuntu-latest"
 
     steps:
       - name: "Checkout"

.github/workflows/lint-workflow-files.yml

@@ -5,31 +5,32 @@ on:
     paths:
       - ".github/**"
 
+permissions:
+  contents: read
+
 jobs:
   actionlint:
-    runs-on: "ubuntu-24.04"
+    uses: "mimmi20/ci/.github/workflows/lint-actions.yml@8.3"
+    with:
+      skip-nasm-install: false
+      skip-libimagequant-install: false
+
+  # This is a meta job to avoid to have to constantly change the protection rules
+  # whenever we touch the matrix.
+  lint-status:
+    name: "Lint Status"
+
+    runs-on: "ubuntu-latest"
+
+    if: always()
+
+    needs: "actionlint"
 
     steps:
-      - name: "Checkout"
-        uses: "actions/checkout@v5"
-        with:
-          # Disabling shallow clone is recommended for improving relevancy of reporting
-          fetch-depth: 0
-          lfs: false
-          persist-credentials: false
-
-      - name: "install libimagequant-dev"
-        run: "sudo apt-get install libimagequant-dev -y"
-
-      - name: "Use Node.js 22"
-        uses: "actions/setup-node@v5"
-        with:
-          node-version: "22"
-
-      - name: "Check workflow files"
-        uses: "raven-actions/actionlint@v2"
-        with:
-          matcher: true
-          cache: true
-          fail-on-error: false
-          flags: "-ignore SC2086"
+      - name: Failing run
+        if: ${{ contains(needs.*.result, 'failure') }}
+        run: exit 1
+
+      - name: Successful run
+        if: ${{ !(contains(needs.*.result, 'failure')) }}
+        run: exit 0

.github/workflows/lock-closed-issues.yml

@@ -9,10 +9,15 @@ on:
     types:
       - "closed"
 
+permissions:
+  contents: read
+
 jobs:
   lock:
-    runs-on: "ubuntu-24.04"
+    name: "Lock"
+    runs-on: "ubuntu-latest"
+    permissions:
+      issues: write
     steps:
-      - uses: "Dunning-Kruger/lock-issues@v1.2"
-        with:
-          repo-token: "${{ secrets.GITHUB_TOKEN }}"
+      - name: "Lock issue"
+        uses: "IOrlandoni/lock-issues@v1.2.1"

.github/workflows/reactions.yml

@@ -15,13 +15,14 @@ on:
       - "edited"
 
 permissions:
+  contents: read
   actions: write
   issues: write
   pull-requests: write
 
 jobs:
   action:
-    runs-on: "ubuntu-24.04"
+    runs-on: "ubuntu-latest"
     steps:
       - uses: "dessant/reaction-comments@v4"
         with:

.github/workflows/release-drafter.yml

@@ -31,7 +31,7 @@ jobs:
       # otherwise, read permission is required at least
       pull-requests: write
 
-    runs-on: "ubuntu-24.04"
+    runs-on: "ubuntu-latest"
 
     steps:
       # Drafts your next Release notes as Pull Requests are merged into "master"

.github/workflows/security.yml

@@ -0,0 +1,21 @@
+name: "OX Security Scan"
+on:
+  push:
+    branches:
+      - "master"
+  pull_request:
+    types: ["opened", "reopened", "synchronize"]
+    branches:
+      - "master"
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    runs-on: "ubuntu-latest"
+    steps:
+      - name: "Run OX Security Scan to check for vulnerabilities"
+        with:
+          ox_api_key: ${{ secrets.OX_API_KEY }}
+        uses: "oxsecurity/ox-security-scan@1.0.0"