Skip to content

Tooling: Fixed PHPCS check. #1146

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Aug 13, 2025
Merged

Tooling: Fixed PHPCS check. #1146

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5173ac1
Tooling: Updated GH `actions/checkout` to v5.
veryspry Aug 13, 2025
e22c6af
Tooling: Updated `nanasess/setup-php` to v4.1.0.
veryspry Aug 13, 2025
2c29a3b
Tooling: Updated `nanasess/setup-php@` to `shivammathur/setup-php`.
veryspry Aug 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions .github/workflows/php-lint-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,14 +7,16 @@ jobs:
name: PHPCS (Files Changed)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: actions/checkout@v5
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Verify actions/checkout@v5 exists; consider pinning to a known-good version or commit SHA

I’m not certain v5 of actions/checkout is released/available. v4 is the widely-used current major. If v5 doesn’t exist (or is pre-release), this will fail at runtime. Also, for supply-chain hardening, pinning to a commit SHA is recommended.

Consider this safe fallback if v5 is unavailable:

-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v4

Optionally, pin to a specific commit SHA for checkout instead of a floating tag.

To confirm the latest published version of actions/checkout, please run this web search:

🌐 Web query:

What is the latest released version of GitHub Actions "actions/checkout"?

💡 Result:

The latest released version of the GitHub Actions actions/checkout action is v5.0.0, released on August 11, 2025[7][3].

  • v5.0.0 requires runner version 2.327.1 or newer[7].
  • The preceding stable release was v4.3.0[3][7].

When specifying the version in your workflow, use:

- uses: actions/checkout@v5

or, to pin exactly:

- uses: actions/[email protected]

Recent minor versions (such as v4.1.4) are now superseded, and the use of v5 is recommended for the latest features and compatibility[7][3].

Citations:

Confirm: actions/checkout@v5 is released — pin to a release or SHA and verify runner compatibility

Web results show actions/checkout v5.0.0 is released (2025-08-11) and requires runner >= 2.327.1. You can keep @v5, but for supply-chain hardening pin to the exact release or a commit SHA.

  • File to update:
    • .github/workflows/php-lint-pr.yml (around line 10)

Suggested change:

-      - uses: actions/checkout@v5
+      - uses: actions/[email protected]

Or, for stronger pinning, use the action's commit SHA:

  •  - uses: actions/checkout@<commit-sha>

If you use self-hosted runners older than 2.327.1, either upgrade them or stay on v4 as a fallback.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v5
- uses: actions/checkout@v5.0.0
🤖 Prompt for AI Agents 
In .github/workflows/php-lint-pr.yml around line 10, the step uses
actions/checkout@v5 which is a floating tag; pin it to a specific release or
commit SHA and verify runner compatibility. Replace the loose @v5 with an exact
released tag (for example @v5.0.0) or the action's commit SHA to harden the
supply chain, and confirm your runners are >= 2.327.1 (or keep @v4 as a fallback
for older self-hosted runners).

with:
fetch-depth: 0 # The blame will not work without this

# PHP 8 will throw PHP Fatal error: Uncaught TypeError: vsprintf(): Argument #2 ($values) must be of type array, string given in ...
- uses: nanasess/setup-php@v3
- uses: shivammathur/setup-php@v2
with:
php-version: '7.4'
tools: composer:v2
coverage: none

- name: Install dependencies
run: composer install --dev --prefer-dist --no-progress --no-suggest
Expand All @@ -23,4 +25,4 @@ jobs:
with:
files: "**.php,**.js,**.css"
phpcs_path: ./vendor/bin/phpcs
standard: phpcs.xml
standard: phpcs.xml
Loading