From 9d92af8b4635a3dac93fa9c9d09928fa2d93d46f Mon Sep 17 00:00:00 2001 From: thierrypigot Date: Tue, 13 Oct 2026 16:28:31 +0200 Subject: [PATCH 1/2] =?UTF-8?q?actions/checkout=20v4.2.2=20=E2=86=92=20v7.?= =?UTF-8?q?0.1=20(Node.js=2024),=20=C3=A9pingl=C3=A9=20par=20SHA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/ci.yml | 2 +- .github/workflows/plugin-release.yml | 8 ++++---- .github/workflows/theme-release.yml | 8 ++++---- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 554c1b7..de237d5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 15 steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/plugin-release.yml b/.github/workflows/plugin-release.yml index 6fddfd8..8217e2f 100644 --- a/.github/workflows/plugin-release.yml +++ b/.github/workflows/plugin-release.yml @@ -24,13 +24,13 @@ jobs: version: ${{ steps.meta.outputs.version }} steps: - name: Code du plugin - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: path: plugin persist-credentials: false - name: Outils de publication - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: wearewp/release-tools ref: ${{ inputs.tools-ref }} @@ -39,7 +39,7 @@ jobs: # Un relèvement de la version minimale sur main s'applique même aux appels épinglés sur un ancien tag. - name: Version minimale de wawp-updater exigée sur main - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: wearewp/release-tools ref: main @@ -106,7 +106,7 @@ jobs: cancel-in-progress: false steps: - name: Outils de publication - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: wearewp/release-tools ref: ${{ inputs.tools-ref }} diff --git a/.github/workflows/theme-release.yml b/.github/workflows/theme-release.yml index 63ed079..16b6fb0 100644 --- a/.github/workflows/theme-release.yml +++ b/.github/workflows/theme-release.yml @@ -24,13 +24,13 @@ jobs: version: ${{ steps.meta.outputs.version }} steps: - name: Code du thème - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: path: theme persist-credentials: false - name: Outils de publication - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: wearewp/release-tools ref: ${{ inputs.tools-ref }} @@ -39,7 +39,7 @@ jobs: # Un relèvement de la version minimale sur main s'applique même aux appels épinglés sur un ancien tag. - name: Version minimale de wawp-theme-updater exigée sur main - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: wearewp/release-tools ref: main @@ -106,7 +106,7 @@ jobs: cancel-in-progress: false steps: - name: Outils de publication - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: wearewp/release-tools ref: ${{ inputs.tools-ref }} From a923547dfc4f469fe86663ae0e5f2a2fe4929fd2 Mon Sep 17 00:00:00 2001 From: thierrypigot Date: Tue, 13 Oct 2026 16:29:30 +0200 Subject: [PATCH 2/2] Test de politique des workflows : SHA d'actions/checkout v7.0.1 --- tests/Unit/WorkflowPolicyTest.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/Unit/WorkflowPolicyTest.php b/tests/Unit/WorkflowPolicyTest.php index bb99c4e..b449226 100644 --- a/tests/Unit/WorkflowPolicyTest.php +++ b/tests/Unit/WorkflowPolicyTest.php @@ -88,7 +88,7 @@ public function testBuildChecksThePackageAndTakesTheHighestMinimumUpdaterVersion $steps = self::steps($build); $main = $steps['Version minimale de wawp-updater exigée sur main'] ?? ''; - foreach (['uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683', 'repository: wearewp/release-tools', 'ref: main', 'path: tools-main', 'sparse-checkout: config', 'persist-credentials: false'] as $needle) { + foreach (['uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1', 'repository: wearewp/release-tools', 'ref: main', 'path: tools-main', 'sparse-checkout: config', 'persist-credentials: false'] as $needle) { self::assertStringContainsString($needle, $main, $needle); } $checks = $steps['Contrôles avant publication'] ?? '';