ci: add canary/publish split, bump actions, audit deps #29

Open

inv3ntor01 wants to merge 1 commit from feature/ci-workflow into main

inv3ntor01 commented

2026-07-03 08:42:26 +00:00

(Migrated from github.com)

CI Workflow Security & Structure Improvements

Changes

Change	Reason
Split `publish` into `canary` + `publish`	Branch pushes go to `canary` pre-release; only `v*` tags trigger stable releases. Prevents accidental production releases from every push.
Add `environment: release` gate	Tagged releases require approval via GitHub Environments. Prevents unauthorized binary uploads.
Add `composer audit`	Blocks CI on vulnerable dependencies (supply chain security).
Add `--no-dev` to production builds	Excludes test/analysis tools from the PHAR binary.
`runs-on: ubuntu-latest` → `ubuntu-24.04`	Pins runner version for reproducible builds.
Bump action versions	`actions/checkout@v4` → `@v7` (pwn-request protection), `softprops/action-gh-release@v2` → `@v3` (Node 24), PHP 8.4 → 8.5 (current stable).
Add concurrency group	Cancels stale in-progress runs on the same branch.

Action Required

Create release GitHub Environment (Settings → Environments): required reviewers = 1, branch filter = main
Generate GPG key and add GPG_PRIVATE_KEY + GPG_PASSPHRASE secrets to the release environment
Verify TAP_GITHUB_TOKEN secret exists (PAT with contents:write on homebrew-larakube)

Testing

Push to main → test + canary jobs run, canary pre-release updated
Push a v* tag → test + publish (paused at release env for approval) + tap run
Open a PR → only test job runs

## CI Workflow Security & Structure Improvements ### Changes | Change | Reason | |---|---| | **Split `publish` into `canary` + `publish`** | Branch pushes go to `canary` pre-release; only `v*` tags trigger stable releases. Prevents accidental production releases from every push. | | **Add `environment: release` gate** | Tagged releases require approval via GitHub Environments. Prevents unauthorized binary uploads. | | **Add `composer audit`** | Blocks CI on vulnerable dependencies (supply chain security). | | **Add `--no-dev` to production builds** | Excludes test/analysis tools from the PHAR binary. | | **`runs-on: ubuntu-latest` → `ubuntu-24.04`** | Pins runner version for reproducible builds. | | **Bump action versions** | `actions/checkout@v4` → `@v7` (pwn-request protection), `softprops/action-gh-release@v2` → `@v3` (Node 24), PHP 8.4 → 8.5 (current stable). | | **Add concurrency group** | Cancels stale in-progress runs on the same branch. | ### Action Required - [ ] Create **`release`** GitHub Environment (Settings → Environments): required reviewers = 1, branch filter = `main` - [ ] Generate GPG key and add `GPG_PRIVATE_KEY` + `GPG_PASSPHRASE` secrets to the `release` environment - [ ] Verify `TAP_GITHUB_TOKEN` secret exists (PAT with `contents:write` on `homebrew-larakube`) ### Testing - Push to `main` → `test` + `canary` jobs run, canary pre-release updated - Push a `v*` tag → `test` + `publish` (paused at `release` env for approval) + `tap` run - Open a PR → only `test` job runs

This pull request has changes conflicting with the target branch.

.github/workflows/ci.yml

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title

Merge pull request 'ci: add canary/publish split, bump actions, audit deps' (#29) from feature/ci-workflow into main

Merge commit body

Reviewed-on: https://git.luchtech.dev/luchaveztech/larakube-cli/pulls/29

Merge pull request 'ci: add canary/publish split, bump actions, audit deps' (#29) from feature/ci-workflow into main

Reviewed-on: https://git.luchtech.dev/luchaveztech/larakube-cli/pulls/29

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feature/ci-workflow:feature/ci-workflow

git switch feature/ci-workflow

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff feature/ci-workflow

git switch feature/ci-workflow

git rebase main

git switch main

git merge --ff-only feature/ci-workflow

git switch feature/ci-workflow

git rebase main

git switch main

git merge --no-ff feature/ci-workflow

git switch main

git merge --squash feature/ci-workflow