From ef5c3fc7c262922c7f66d35d25822edc33dd2b03 Mon Sep 17 00:00:00 2001 From: Joe Fusco Date: Wed, 10 Jun 2026 12:14:47 -0400 Subject: [PATCH] Add a composer audit CI workflow Fails when any direct or transitive dependency in composer.lock has a known security advisory. Runs on every PR that touches the lockfile, plus weekly so newly-disclosed advisories against unchanged dependencies still trip CI. --- .github/workflows/composer-audit.yml | 31 ++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 .github/workflows/composer-audit.yml diff --git a/.github/workflows/composer-audit.yml b/.github/workflows/composer-audit.yml new file mode 100644 index 00000000..1360a3e3 --- /dev/null +++ b/.github/workflows/composer-audit.yml @@ -0,0 +1,31 @@ +name: Composer Audit + +# Fails when any direct or transitive dependency in `composer.lock` has a +# known security advisory. Runs on every PR and weekly so newly-disclosed +# advisories against unchanged dependencies still trip CI. + +on: + pull_request: + paths: + - 'composer.json' + - 'composer.lock' + - '.github/workflows/composer-audit.yml' + schedule: + - cron: '0 6 * * 1' + workflow_dispatch: + +permissions: + contents: read + +jobs: + audit: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - uses: shivammathur/setup-php@v2 + with: + php-version: '8.3' + tools: composer + + - run: composer audit --no-interaction