v1.3.0 - 2026-10-04

Added

• New reusable workflow: "reusable-pinact". #52
  This workflow will verify that any action runners used in GitHub actions workflows are pinned and that these pins are correct and follow specified "cooldown" rules.
  To start using this workflow, add a .pinact.yaml file to a repository and add a GHA job referencing the reusable workflow.

Changed

• Clarified thread model in the security policy (which applies to all repos in this org). #49 Props @edorian.
• All workflows: the permissions needed for each (reusable) job are now explicitly set and documented. #53
  It is recommended for repositories using the reusable workflows to apply the recommended permissions to their jobs as well.
  The recommended permissions are as follows:
  • reusable-findtokenprops.yml: contents: read
  • reusable-markdownlint.yml: contents: read
  • reusable-pinact.yml: contents: read
  • reusable-phpstan.yml: contents: read
  • reusable-remark.yml: contents: read
  • reusable-yamllint.yml: contents: read
• All workflows will now respect a 10 day "cooldown" period before external action runners are updated to a new version. #50
• reusable-phpstan.yml: the workflow will now fail early if PHPStan could not be acquired. #48
• reusable-markdownlint.yml: DavidAnson/markdownlint-cli2-action was bumped from v24.1.0 to v24.2.0.
• reusable-remark.yml: reviewdog/action-remark-lint was bumped from v5.18.0 to v5.20.0.
• Minor documentation improvements.