chore: enforce security hardening for GitHub Actions workflows

[paulbalandan]

Description
Ref: https://docs.github.com/en/actions/reference/security/secure-use

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[michalsn]

Question - can Dependabot update GitHub Actions that are pinned to a full commit SHA?

I noticed that test-phpcpd.yml does not use a pinned version. Is there a specific reason for this, or is it just a missing update?

[paulbalandan]

Question - can Dependabot update GitHub Actions that are pinned to a full commit SHA?

Yes. It actually can update the pinned SHA. It has done this to my other repo.

I noticed that test-phpcpd.yml does not use a pinned version. Is there a specific reason for this, or is it just a missing update?

It uses the reusable workflow from codeigniter/.github repo instead of an action. I can update that.

[michalsn]

It uses the reusable workflow from codeigniter/.github repo instead of an action. I can update that.

I'm getting blind - I haven't noticed that it links to the repo...