Skip to content

v1.0.0

Marketplace
Marketplace

Choose a tag to compare

View all tags
@somework somework released this 16 Sep 05:06
· 31 commits to main since this release
v1.0.0
6fd80ac

Runs lockrot 0.2.2.

- uses: somework/lockrot-action@v1
  with:
    target-php: '8.4'
    fail-on: silent

What is in it

  • Composite action: verified download of the pinned lockrot release (version and sha256 in lockrot.env, re-checked right before it runs), the runner's PHP or setup-php when there is none, a metadata cache keyed by composer.lock, every lockrot option as an input, pull-request annotations (rewritten for a project in a subdirectory), the report as a job summary, and lockrot's exit code applied after the cache is saved.
  • Docker image ghcr.io/somework/lockrot: 16 MB to pull, non-root, linux/amd64 and linux/arm64, cosign-signed with a GitHub build-provenance attestation and an SBOM. Tags follow the lockrot version (0.2.2, 0.2, latest).
  • Maintenance: a daily check opens a pull request when lockrot publishes a release; v1 follows every v1.x.y.

The README has recipes for SARIF, pull-request comments, baselines, subdirectories, GitLab CI and image verification.

Assets 2
Loading