fix: Update workflow actions to use v1 stable version instead of main, update LICENSE.md.

[terabytesoftw]

Q	A
Is bugfix?	✔️
New feature?	❌
Breaks BC?	❌

Summary by CodeRabbit

• Chores

  • Pinned continuous integration workflows to stable v1 tags for improved reliability.
  • Streamlined export rules to ensure development tooling files are excluded from release archives.
  • Updated license text to reflect the correct project name.

• Documentation

  • Added a changelog entry noting workflow updates and license adjustments for the upcoming release.

[coderabbitai]

Walkthrough

Broadened .gitattributes export-ignore patterns. Pinned multiple GitHub Actions workflow “uses” references from @main to @v1. Added a changelog entry for these updates. Updated the BSD-3-Clause license endorsement text to reference “Yii2 Extensions (Terabytesoftw).”

Changes

Cohort / File(s)	Summary
Export rules (.gitattributes) /.gitattributes	Replaced explicit export-ignore entries with wildcards: /infection.json* and /phpstan*.neon*.
CI workflows pinned to v1 .github/workflows/build.yml, .github/workflows/dependency-check.yml, .github/workflows/ecs.yml, .github/workflows/static.yml	Changed reusable workflow references from @main to @v1 for phpunit, phpunit-compatibility, composer-require-checker, ecs, and phpstan.
Documentation: changelog /CHANGELOG.md	Added entry under 0.3.2 noting workflow pinning to v1 and LICENSE update.
License text /LICENSE.md	Updated endorsement clause to “Yii2 Extensions (Terabytesoftw)”; adjusted wrapping.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• fix: Exclude phpstan-console.neon from the package in .gitattributes. #72 — Similar .gitattributes changes excluding phpstan console config; closely aligned with generalized wildcard approach.
• fix: Update .gitattributes to exclude additional files from the package. #71 — Adjusts export-ignore for infection and phpstan files; overlaps with this PR’s wildcard updates.
• feat: Consolidate PHPUnit workflows and update README.md with Yii2 version badges. #14 — Modifies the same build workflow references; this PR pins them to @v1.

Poem

I twitch my nose at tags that stray,
Now v1 guides our CI’s way.
Wildcards sweep the exports clean,
A tidy burrow, crisp and lean.
Changelog ink and license bright—
Thump-thump! Our repo’s set just right. 🥕🐇

✨ Finishing Touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix-mini-43

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR/Issue comments)

Type @coderabbitai help to get the list of available commands.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Status, Documentation and Community

• Visit our Status Page to check the current availability of CodeRabbit.
• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@ac534c1). Learn more about missing BASE report.
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff            @@
##             main       #73   +/-   ##
========================================
  Coverage        ?   100.00%           
  Complexity      ?        71           
========================================
  Files           ?         2           
  Lines           ?       129           
  Branches        ?         0           
========================================
  Hits            ?       129           
  Misses          ?         0           
  Partials        ?         0           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[terabytesoftw]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (1)

.github/workflows/dependency-check.yml (1)

20-23: Optional hardening: restrict GITHUB_TOKEN permissions in this workflow.

To follow least-privilege best practices, consider explicitly restricting permissions (top-level or per-job). Example:

permissions:
  contents: read

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between ac534c1 and e8148ad.

📒 Files selected for processing (7)

• .gitattributes (1 hunks)
• .github/workflows/build.yml (1 hunks)
• .github/workflows/dependency-check.yml (1 hunks)
• .github/workflows/ecs.yml (1 hunks)
• .github/workflows/static.yml (1 hunks)
• CHANGELOG.md (1 hunks)
• LICENSE.md (1 hunks)

🔇 Additional comments (7)

.github/workflows/ecs.yml (1)

22-22: ecs.yml at v1 confirmed, no input changes
The reusable workflow exists under the v1 tag and all input names match main—no further action needed.

CHANGELOG.md (1)

7-7: Changelog entry reads well and matches the PR scope.

Accurately documents pinning actions to v1 and the license update.

LICENSE.md (1)

14-16: License endorsement line updated correctly.

The BSD-3-Clause clause now reflects the intended project entity (“Yii2 Extensions (Terabytesoftw)”). No legal structure issues spotted.

.github/workflows/build.yml (1)

22-22: Confirmed phpunit.yml@v1 compatibility – composer-command, extensions, concurrency-group and the CODECOV_TOKEN secret are all defined in the v1 workflow, so pinning to @v1 is safe.

.github/workflows/static.yml (1)

26-26: Confirmed: phpstan.yml@v1 Supports Required Inputs

I fetched and decoded phpstan.yml@v1 from php-forge/actions and verified that both

• configuration
• concurrency-group
  are defined under workflow_call.inputs.

You can safely proceed with the pin to @v1.

.github/workflows/dependency-check.yml (1)

22-22: Verification successful: v1 ref and workflow file confirmed.
Good pin to stable @v1 for the reusable workflow—switching from @main to @v1 reduces breakage risk from upstream changes. Nice.

.gitattributes (1)

38-39: Export-ignore patterns verified

• /infection.json* currently matches no files (no infection.json variants at repo root)
• /phpstan*.neon* matches phpstan.neon and phpstan-console.neon, both export-ignored as expected

If your goal is to broadly exclude current and future PHPStan and Infection config files from release archives, this setup is correct.