[alies-dev]

Adds a jactionlint job that runs on changes under .github/ and fixes what it found on the current workflows.

The release builds (build-phar, build-docker) restored the shared composer cache, so a poisoned cache entry could end up in a published phar or image; they now install without it. bcc and pr-labels ran with the repository's default token permissions and now request only what they use. The PHP lint step in ci.yml piped git ls-files through unquoted grep patterns without pipefail, so a failing git went unnoticed; it now uses a pathspec (same 1737 files) under shell: bash. Smaller items: a concurrency group for pr-labels, quoted $GITHUB_OUTPUT, and a 7-day Dependabot cooldown.

.github/jactionlint.yaml keeps the default profile but turns off missing-timeout, duplicate-triggers (unfiltered push runs CI on fork branches on purpose) and superfluous-actions, and records why build-phar.yml keeps its concurrency in skip-duplicate-actions and why perf-comment.yml's workflow_run trigger and pull-requests: write are acceptable.

[alies-dev]

Removed on purpose (cache-poisoning). This job publishes the phar on releases, and it restored the Linux-composer-* cache that other workflows on the default branch also write. Composer does not verify dist checksums for most GitHub-hosted packages, so a poisoned entry there would end up inside the released phar. Without the cache, composer install downloads everything fresh, which makes the build a little slower.

[alies-dev]

Same reason as in build-phar.yml: this job pushes the image on tags, so it should not build from a restored cache.

[alies-dev]

Same file list as the old grep chain (I diffed both: 1737 files). The old version had two problems. Without pipefail, a failing git ls-files went unnoticed and the step linted nothing. And the regexes were not quoted, so the shell could treat ^dictionaries/scripts/* as a glob. shell: bash makes Actions run with -o pipefail.

[alies-dev]

Before this, the job ran with the repository's default token permissions. It only checks out the code and runs roave/backward-compatibility-check, so contents: read is enough.

[alies-dev]

mheap/github-action-required-labels at this pin calls only issues.listLabelsOnIssue. It calls listComments/deleteComment only with add_comment: true, which this workflow does not set, so read access is enough. The concurrency group drops stale runs when labels change several times in a row.

[alies-dev]

With this, Dependabot waits 7 days after an action release before proposing it (its implicit default is 3 days). A compromised release is then more likely to be found and pulled before we pin it.

[alies-dev]

superfluous-actions only flagged svenstaro/upload-release-action in build-phar.yml and suggested replacing it with gh release upload. That is a style preference, not a bug, so the rule is off. missing-timeout would mean picking an upper bound for every analysis and test job (21 jobs), and a wrong guess would kill slow but healthy runs.

[alies-dev]

The runner is pinned to ubuntu-24.04 instead of ubuntu-latest because jactionlint checks run: scripts only when shellcheck is on PATH. The 24.04 image has it, and pinning keeps that from changing silently.

[alies-dev]

The action pins the jactionlint version too: its version input defaults to the release the action was published with. Dependabot (with the new cooldown) will propose updates.

[github-actions]

✅ Performance: unchanged · Issues: unchanged

Project	Memory (MB)	Wall (s)	Issues	Weighted
✅ laravel	1 821	55.3 $\color{gray}{\textsf{-2.6\%}}$	25 914	51 150
✅ symfony	4 002	213.6 $\color{gray}{\textsf{+0.5\%}}$	51 079	101 098
✅ doctrine-orm	428	17.4 $\color{gray}{\textsf{-0.2\%}}$	3 507	5 580
✅ psl	651	21.9	1 424	5 514
✅ phpunit	506	10.5 $\color{gray}{\textsf{+1.1\%}}$	1 627	1 265
✅ php-parser	245	10.1 $\color{gray}{\textsf{+0.7\%}}$	17 169	20 624
✅ tempest	922	21.6 $\color{gray}{\textsf{+3.3\%}}$	5 016	9 616
✅ amphp-amp	60	2.1 $\color{gray}{\textsf{-1.4\%}}$	32	79
✅ webmozarts-assert	272	4.8 $\color{gray}{\textsf{+0.4\%}}$	577	2 714
✅ guzzle-promises	55	2.1	163	407
✅ monolog	161	5.4 $\color{gray}{\textsf{+0.6\%}}$	1 004	2 722
✅ drupal	5 196	200.6 $\color{gray}{\textsf{+3.0\%}}$	98 825	161 668
Total	14 319	565.2 $\color{gray}{\textsf{+1.1\%}}$	206 337	362 437

How to read this table

• Memory: Psalm's own peak figure, threads=1. More than +5 % fails, unless the PR changes composer.json.
• Wall: base and head run on the same runner; ±10 % is noise. Above +20 % warns, never fails. re-run: a reversed second run was taken and the faster kept.
• Issues: head count, then $\color{red}{\textsf{+added}}$ $\color{green}{\textsf{-removed}}$ against base.
• Weighted: issues weighted by error level (levels 1–8 as is, always-errors 10, feature-specific and purity suggestions 0). The projects' own code is pinned and their dependencies resolve identically for base and head, so a change means Psalm reports more, fewer or differently serious issues. A rise is not necessarily a regression.
• Total: sum over the projects compared on both sides. Thresholds apply per project, not to the total.
• Colors: $\color{red}{\textsf{red}}$ past a fail or warn threshold (or more issues), $\color{green}{\textsf{green}}$ an improvement past noise (or fewer issues), $\color{gray}{\textsf{gray}}$ noise.
• Performance: regressed if a head run crashed or timed out or a memory or wall delta is red, else improved if one is green, else unchanged. Its icon is the check result: ❌ fail · ⚠️ warn · ✅ pass; the icon next to each project is that project's result, 💥 = not comparable: base crashed or timed out (counts as ⚠️).
• Issues (heading): the total weighted change, increased · decreased · unchanged. Informational, never fails the check.

_{head 81c0f02 · base 0cc606c (merge-base) · workflow run}