---
name: Security check

on:
  - push
  - pull_request
  # Allow manually triggering the workflow.
  - workflow_dispatch

env:
  COMPOSER_AUTH: '{"github-oauth": {"github.com": "${{ secrets.GITHUB_TOKEN }}"}}'

# Cancels all previous workflow runs for the same branch that have not yet completed.
concurrency:
  # The concurrency group contains the workflow name and the branch name.
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  security-check:
    runs-on: ubuntu-latest
    name: "Security check"

    strategy:
      matrix:
        php: ['5.4', 'latest']

    steps:
      - name: Checkout code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false

      - name: Install PHP
        uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5
        with:
          php-version: ${{ matrix.php }}
          coverage: none

      # Install dependencies and handle caching in one go.
      # @link https://github.com/marketplace/actions/install-php-dependencies-with-composer
      - name: Install Composer dependencies
        uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # 3.1.1
        with:
          # Bust the cache at least once a month - output format: YYYY-MM.
          custom-cache-suffix: $(date -u "+%Y-%m")
          # Ignore development-only packages in security check
          composer-options: "--no-dev"

      - name: Download security checker
        # yamllint disable-line rule:line-length
        run: wget -P . https://github.com/fabpot/local-php-security-checker/releases/download/v2.0.6/local-php-security-checker_2.0.6_linux_amd64

      - name: Make security checker executable
        run: chmod +x ./local-php-security-checker_2.0.6_linux_amd64

      - name: Check against insecure dependencies
        run: ./local-php-security-checker_2.0.6_linux_amd64 --path=vendor/composer/installed.json
