From 05bbbefb4486fbba8c8344dfd55061ee660a22d6 Mon Sep 17 00:00:00 2001
From: roxblnfk <roxblnfk@ya.ru>
Date: Fri, 9 Oct 2026 21:29:15 +0400
Subject: [PATCH] ci: audit dependencies with `composer audit`

GHSA-g9pc-8g42-g6vq is ignored: its range `spiral/roadrunner < 2025.1.0` also matches RoadRunner 3.x, which is not affected.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/security.yml | 57 ++++++++++++++++++++++++++++++++++
 composer.json                  |  5 +++
 2 files changed, 62 insertions(+)
 create mode 100644 .github/workflows/security.yml

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
new file mode 100644
index 0000000..65ecd29
--- /dev/null
+++ b/.github/workflows/security.yml
@@ -0,0 +1,57 @@
+---
+
+name: 🔐 Security analysis
+
+on:  # yamllint disable-line rule:truthy
+  pull_request:
+  push:
+    branches: [3.x]
+
+# `head_ref` is the PR source branch on `pull_request` events and empty on `push`
+# (falls back to `github.ref` = `refs/heads/<branch>`). Different PRs from different
+# branches → different groups, so they never cross-cancel. Same PR pushed again
+# → same group, the new run cancels the previous one.
+#
+# `cancel-in-progress` is only enabled on PR events: pushes to the default branch
+# (3.x) keep their full history of CI runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  security-analysis:
+    timeout-minutes: 4
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: true
+      matrix:
+        os:
+          - ubuntu-latest
+        php-version:
+          - '8.2'
+        dependencies:
+          - highest
+    steps:
+      - name: 📦 Check out the codebase
+        uses: actions/checkout@v7
+
+      - name: 🛠️ Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-version }}
+          ini-values: error_reporting=E_ALL
+          coverage: none
+
+      - name: 🛠️ Setup problem matchers
+        run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"
+
+      - name: 🤖 Validate composer.json
+        run: composer validate --ansi --strict
+
+      - name: 📥 Install dependencies with composer
+        uses: ramsey/composer-install@v3
+        with:
+          dependency-versions: ${{ matrix.dependencies }}
+
+      - name: 🐛 Check installed packages for security vulnerability advisories
+        run: composer audit --ansi
diff --git a/composer.json b/composer.json
index 440b846..9cafb82 100644
--- a/composer.json
+++ b/composer.json
@@ -80,6 +80,11 @@
         "spiral/roadrunner-cli": "Provides RoadRunner installation and management CLI tools"
     },
     "config": {
+        "audit": {
+            "ignore": {
+                "GHSA-g9pc-8g42-g6vq": "False positive: the range < 2025.1.0 also matches RoadRunner 3.x, which is not affected"
+            }
+        },
         "sort-packages": true
     },
     "minimum-stability": "dev",