From b718f1c49eee73a2a788c639f9b21ac8d07be28e Mon Sep 17 00:00:00 2001
From: Julien Dehais <julien.dehais@groupe-cyllene.com>
Date: Wed, 7 Oct 2026 17:20:59 +0200
Subject: [PATCH 1/2] chore: add homepage, authors and support links to
 composer.json

---
 composer.json | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/composer.json b/composer.json
index ecaf5b8..7ed937f 100644
--- a/composer.json
+++ b/composer.json
@@ -11,6 +11,18 @@
         "admin"
     ],
     "license": "MIT",
+    "homepage": "https://github.com/CylleneDigital/SyliusTranslationFlagsPlugin",
+    "authors": [
+        {
+            "name": "Cyllene",
+            "homepage": "https://github.com/CylleneDigital"
+        }
+    ],
+    "support": {
+        "issues": "https://github.com/CylleneDigital/SyliusTranslationFlagsPlugin/issues",
+        "source": "https://github.com/CylleneDigital/SyliusTranslationFlagsPlugin",
+        "security": "https://github.com/CylleneDigital/SyliusTranslationFlagsPlugin/security/policy"
+    },
     "require": {
         "php": "^8.3",
         "sylius/sylius": "~2.2.0 || ~2.3.0",

From be83f96fa0beb8410b80040136799eb056e58063 Mon Sep 17 00:00:00 2001
From: Julien Dehais <julien.dehais@groupe-cyllene.com>
Date: Wed, 7 Oct 2026 17:20:59 +0200
Subject: [PATCH 2/2] ci: pin runners and actions, restrict token permissions,
 audit the Sylius 2.2 resolution

---
 .github/workflows/build.yaml    | 19 +++++++++++++++----
 .github/workflows/security.yaml | 20 +++++++++++++++++---
 2 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 4b7e302..82680f2 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -1,6 +1,11 @@
 name: Build
 
 on:
+    # No `paths-ignore` on `pull_request`: `Build complete` is a required check, and a required
+    # check that never starts blocks the pull request for good.
+    #
+    # `push` is limited to `main` so that a branch does not run the matrix twice, once for the push
+    # and once for its pull request.
     push:
         branches:
             - main
@@ -9,16 +14,22 @@ on:
         types: [created]
     schedule:
         -
-            cron: "0 1 * * 6" # Run at 1am every Saturday
+            cron: "0 1 * * 6"
     workflow_dispatch: ~
 
 concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
     cancel-in-progress: true
 
+permissions:
+    contents: read
+
 jobs:
     tests:
-        runs-on: ubuntu-latest
+        # Pinned rather than `ubuntu-latest`: the build action is only known to work on this image.
+        runs-on: ubuntu-24.04
+        # A stuck job would otherwise hold the runner for the 6-hour default.
+        timeout-minutes: 30
 
         name: "PHP ${{ matrix.php }}, Sylius ${{ matrix.sylius }}, Symfony ${{ matrix.symfony }}"
 
@@ -54,7 +65,7 @@ jobs:
 
             -
                 name: Build Sylius Test Application
-                uses: SyliusLabs/BuildTestAppAction@v4
+                uses: SyliusLabs/BuildTestAppAction@fbdfc158a99f540fc3bbe554b46120d14444f2f4 # v4.3.0
                 with:
                     # The admin page the tests render includes the Webpack Encore entries:
                     # without a front-end build they answer 500 without saying why.
@@ -102,7 +113,7 @@ jobs:
     # required check counts as satisfied - the rule would let through exactly what it guards
     # against.
     build:
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         name: "Build complete"
         needs: tests
         if: always()
diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
index 549c67f..0b53b2d 100644
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -7,12 +7,16 @@ on:
     pull_request: ~
     schedule:
         -
-            cron: "0 7 * * 1" # Every Monday at 7am
+            cron: "0 7 * * 1"
     workflow_dispatch: ~
 
+permissions:
+    contents: read
+
 jobs:
     audit:
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
+        timeout-minutes: 15
 
         name: "Composer audit"
 
@@ -22,7 +26,7 @@ jobs:
 
             -
                 name: Setup PHP
-                uses: shivammathur/setup-php@v2
+                uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
                 with:
                     php-version: "8.4"
                     coverage: none
@@ -42,3 +46,13 @@ jobs:
             -
                 name: Audit dependencies
                 run: composer audit --ansi --abandoned=report
+
+            # The resolution above takes the newest packages (Sylius 2.3, Symfony 8). Shops also run the
+            # oldest supported line: Sylius 2.2 on PHP 8.3, hence Symfony 7.4.
+            -
+                name: Audit the Sylius 2.2 resolution
+                run: |
+                    composer config platform.php 8.3.0
+                    composer require --no-update --no-interaction "sylius/sylius:~2.2.0" "sylius/test-application:~2.2.0@alpha"
+                    composer update --no-interaction --no-progress --prefer-dist
+                    composer audit --ansi --abandoned=report