Repository navigation

chore(ci): generate actions.lock ahead of the 2026-10-01 lock gate #399

	# SPDX-License-Identifier: MPL-2.0
	# This workflow is managed by gh actions-lock.
	name: PHP Security Check

	on:
	push:
	branches: [main, master]
	pull_request:

	# Estate guardrail: scope push to default branches so a PR fires once (not
	# push+PR), and cancel superseded runs. Safe — read-only PR-triggered check.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	actions: read
	contents: read

	jobs:
	security:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- name: PHP Security Scan
	run: \|
	# Check for dangerous functions
	DANGEROUS=$(grep -rE 'eval\s\(\|exec\s\(\|system\s\(\|passthru\s\(\|shell_exec\s\(\|`.\$' --include="*.php" . 2>/dev/null \| grep -v 'vendor/' \| head -10 \|\| true)
	if [ -n "$DANGEROUS" ]; then
	echo "⚠️ Potentially dangerous PHP functions found:"
	echo "$DANGEROUS"
	fi

	# Check for SQL injection patterns
	SQLI=$(grep -rE '\$_(GET\|POST\|REQUEST).query\|mysqli_query.\$_' --include="*.php" . 2>/dev/null \| grep -v 'vendor/' \| head -5 \|\| true)
	if [ -n "$SQLI" ]; then
	echo "⚠️ Potential SQL injection patterns:"
	echo "$SQLI"
	fi

	# Check for XSS patterns
	XSS=$(grep -rE 'echo\s+\$_(GET\|POST\|REQUEST)' --include="*.php" . 2>/dev/null \| grep -v 'vendor/' \| head -5 \|\| true)
	if [ -n "$XSS" ]; then
	echo "⚠️ Potential XSS patterns (unescaped output):"
	echo "$XSS"
	fi

	echo "✅ PHP security scan completed"