GH Actions: Bump the action-runners group with 5 updates - #2101

Sourced from shivammathur/setup-php's releases.

2.40.0

Changelog

• Added support for PHP 8.7 nightly builds. This installs PHP builds from the master branch of php/php-src.

- name: Setup PHP 8.7
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.7'

• Added support for Ubuntu 26.04 (ubuntu-26.04). (#1083)

• Added support for pinning tools to SHA-256 and SHA-512 checksums. (#1098, #1099)

- name: Setup PHP with tools pinned to checksums
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: >
      composer:2.9.8@sha256:59b2c50e10cafa0d8efc19ede9a326d782f096c674a26baf98cf042ce23de890,
      phpunit:12.5.0@sha512:76430b433bd57f96e5fbbabaefc0c82e3a5b19b1a366bd836614344c441a7a87575d77faa07e0e58ecec52061af67584b036adc4311f0764bd4414bc62be4684

• Fixed support for Couchbase, Oracle, and IBM extensions on Ubuntu 26.04. (#1123)

• Added support for cpx. (#1104)

- name: Setup PHP with cpx
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: cpx

• Added support for Laravel Cloud CLI. (#1106)

- name: Setup PHP with Laravel Cloud CLI
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: laravel-cloud

• Added configurable verbose logging using the verbose environment variable. Set it to true or v to show command output, or vv or vvv to also enable tracing. Also, deprecated the verbose and more-verbose tags in favor of this environment variable. (#1077, #1118, #1119)

... (truncated)

• eb7c497 Bump version to 2.40.0
• 7d671ba Resolve PHP formula aliases before invoking Homebrew
• 57747c1 Allow opt-in builds cache on Blacksmith and Depot runners
• 421f97f Keep verbose tests in TypeScript
• dc7811a Bump Node.js dependencies
• 7932293 Bump the github-actions group with 3 updates (#1130)
• 87d00bd Default "Are you willing to submit a PR?" to "No" (#1126)
• f458a14 Remove macOS 14 from README runner listings
• bc12f5c Switch to homebrew-extensions for geos on macOS [skip ci]
• bbf0b63 Try Brew extension installs before refreshing Homebrew
• Additional commits viewable in compare view

Sourced from PHPCSStandards/.github/.github/workflows/reusable-markdownlint.yml's releases.

v1.3.0 - 2026-10-04

Added

• New reusable workflow: "reusable-pinact". #52 This workflow will verify that any action runners used in GitHub actions workflows are pinned and that these pins are correct and follow specified "cooldown" rules. To start using this workflow, add a .pinact.yaml file to a repository and add a GHA job referencing the reusable workflow.

Changed

• Clarified thread model in the security policy (which applies to all repos in this org). #49 Props @​edorian.
• All workflows: the permissions needed for each (reusable) job are now explicitly set and documented. #53 It is recommended for repositories using the reusable workflows to apply the recommended permissions to their jobs as well. The recommended permissions are as follows:
  • reusable-findtokenprops.yml: contents: read
  • reusable-markdownlint.yml: contents: read
  • reusable-pinact.yml: contents: read
  • reusable-phpstan.yml: contents: read
  • reusable-remark.yml: contents: read
  • reusable-yamllint.yml: contents: read
• All workflows will now respect a 10 day "cooldown" period before external action runners are updated to a new version. #50
• reusable-phpstan.yml: the workflow will now fail early if PHPStan could not be acquired. #48
• reusable-markdownlint.yml: DavidAnson/markdownlint-cli2-action was bumped from v24.1.0 to v24.2.0.
• reusable-remark.yml: reviewdog/action-remark-lint was bumped from v5.18.0 to v5.20.0.
• Minor documentation improvements.

• 559f404 README: list available reusable workflows alphabetically
• ac0489b GH Actions: Bump reviewdog/action-remark-lint
• ee193c0 README: improve formatting for readability
• 47f9487 QA: add pinact GHA job and configuration
• 37fff7f New reusable workflow to run the Pinact tool
• b1c1d33 GH Actions: set permissions for each workflow/job (#53)
• 2a9d449 Propose Trust/Thread model section in SECURITY.md (#49)
• 5544c3c GH Actions: Bump DavidAnson/markdownlint-cli2-action
• 58b7623 Dependabot: add cooldown period
• 1f74e60 GH Actions: fail "setup-php" if requested tooling could not be installed
• See full diff in compare view

Sourced from PHPCSStandards/.github/.github/workflows/reusable-remark.yml's releases.

v1.3.0 - 2026-10-04

Added

• New reusable workflow: "reusable-pinact". #52 This workflow will verify that any action runners used in GitHub actions workflows are pinned and that these pins are correct and follow specified "cooldown" rules. To start using this workflow, add a .pinact.yaml file to a repository and add a GHA job referencing the reusable workflow.

Changed

• Clarified thread model in the security policy (which applies to all repos in this org). #49 Props @​edorian.
• All workflows: the permissions needed for each (reusable) job are now explicitly set and documented. #53 It is recommended for repositories using the reusable workflows to apply the recommended permissions to their jobs as well. The recommended permissions are as follows:
  • reusable-findtokenprops.yml: contents: read
  • reusable-markdownlint.yml: contents: read
  • reusable-pinact.yml: contents: read
  • reusable-phpstan.yml: contents: read
  • reusable-remark.yml: contents: read
  • reusable-yamllint.yml: contents: read
• All workflows will now respect a 10 day "cooldown" period before external action runners are updated to a new version. #50
• reusable-phpstan.yml: the workflow will now fail early if PHPStan could not be acquired. #48
• reusable-markdownlint.yml: DavidAnson/markdownlint-cli2-action was bumped from v24.1.0 to v24.2.0.
• reusable-remark.yml: reviewdog/action-remark-lint was bumped from v5.18.0 to v5.20.0.
• Minor documentation improvements.

• 559f404 README: list available reusable workflows alphabetically
• ac0489b GH Actions: Bump reviewdog/action-remark-lint
• ee193c0 README: improve formatting for readability
• 47f9487 QA: add pinact GHA job and configuration
• 37fff7f New reusable workflow to run the Pinact tool
• b1c1d33 GH Actions: set permissions for each workflow/job (#53)
• 2a9d449 Propose Trust/Thread model section in SECURITY.md (#49)
• 5544c3c GH Actions: Bump DavidAnson/markdownlint-cli2-action
• 58b7623 Dependabot: add cooldown period
• 1f74e60 GH Actions: fail "setup-php" if requested tooling could not be installed
• See full diff in compare view

Sourced from PHPCSStandards/.github/.github/workflows/reusable-yamllint.yml's releases.

v1.3.0 - 2026-10-04

Added

• New reusable workflow: "reusable-pinact". #52 This workflow will verify that any action runners used in GitHub actions workflows are pinned and that these pins are correct and follow specified "cooldown" rules. To start using this workflow, add a .pinact.yaml file to a repository and add a GHA job referencing the reusable workflow.

Changed

• Clarified thread model in the security policy (which applies to all repos in this org). #49 Props @​edorian.
• All workflows: the permissions needed for each (reusable) job are now explicitly set and documented. #53 It is recommended for repositories using the reusable workflows to apply the recommended permissions to their jobs as well. The recommended permissions are as follows:
  • reusable-findtokenprops.yml: contents: read
  • reusable-markdownlint.yml: contents: read
  • reusable-pinact.yml: contents: read
  • reusable-phpstan.yml: contents: read
  • reusable-remark.yml: contents: read
  • reusable-yamllint.yml: contents: read
• All workflows will now respect a 10 day "cooldown" period before external action runners are updated to a new version. #50
• reusable-phpstan.yml: the workflow will now fail early if PHPStan could not be acquired. #48
• reusable-markdownlint.yml: DavidAnson/markdownlint-cli2-action was bumped from v24.1.0 to v24.2.0.
• reusable-remark.yml: reviewdog/action-remark-lint was bumped from v5.18.0 to v5.20.0.
• Minor documentation improvements.

• 559f404 README: list available reusable workflows alphabetically
• ac0489b GH Actions: Bump reviewdog/action-remark-lint
• ee193c0 README: improve formatting for readability
• 47f9487 QA: add pinact GHA job and configuration
• 37fff7f New reusable workflow to run the Pinact tool
• b1c1d33 GH Actions: set permissions for each workflow/job (#53)
• 2a9d449 Propose Trust/Thread model section in SECURITY.md (#49)
• 5544c3c GH Actions: Bump DavidAnson/markdownlint-cli2-action
• 58b7623 Dependabot: add cooldown period
• 1f74e60 GH Actions: fail "setup-php" if requested tooling could not be installed
• See full diff in compare view

Sourced from PHPCSStandards/.github/.github/workflows/reusable-findtokenprops.yml's releases.

v1.3.0 - 2026-10-04

Added

• New reusable workflow: "reusable-pinact". #52 This workflow will verify that any action runners used in GitHub actions workflows are pinned and that these pins are correct and follow specified "cooldown" rules. To start using this workflow, add a .pinact.yaml file to a repository and add a GHA job referencing the reusable workflow.

Changed

• Clarified thread model in the security policy (which applies to all repos in this org). #49 Props @​edorian.
• All workflows: the permissions needed for each (reusable) job are now explicitly set and documented. #53 It is recommended for repositories using the reusable workflows to apply the recommended permissions to their jobs as well. The recommended permissions are as follows:
  • reusable-findtokenprops.yml: contents: read
  • reusable-markdownlint.yml: contents: read
  • reusable-pinact.yml: contents: read
  • reusable-phpstan.yml: contents: read
  • reusable-remark.yml: contents: read
  • reusable-yamllint.yml: contents: read
• All workflows will now respect a 10 day "cooldown" period before external action runners are updated to a new version. #50
• reusable-phpstan.yml: the workflow will now fail early if PHPStan could not be acquired. #48
• reusable-markdownlint.yml: DavidAnson/markdownlint-cli2-action was bumped from v24.1.0 to v24.2.0.
• reusable-remark.yml: reviewdog/action-remark-lint was bumped from v5.18.0 to v5.20.0.
• Minor documentation improvements.

• 559f404 README: list available reusable workflows alphabetically
• ac0489b GH Actions: Bump reviewdog/action-remark-lint
• ee193c0 README: improve formatting for readability
• 47f9487 QA: add pinact GHA job and configuration
• 37fff7f New reusable workflow to run the Pinact tool
• b1c1d33 GH Actions: set permissions for each workflow/job (#53)
• 2a9d449 Propose Trust/Thread model section in SECURITY.md (#49)
• 5544c3c GH Actions: Bump DavidAnson/markdownlint-cli2-action
• 58b7623 Dependabot: add cooldown period
• 1f74e60 GH Actions: fail "setup-php" if requested tooling could not be installed
• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions