Chore/supply chain security

.github/dependabot.yml

@@ -8,6 +8,11 @@ updates:
     labels:
       - "dependencies"
       - "php"
+    cooldown:
+      default-days: 5
+      semver-major-days: 7
+      semver-minor-days: 5
+      semver-patch-days: 3
 
   - package-ecosystem: "github-actions"
     directory: "/"
@@ -17,3 +22,5 @@ updates:
     labels:
       - "dependencies"
       - "github-actions"
+    cooldown:
+      default-days: 5

.github/workflows/fix-style.yml

@@ -22,6 +22,9 @@ on:
       - 'composer.json'
       - '.github/workflows/fix-style.yml'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -34,10 +37,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.3'
           extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv

.github/workflows/phpstan.yml

@@ -8,7 +8,6 @@ on:
     paths:
       - 'src/**'
       - 'composer.json'
-      - 'composer.lock'
       - 'phpstan.neon'
       - '.github/workflows/phpstan.yml'
   pull_request:
@@ -18,10 +17,12 @@ on:
     paths:
       - 'src/**'
       - 'composer.json'
-      - 'composer.lock'
       - 'phpstan.neon'
       - '.github/workflows/phpstan.yml'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -34,10 +35,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.3'
           extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv

.github/workflows/run-tests.yml

@@ -11,7 +11,6 @@ on:
       - 'workbench/**'
       - 'resources/**'
       - 'composer.json'
-      - 'composer.lock'
       - 'phpunit.xml.dist'
       - '.github/workflows/run-tests.yml'
   pull_request:
@@ -24,10 +23,12 @@ on:
       - 'workbench/**'
       - 'resources/**'
       - 'composer.json'
-      - 'composer.lock'
       - 'phpunit.xml.dist'
       - '.github/workflows/run-tests.yml'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -40,15 +41,20 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.3'
           coverage: none
 
-      - name: Check dependency advisories
+      - name: Resolve dependency graph without installing
+        run: composer update --no-install --no-scripts --no-plugins --no-audit --prefer-stable --no-interaction --no-progress --ansi
+
+      - name: Check resolved dependency advisories
         run: composer audit --locked
 
   test:
@@ -71,10 +77,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: ${{ matrix.php }}
           extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv
@@ -90,25 +98,3 @@ jobs:
 
       - name: Execute tests
         run: vendor/bin/pest --ci
-
-  locked-test:
-    name: PHP 8.3 - locked dependencies
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
-
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: '8.3'
-          extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv
-          coverage: none
-
-      - name: Install locked dependencies
-        run: composer install --prefer-dist --no-interaction --ansi
-
-      - name: Execute tests against the release lockfile
-        run: vendor/bin/pest --ci

.gitignore

@@ -1,5 +1,6 @@
 /vendor/
 /node_modules/
+/composer.lock
 .phpunit.result.cache
 .pest.cache
 .phpunit.cache/
@@ -24,4 +25,3 @@ Thumbs.db
 
 # Internal Requirements & Platform Specifications
 /requirements/
-

CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Marketplace thumbnail with an explicit AI-generated artwork attribution.
+
+### Changed
+
+- The library no longer commits `composer.lock`; CI resolves dependencies from
+  the declared constraints for every run and audits the generated lock file.
+
+### Security
+
+- Pinned all third-party GitHub Actions to immutable full commit SHAs.
+- Added Dependabot cooldowns of at least three days for Composer and GitHub
+  Actions updates to reduce exposure to newly compromised releases.
+- Restricted GitHub Actions tokens to read-only repository contents and stopped
+  checkout credentials from persisting in the job workspace.
+
 ## [1.3.0] - 2026-09-14
 
 ### Added

CONTRIBUTING.md

@@ -15,9 +15,13 @@ Clone the repository and install dependencies:
 ```bash
 git clone https://github.com/allgorithm/filament-actionguard.git
 cd filament-actionguard
-composer install
+composer update
 ```
 
+As this repository contains a reusable library, `composer.lock` is generated
+locally but is not committed. CI resolves the supported dependency ranges on
+every run, including a `prefer-lowest` test job.
+
 ### Running Tests
 
 We use [Pest](https://pestphp.com) for testing:

art/ATTRIBUTION.md

@@ -1,6 +1,7 @@
 # Artwork attribution and AI disclosure
 
-`avatar.png` and `banner.png` were generated with AI for Filament ActionGuard.
+`avatar.png`, `banner.png`, and `filament-actionguard-thumbnail-v1.jpg` were
+generated with AI for Filament ActionGuard.
 
 They are project artwork, not third-party stock assets, and are distributed with
 this repository under the project MIT license. This disclosure is informational

composer.json

@@ -94,6 +94,7 @@
             "/.env.example",
             "/.gitattributes",
             "/.gitignore",
+            "/composer.lock",
             "/phpstan.neon",
             "/phpunit.xml.dist",
             "/testbench.yaml"
@@ -117,7 +118,10 @@
             "@php vendor/bin/phpstan analyse --verbose --ansi --memory-limit=512M"
         ],
         "format": "@php vendor/bin/pint --ansi",
-        "security-audit": "@composer audit --locked",
+        "security-audit": [
+            "@composer update --no-install --no-scripts --no-plugins --no-audit --prefer-stable --no-interaction --no-progress",
+            "@composer audit --locked"
+        ],
         "test": "@php vendor/bin/pest"
     }
 }