feat: update actions

.github/actions/setup-magento/action.yml

@@ -0,0 +1,136 @@
+name: Set up Magento
+description: >-
+  Provisions a Magento install for CI: sets up PHP + Composer, restores the
+  Composer download cache, fetches Magento (git clone or the Mage-OS mirror) and
+  runs `bin/magento setup:install`. The calling job must provide the MySQL/MariaDB
+  and OpenSearch service containers (reachable at 127.0.0.1:3306 / localhost:9200).
+  Leaves a ready install in ./magento2 next to the checked-out module.
+
+inputs:
+  php-version:
+    description: PHP version passed to shivammathur/setup-php.
+    required: true
+  magento-version:
+    description: >-
+      Magento version. With magento-source=git it is the branch/tag to clone.
+      With magento-source=mage-os it pins `composer create-project` to that
+      release (falling back to the latest stable only if the mirror lacks that
+      exact version). Also namespaces the Composer cache.
+    required: true
+  magento-source:
+    description: >-
+      How to fetch Magento: "git" (github.com/magento/magento2) or "mage-os"
+      (composer create-project via the Mage-OS mirror).
+    required: false
+    default: git
+  php-extensions:
+    description: PHP extensions to install.
+    required: false
+    default: mbstring, intl, gd, xml, soap, zip, bcmath, pdo_mysql, curl, sockets
+  composer-auth:
+    description: >-
+      COMPOSER_AUTH JSON (Magento Marketplace keys) for authenticated Composer
+      downloads. Pass the calling workflow's secrets.COMPOSER_AUTH secret.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    # Fail fast on a bad magento-source: otherwise both download steps' `if`
+    # conditions are false, no magento2/ is created, and the failure only
+    # surfaces later as a confusing "working-directory magento2 not found".
+    - name: Validate inputs
+      shell: bash
+      env:
+        MAGENTO_SOURCE: ${{ inputs.magento-source }}
+      run: |
+        case "$MAGENTO_SOURCE" in
+          git | mage-os) ;;
+          *)
+            echo "::error::Invalid magento-source '${MAGENTO_SOURCE}' (expected 'git' or 'mage-os')"
+            exit 1
+            ;;
+        esac
+
+    - name: Setup PHP
+      uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
+      with:
+        php-version: ${{ inputs.php-version }}
+        extensions: ${{ inputs.php-extensions }}
+        tools: composer:v2
+
+    # Caches ~/.composer/cache/files — Composer's content-addressed download
+    # cache, not a resolved dependency set. If the mage-os fallback installs a
+    # different release than magento-version implies, a mismatched key only
+    # causes cache misses (re-downloads), never an incorrect install: Composer
+    # always installs exactly what composer.json resolves to.
+    - name: Cache Composer packages
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ~/.composer/cache/files
+        key: ${{ runner.os }}-composer-${{ inputs.magento-version }}-${{ hashFiles('**/composer.json') }}
+        restore-keys: ${{ runner.os }}-composer-${{ inputs.magento-version }}
+
+    - name: Download Magento (git clone)
+      if: ${{ inputs.magento-source == 'git' }}
+      shell: bash
+      run: |
+        # Assign to a shell variable and quote it so an unexpected value can't
+        # word-split or glob into extra git arguments.
+        version="${{ inputs.magento-version }}"
+        git clone --depth=1 --branch="$version" \
+          https://github.com/magento/magento2.git magento2
+
+    - name: Download Magento (Mage-OS mirror)
+      if: ${{ inputs.magento-source == 'mage-os' }}
+      shell: bash
+      env:
+        COMPOSER_AUTH: ${{ inputs.composer-auth }}
+      run: |
+        # Pin create-project to the requested version so runs are reproducible,
+        # falling back to the latest stable only if the mirror lacks that exact
+        # release. --no-install: scaffold only here; the "Install Magento" step
+        # below installs dependencies exactly once (with COMPOSER_AUTH), instead
+        # of create-project installing them unauthenticated and the install step
+        # installing them a second time.
+        mirror=https://mirror.mage-os.org/
+        version="${{ inputs.magento-version }}"
+        if ! composer create-project --no-install --repository-url="$mirror" \
+          magento/project-community-edition magento2 "$version"; then
+          echo "::warning::Mage-OS mirror has no project-community-edition ${version}; using latest stable"
+          rm -rf magento2
+          composer create-project --no-install --repository-url="$mirror" \
+            magento/project-community-edition magento2
+        fi
+
+    - name: Install Magento
+      working-directory: magento2
+      shell: bash
+      env:
+        COMPOSER_AUTH: ${{ inputs.composer-auth }}
+      run: |
+        composer config minimum-stability stable
+        composer config prefer-stable true
+        composer install --no-interaction --no-progress
+        bin/magento setup:install \
+          --base-url=http://localhost \
+          --db-host=127.0.0.1 \
+          --db-name=magento \
+          --db-user=root \
+          --db-password=magento \
+          --admin-firstname=Admin \
+          --admin-lastname=User \
+          --admin-email=admin@example.com \
+          --admin-user=admin \
+          --admin-password=admin12345 \
+          --language=en_US \
+          --currency=USD \
+          --timezone=Europe/Berlin \
+          --use-rewrites=1 \
+          --backend-frontname=admin \
+          --search-engine=opensearch \
+          --opensearch-host=localhost \
+          --opensearch-port=9200 \
+          --opensearch-index-prefix=magento \
+          --cleanup-database

.github/workflows/functional-tests.yml

@@ -2,11 +2,16 @@ name: Functional Tests
 
 on:
   pull_request:
-    branches: [main]
   push:
     branches: [main]
   workflow_dispatch:
 
+concurrency:
+  # Heavy Magento bootstrap — cancel superseded PR runs to save CI minutes;
+  # let push/main runs finish so main is always validated directly.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
@@ -42,63 +47,22 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           path: mageforge
 
-      - name: Setup PHP
-        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f
-        with:
-          php-version: "8.4"
-          extensions: mbstring, intl, gd, xml, soap, zip, bcmath, pdo_mysql, curl, sockets
-          tools: composer:v2
-
       - name: Setup Node.js
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           node-version: "20"
 
-      - name: Cache Composer packages
-        id: composer-cache
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684
+      - name: Set up Magento
+        uses: ./mageforge/.github/actions/setup-magento
         with:
-          path: ~/.composer/cache/files
-          key: ${{ runner.os }}-composer-functional-${{ hashFiles('**/composer.json') }}
-          restore-keys: ${{ runner.os }}-composer-functional
-
-      - name: Clone Magento
-        run: |
-          git clone --depth=1 --branch=2.4.8 https://github.com/magento/magento2.git magento2
-
-      - name: Install Magento
-        working-directory: magento2
-        env:
-          COMPOSER_AUTH: ${{ secrets.COMPOSER_AUTH }}
-        run: |
-          composer config minimum-stability stable
-          composer config prefer-stable true
-          composer install --no-interaction --no-progress
-          bin/magento setup:install \
-            --base-url=http://localhost \
-            --db-host=127.0.0.1 \
-            --db-name=magento \
-            --db-user=root \
-            --db-password=magento \
-            --admin-firstname=Admin \
-            --admin-lastname=User \
-            --admin-email=admin@example.com \
-            --admin-user=admin \
-            --admin-password=admin12345 \
-            --language=en_US \
-            --currency=USD \
-            --timezone=Europe/Berlin \
-            --use-rewrites=1 \
-            --backend-frontname=admin \
-            --search-engine=opensearch \
-            --opensearch-host=localhost \
-            --opensearch-port=9200 \
-            --opensearch-index-prefix=magento \
-            --cleanup-database
+          php-version: "8.4"
+          magento-version: 2.4.8
+          magento-source: git
+          composer-auth: ${{ secrets.COMPOSER_AUTH }}
 
       - name: Install MageForge Module
         working-directory: magento2

.github/workflows/label.yml

@@ -6,6 +6,12 @@
 name: Labeler
 on: [pull_request_target]
 
+concurrency:
+  # One labeling run per PR; a newer event on the same PR supersedes an
+  # in-flight one so labels can't race each other.
+  group: labeler-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -18,7 +24,7 @@ jobs:
 
     steps:
       - name: Label by changed files and branch name
-        uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5
+        uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
 

.github/workflows/lint.yml

@@ -4,6 +4,13 @@ on:
   pull_request:
   push:
     branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  # Cancel superseded PR runs to save CI minutes; let push/main runs finish so
+  # main is always validated directly (catches anything pushed straight to main).
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: read
@@ -15,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Set up PHP
         uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
@@ -24,7 +31,7 @@ jobs:
           tools: composer:v2
 
       - name: Cache Composer packages
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.composer/cache/files
           key: ${{ runner.os }}-composer-lint-${{ hashFiles('composer.json') }}
@@ -44,11 +51,18 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      checks: write
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
+      # save-annotations stores findings as an artifact instead of posting them
+      # to the GitHub Checks API. That avoids the *second* check-run that used to
+      # duplicate this job's red status — and the 403 it would otherwise throw
+      # without `checks: write`. Findings still print in the job log and fail
+      # this job via its exit code; grant `checks: write` + drop this only if you
+      # want inline PR annotations (and the extra check-run) back.
       - name: Trunk Check
         uses: trunk-io/trunk-action@04ba50e7658c81db7356da96657e6e77f220bfa3 # v1.3.1
+        with:
+          save-annotations: true