Lint / Deploy (push) Successful in 4s
Lint / Notify on failure (push) Has been skipped
Lint / PHP (phpcs PSR-12) (push) Successful in 34s
Lint / JS (eslint) (push) Successful in 9s
Lint / PHP requirements (version + extensions) (push) Successful in 44s
Security / PHP Security (semgrep) (push) Successful in 2m48s
semgrep's github-actions-mutable-action-tag rule (now running, after the pip install was fixed) flags actions/checkout@v3 as a mutable tag that could be repointed upstream (supply-chain risk). Pin all four uses to the SHA the v3 tag currently resolves to (v3.6.0), preserving behavior. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>