From ac9ebeb09bc71fd0523654c767048260efa6bd7b Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Tue, 18 Nov 2025 15:14:23 +0100
Subject: [PATCH] ci: improve security of all workflows

---
 .github/workflows/lock-threads.yaml  |  7 ++++++-
 .github/workflows/stale-threads.yaml | 20 ++++++++++++--------
 .github/workflows/tests.yaml         | 23 ++++++++++++++---------
 3 files changed, 32 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/lock-threads.yaml b/.github/workflows/lock-threads.yaml
index 9ed352353..42d46a28e 100644
--- a/.github/workflows/lock-threads.yaml
+++ b/.github/workflows/lock-threads.yaml
@@ -2,7 +2,12 @@ name: Lock inactive threads
 
 on:
   schedule:
-    - cron: '0 1 * * *'
+    - cron: "0 1 * * *"
+
+permissions:
+  issues: write
+  discussions: write
+  pull-requests: write
 
 jobs:
   lock-threads:
diff --git a/.github/workflows/stale-threads.yaml b/.github/workflows/stale-threads.yaml
index 2750678c4..ba86270a8 100644
--- a/.github/workflows/stale-threads.yaml
+++ b/.github/workflows/stale-threads.yaml
@@ -2,29 +2,33 @@ name: Manage stale threads
 
 on:
   schedule:
-    - cron: '0 2 * * *'
+    - cron: "0 2 * * *"
+
+permissions:
+  issues: write
+  pull-requests: write
 
 jobs:
   stale-threads:
     runs-on: ubuntu-latest
     steps:
       - name: Manage stale threads (Issues & PRs)
-        uses: actions/stale@v9
+        uses: actions/stale@v10
         with:
           stale-issue-message: |
             This issue has been marked as stale due to inactivity. It will be automatically closed in 7 days if no update is received.
-            
+
             Please provide the requested information to keep the issue active.
           stale-pr-message: |
             This pull request has been marked as stale due to inactivity. It will be automatically closed in 7 days if no update is received.
-            
+
             To keep this PR active:
             - Update your changes based on the requested feedback
             - Leave a comment with your progress or questions
           days-before-stale: 14
-          stale-issue-label: '⏱︎ Stale'
-          stale-pr-label: '⏱︎ Stale'
-          only-labels: '💤 Waiting for feedback, 💤 Waiting for changes'
+          stale-issue-label: "⏱︎ Stale"
+          stale-pr-label: "⏱︎ Stale"
+          only-labels: "💤 Waiting for feedback, 💤 Waiting for changes"
           remove-stale-when-updated: true
           operations-per-run: 100
-          labels-to-remove-when-unstale: '⏱︎ Stale, 💤 Waiting for feedback, 💤 Waiting for changes'
+          labels-to-remove-when-unstale: "⏱︎ Stale, 💤 Waiting for feedback, 💤 Waiting for changes"
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 75d5f9b87..26af15ff8 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -3,7 +3,10 @@ name: Tests
 on:
   push:
     branches:
-      - '**v5.x**'
+      - "**v5.x**"
+
+permissions:
+  contents: read
 
 jobs:
   composer-validate:
@@ -11,13 +14,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
-    
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4'
-    
+          php-version: "8.4"
+
       - name: Validate composer.json
         run: composer validate --check-lock --strict
 
@@ -32,7 +37,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4'
+          php-version: "8.4"
 
       - name: Cache Composer packages
         id: composer-cache
@@ -55,7 +60,7 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-      
+
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
@@ -74,12 +79,12 @@ jobs:
       - name: Setup PHP with Xdebug
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4'
+          php-version: "8.4"
           coverage: xdebug
 
       # - name: Install aspell
       #   run: sudo apt-get update && sudo apt-get install -y aspell aspell-en
-      
+
       - name: Cache Composer packages
         id: composer-cache
         uses: actions/cache@v4