From 40b41d0a1a6115c5fb3a5efef61eacecdf25af7c Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Thu, 22 Oct 2026 19:01:46 +0000
Subject: [PATCH] ci: confine pip and Composer dependency trust

---
 .github/workflows/ci.yml | 32 ++++++++++++++++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dbae14d..498deae 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,7 +32,7 @@ jobs:
         with:
           python-version: "3.13"
       - name: Bootstrap patched pip trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10  # patched-pip
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
       - name: Install policy dependencies
         run: >-
           python -m pip install --only-binary :all: PyYAML==6.0.2
@@ -73,12 +73,25 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.13'
+
+      - name: Select authenticated dependency trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust
+        with:
+          clients: pip,python,composer,curl,git
+
       - name: Set up PHP
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240  # v2
         with:
           php-version: ${{ matrix.php }}
           coverage: none
-          tools: composer:v2
+          tools: composer:2.10.3
+
+      - name: Verify Composer trust before selecting compatibility dependencies
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust
 
       - name: Select compatibility dependencies
         run: |
@@ -87,18 +100,33 @@ jobs:
             "orchestra/testbench:${{ matrix.testbench }}" \
             "phpunit/phpunit:${{ matrix.phpunit }}"
 
+      - name: Verify Composer trust before dependency requests
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust
+
       - name: Install dependencies
         run: composer update --prefer-dist --no-progress --no-interaction
 
+      - name: Verify Composer trust before validation
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust
+
       - name: Validate package metadata
         run: composer validate --strict --no-check-all
 
+      - name: Verify Composer trust before formatting scripts
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust
+
       - name: Check formatting
         run: composer format
 
+      - name: Verify Composer trust before analysis scripts
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust
+
       - name: Run static analysis
         run: composer stan
 
+      - name: Verify Composer trust before test scripts
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust
+
       - name: Run tests
         run: composer test