Harden GitHub workflows

.github/dependabot.yml

@@ -4,13 +4,17 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
-    # Too noisy. See https://github.community/t/increase-if-necessary-for-github-actions-in-dependabot/179581
-    open-pull-requests-limit: 0
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    ignore:
+      - dependency-name: "yiisoft/*"
 
   # Maintain dependencies for Composer
   - package-ecosystem: "composer"
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
     versioning-strategy: increase-if-necessary

.github/workflows/build.yml

@@ -22,20 +22,29 @@ on:
 
 name: build
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
 jobs:
   phpunit:
+    name: phpunit
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
+        with:
+          persist-credentials: false
       - name: Build
         working-directory: ./tests
         run: docker compose build
       - name: PHP Unit tests coverage
         working-directory: ./tests
         run: docker compose run --rm php-cli vendor/bin/phpunit --coverage-clover ./tests/runtime/coverage.xml
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
         with:
           verbose: true
           files: ./tests/runtime/coverage.xml

.github/workflows/composer-require-checker.yml

@@ -24,6 +24,8 @@ on:
 
 name: Composer require checker
 
+permissions:
+  contents: read
 jobs:
   composer-require-checker:
     uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@master

.github/workflows/mutation.yml

@@ -20,14 +20,21 @@ on:
 
 name: mutation test
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   mutation:
+    name: mutation
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
       - name: Mutation tests
         run: make mutation

.github/workflows/rector.yml

@@ -11,14 +11,21 @@ on:
 
 name: rector
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   rector:
+    name: rector
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
       - name: Rector
         run: make rector

.github/workflows/static.yml

@@ -22,6 +22,8 @@ on:
 
 name: static analysis
 
+permissions:
+  contents: read
 jobs:
   psalm:
     uses: yiisoft/actions/.github/workflows/psalm.yml@master

.github/workflows/zizmor.yml

@@ -0,0 +1,22 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches:
+      - master
+      - main
+    paths:
+      - '.github/**.yml'
+      - '.github/**.yaml'
+  pull_request:
+    paths:
+      - '.github/**.yml'
+      - '.github/**.yaml'
+
+permissions:
+  actions: read # Required by zizmor when reading workflow metadata through the API.
+  contents: read # Required to read workflow files.
+
+jobs:
+  zizmor:
+    uses: yiisoft/actions/.github/workflows/zizmor.yml@master

src/Adapter.php

@@ -9,7 +9,7 @@
 use Yiisoft\Queue\Cli\LoopInterface;
 use Yiisoft\Queue\Message\IdEnvelope;
 use Yiisoft\Queue\Message\MessageInterface;
-use Yiisoft\Queue\Message\MessageSerializerInterface;
+use Yiisoft\Queue\Message\Serializer\MessageSerializerInterface;
 use Yiisoft\Queue\MessageStatus;
 
 final class Adapter implements AdapterInterface
@@ -63,7 +63,7 @@ public function status(int|string $id): MessageStatus
     public function push(MessageInterface $message): MessageInterface
     {
         $payload = $this->serializer->serialize($message);
-        $id = $this->provider->pushMessage($payload, $message->getMetadata());
+        $id = $this->provider->pushMessage($payload, $message->getMeta());
         return new IdEnvelope($message, $id);
     }
 

src/Message/Message.php

@@ -6,14 +6,19 @@
 
 use Yiisoft\Queue\Message\MessageInterface;
 
+/**
+ * @psalm-import-type MessageMeta from MessageInterface
+ * @psalm-import-type MessagePayload from MessageInterface
+ */
 final class Message implements MessageInterface
 {
     /**
-     * @param array<string, mixed> $metadata
+     * @psalm-param MessagePayload $data
+     * @psalm-param MessageMeta $metadata
      */
     public function __construct(
         private string $handlerName,
-        private mixed $data,
+        private bool|int|float|string|array|null $data,
         private array $metadata,
         private int $delay = 0 //delay in seconds
     ) {
@@ -44,16 +49,29 @@ public function getData(): mixed
         return $this->data;
     }
 
+    public function getPayload(): bool|int|float|string|array|null
+    {
+        return $this->data;
+    }
+
     /**
-     * @return array<string, mixed>
+     * @psalm-return MessageMeta
      */
     public function getMetadata(): array
     {
         return $this->metadata;
     }
 
     /**
-     * @param array<string, mixed> $metadata
+     * @psalm-return MessageMeta
+     */
+    public function getMeta(): array
+    {
+        return $this->metadata;
+    }
+
+    /**
+     * @psalm-param MessageMeta $metadata
      */
     public function withMetadata(array $metadata): static
     {
@@ -62,8 +80,54 @@ public function withMetadata(array $metadata): static
         return $message;
     }
 
+    /**
+     * @psalm-param MessageMeta $meta
+     */
+    public function withMeta(array $meta): static
+    {
+        return $this->withMetadata($meta);
+    }
+
     public static function fromData(string $type, mixed $data): self
     {
+        self::assertPayload($data);
         return new self($type, $data, []);
     }
+
+    public static function fromPayload(string $type, bool|int|float|string|array|null $payload): self
+    {
+        return new self($type, $payload, []);
+    }
+
+    /**
+     * @psalm-assert MessagePayload $payload
+     */
+    private static function assertPayload(mixed $payload): void
+    {
+        if (!self::isPayload($payload)) {
+            throw new \InvalidArgumentException('Payload must contain only null, scalar values, and arrays of them.');
+        }
+    }
+
+    /**
+     * @psalm-assert-if-true MessagePayload $payload
+     */
+    private static function isPayload(mixed $payload): bool
+    {
+        if ($payload === null || is_scalar($payload)) {
+            return true;
+        }
+
+        if (!is_array($payload)) {
+            return false;
+        }
+
+        foreach ($payload as $value) {
+            if (!self::isPayload($value)) {
+                return false;
+            }
+        }
+
+        return true;
+    }
 }

src/QueueProvider.php

@@ -26,6 +26,8 @@ public function __construct(
     }
 
     /**
+     * @param array<string, array|bool|float|int|string|null> $metadata
+     *
      * @throws RedisException
      */
     public function pushMessage(string $message, array $metadata = []): int

src/QueueProviderInterface.php

@@ -6,6 +6,9 @@
 
 interface QueueProviderInterface
 {
+    /**
+     * @param array<string, array|bool|float|int|string|null> $metadata
+     */
     public function pushMessage(string $message, array $metadata = []): int;
 
     /**

tests/Integration/QueueProviderTest.php

@@ -36,7 +36,7 @@ public function test__construct(): QueueProvider
     public function testDelay(QueueProvider $provider): void
     {
         $message = new Message('test', ['key' => 'value'], [], 2);
-        $id = $provider->pushMessage(json_encode($message->getData(), JSON_THROW_ON_ERROR), $message->getMetadata());
+        $id = $provider->pushMessage(json_encode($message->getPayload(), JSON_THROW_ON_ERROR), $message->getMeta());
         $this->assertGreaterThan(0, $id);
         $reserv = $provider->reserve($id);
         $this->assertNull($reserv);

tests/Integration/QueueTest.php

@@ -6,10 +6,11 @@
 
 use Yiisoft\Queue\Adapter\AdapterInterface;
 use Yiisoft\Queue\Cli\LoopInterface;
-use Yiisoft\Queue\Message\JsonMessageSerializer;
 use Yiisoft\Queue\Message\GenericMessage as Message;
 use Yiisoft\Queue\Message\MessageInterface;
-use Yiisoft\Queue\Message\MessageSerializerInterface;
+use Yiisoft\Queue\Message\Serializer\JsonMessageEncoder;
+use Yiisoft\Queue\Message\Serializer\MessageSerializer;
+use Yiisoft\Queue\Message\Serializer\MessageSerializerInterface;
 use Yiisoft\Queue\MessageStatus;
 use Yiisoft\Queue\Queue;
 use Yiisoft\Queue\Redis\Adapter;
@@ -65,7 +66,7 @@ public function testStatus(): void
 
         $mockReserved = $this->createMock(QueueProviderInterface::class);
         $mockReserved->method('existInReserved')->willReturn(true);
-        $adapter = new Adapter($mockReserved, new JsonMessageSerializer(), $this->getLoop());
+        $adapter = new Adapter($mockReserved, new MessageSerializer(new JsonMessageEncoder()), $this->getLoop());
 
         $status = $adapter->status('1');
         $this->assertEquals(MessageStatus::RESERVED, $status);
@@ -83,7 +84,7 @@ public function testListen(): void
         $adapter = new Adapter(
             $queueProvider
                 ->withChannelName('yii-queue'),
-            new JsonMessageSerializer(),
+            new MessageSerializer(new JsonMessageEncoder()),
             $mockLoop,
         );
         $queue = $this->getDefaultQueue($adapter);
@@ -131,7 +132,7 @@ public function testAdapterNullMessage()
 
         $adapter = new Adapter(
             $provider,
-            new JsonMessageSerializer(),
+            new MessageSerializer(new JsonMessageEncoder()),
             $mockLoop,
         );
         $notUseHandler = true;

tests/Support/ExtendedSimpleMessageHandler.php

@@ -17,7 +17,7 @@ public function __construct(private FileHelper $fileHelper)
 
     public function handle(MessageInterface $message): void
     {
-        $data = $message->getData();
+        $data = $message->getPayload();
         if (null !== $data) {
             $this->fileHelper->put($data['file_name'], $data['payload']['time']);
         }

tests/Support/IntegrationTestCase.php

@@ -11,8 +11,9 @@
 use Yiisoft\Queue\Adapter\AdapterInterface;
 use Yiisoft\Queue\Cli\LoopInterface;
 use Yiisoft\Queue\Cli\SignalLoop;
-use Yiisoft\Queue\Message\JsonMessageSerializer;
 use Yiisoft\Queue\Message\MessageInterface;
+use Yiisoft\Queue\Message\Serializer\JsonMessageEncoder;
+use Yiisoft\Queue\Message\Serializer\MessageSerializer;
 use Yiisoft\Queue\Middleware\CallableFactory;
 use Yiisoft\Queue\Middleware\Consume\ConsumeMiddlewareDispatcher;
 use Yiisoft\Queue\Middleware\Consume\ConsumeMiddlewareFactory;
@@ -91,7 +92,7 @@ protected function getMessageHandlers(): array
         return [
             'ext-simple' => [new ExtendedSimpleMessageHandler(new FileHelper()), 'handle'],
             'exception-listen' => static function (MessageInterface $message) {
-                $data = $message->getData();
+                $data = $message->getPayload();
                 if (null !== $data) {
                     throw new \RuntimeException((string) $data['payload']['time']);
                 }
@@ -134,7 +135,7 @@ protected function getAdapter(): AdapterInterface
     {
         return $this->adapter ??= new Adapter(
             $this->getQueueProvider(),
-            new JsonMessageSerializer(),
+            new MessageSerializer(new JsonMessageEncoder()),
             $this->getLoop(),
         );
     }