v1.3.0 - 2026-10-04

Added

• New reusable workflow: "reusable-pinact". #52
  This workflow will verify that any action runners used in GitHub actions workflows are pinned and that these pins are correct and follow specified "cooldown" rules.
  To start using this workflow, add a .pinact.yaml file to a repository and add a GHA job referencing the reusable workflow.

Changed

• Clarified thread model in the security policy (which applies to all repos in this org). #49 Props @edorian.
• All workflows: the permissions needed for each (reusable) job are now explicitly set and documented. #53
  It is recommended for repositories using the reusable workflows to apply the recommended permissions to their jobs as well.
  The recommended permissions are as follows:
  • reusable-findtokenprops.yml: contents: read
  • reusable-markdownlint.yml: contents: read
  • reusable-pinact.yml: contents: read
  • reusable-phpstan.yml: contents: read
  • reusable-remark.yml: contents: read
  • reusable-yamllint.yml: contents: read
• All workflows will now respect a 10 day "cooldown" period before external action runners are updated to a new version. #50
• reusable-phpstan.yml: the workflow will now fail early if PHPStan could not be acquired. #48
• reusable-markdownlint.yml: DavidAnson/markdownlint-cli2-action was bumped from v24.1.0 to v24.2.0.
• reusable-remark.yml: reviewdog/action-remark-lint was bumped from v5.18.0 to v5.20.0.
• Minor documentation improvements.

v1.2.2 - 2026-07-20

Changed

• All workflows: actions/checkout was bumped from v7.0.0 to v7.0.1.
• reusable-markdownlint.yml: DavidAnson/markdownlint-cli2-action was bumped from v24.0.0 to v24.1.0.
• reusable-remark.yml: actions/setup-node was bumped from v6.4.0 to v7.0.0.

v1.2.1 - 2026-07-05

Changed

• All workflows: actions/checkout was bumped from v6.0.2 to v7.0.0.
• reusable-markdownlint.yml: DavidAnson/markdownlint-cli2-action was bumped from v23.2.0 to v24.0.0.

v1.2.0 - 2026-06-20

Changed

• reusable-remark.yml: now uses Node 24 to install Remark and the relevant add-on extensions. Props @rodrigoprimo.
• reusable-markdownlint.yml: DavidAnson/markdownlint-cli2-action was bumped from v23.0.0 to v23.2.0.
• reusable-phpstan.yml: shivammathur/setup-php was bumped from v2.37.0 to v2.37.2.
• reusable-remark.yml: actions/setup-node was bumped from v6.3.0 to v6.4.0.

v1.1.3 - 2026-04-04

Changed

• (Nearly) All workflows: andstor/file-existence-action was bumped from v3.0.0 to v3.1.0.
• reusable-markdownlint.yml: DavidAnson/markdownlint-cli2-action was bumped from v22.0.0 to v23.0.0.

v1.1.2 - 2026-03-21

Changed

• reusable-phpstan.yml: ramsey/composer-install was bumped from v3.1.1 to v4.0.0.
• reusable-phpstan.yml: shivammathur/setup-php was bumped from v2.36.0 to v2.37.0.

Both these version bumps means the action runners now run on Node 24.

v1.1.1 - 2026-03-05

Fixed

• The config file matching was broken for the reusable-markdownlint.yml, reusable-phpstan.yml and the reusable-yamllint.yml workflows, causing the actual linting tasks in these workflows to no longer run. #30, fixed via #31.
  Thanks @james-cnz for reporting!

Changed

• All workflows: actions/checkout was bumped from v6.0.1 to v6.0.2.
• reusable-remark.yml: actions/setup-node was bumped from v6.1.0 to v6.3.0.

v1.1.0 - 2025-12-24

Added

• New reusable workflow: "find token properties". #27
  This workflow will flag the use of the static Tokens class properties, which can be replaced with the corresponding class constants.
  The target audience for this workflow is codebases which have dropped support for PHP_CodeSniffer 3.x.

v1.0.0 - 2025-12-22

• Initial release.