Organization-wide workflows

[ondrejmirtes]

@phpstan-bot Update the workflows:

• The react-on-comment workflow to ignore this issue instead of Organization-wide workflows #2
• The org-wide workflow to only react on comments on this issue instead of Organization-wide workflows #2

Please create a PR with these changes. I want to start fresh instead of having a long thread when I tried the idea and debugged it.

[phpstan-bot]

Claude finished @ondrejmirtes's task in 1m 31s —— View job • claude/issue-15-20260219-2134 • Create PR ➔

---

Updated workflow references from #2 to #15

• Gather context and understand repository structure
• Update react-on-comment workflow to ignore Organization-wide workflows #15 instead of Organization-wide workflows #2
• Update org-wide workflow to react on Organization-wide workflows #15 instead of Organization-wide workflows #2
• Commit and push changes
• Provide PR link

Changes made

• claude-react-on-comment.yml: Changed github.event.issue.number != 2 → != 15 — the react-on-comment workflow now skips this issue (Organization-wide workflows #15) instead of Organization-wide workflows #2
• claude-org-wide.yml: Changed github.event.issue.number == 2 → == 15 — the org-wide workflow now triggers only on comments on this issue (Organization-wide workflows #15)
• claude-org-wide.yml: Changed post-comment target from issues/2/comments → issues/15/comments — PR link summaries will be posted to this issue

[ondrejmirtes]

@phpstan-bot Please introduce these files to the repository:

.github/actionlint-matcher.json:

{
  "problemMatcher": [
    {
      "owner": "actionlint",
      "pattern": [
        {
          "regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
          "file": 1,
          "line": 2,
          "column": 3,
          "message": 4,
          "code": 5
        }
      ]
    }
  ]
}

.github/actionlint.yaml:

self-hosted-runner:
  # Labels of self-hosted runner in array of strings.
  labels: []

# Configuration variables in array of strings defined in your repository or
# organization. `null` means disabling configuration variables check.
# Empty array means no configuration variable is allowed.
config-variables: null

# Configuration for file paths. The keys are glob patterns to match to file
# paths relative to the repository root. The values are the configurations for
# the file paths. Note that the path separator is always '/'.
# The following configurations are available.
#
# "ignore" is an array of regular expression patterns. Matched error messages
# are ignored. This is similar to the "-ignore" command line option.
paths:
  .github/workflows/**/*.{yml,yaml}:
    # List of regular expressions to filter errors by the error messages.
    ignore:
      # Ignore the specific error from shellcheck
      - 'shellcheck reported issue in this script: SC2129:.+'

.github/workflows/lint-workflows.yml:

# Configuration from:
# https://github.com/johnbillion/plugin-infrastructure/blob/571cba96190304963285181e2b928d941b9ec7c4/.github/workflows/reusable-workflow-lint.yml

name: Lint GitHub Actions workflows
on:
  pull_request:
  push:
    branches:
      - "main"

permissions: {}

jobs:
  actionlint:
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Check workflow files
        run: |
          echo "::add-matcher::.github/actionlint-matcher.json"
          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
          ./actionlint -color
        shell: bash

  octoscan:
    name: Octoscan
    runs-on: ubuntu-latest
    permissions:
      security-events: write # Required for codeql-action/upload-sarif to upload SARIF files.
    timeout-minutes: 10
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run octoscan
        id: octoscan
        uses: synacktiv/action-octoscan@6b1cf2343893dfb9e5f75652388bd2dc83f456b0 # v1.0.0
        with:
          filter_triggers: ''

      - name: Upload SARIF file to GitHub
        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
        with:
          sarif_file: "${{steps.octoscan.outputs.sarif_output}}"
          category: octoscan
          wait-for-processing: false

  poutine:
    name: Poutine
    runs-on: ubuntu-latest
    permissions:
      security-events: write # Required for codeql-action/upload-sarif to upload SARIF files.
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Run Poutine
        uses: boostsecurityio/poutine-action@84c0a0d32e8d57ae12651222be1eb15351429228 # v0.15.2

      - name: Upload poutine SARIF file
        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
        with:
          sarif_file: results.sarif
          category: poutine
          wait-for-processing: false

  zizmor:
    name: Zizmor
    runs-on: ubuntu-latest
    permissions:
      security-events: write # Required for codeql-action/upload-sarif to upload SARIF files.
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install the latest version of uv
        uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
        with:
          enable-cache: false

      - name: Run zizmor
        run: uvx zizmor@1.20.0 --persona=auditor --format=sarif --strict-collection . > results.sarif
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
        with:
          sarif_file: results.sarif
          category: zizmor
          wait-for-processing: false