feature/INT-1751 - Security updates

.github/workflows/build-master.yml

@@ -157,9 +157,14 @@ jobs:
               shell: bash
               run: composer validate
 
-            - name: Composer update
+            # Install exactly what composer.lock pins. composer update would re-resolve every
+            # range on each run and pick up any version published since, including a malicious
+            # one, in a job that holds repository secrets. composer validate above fails the
+            # job if the lock no longer matches composer.json. The lock is resolved for PHP 8.1
+            # (config.platform in composer.json), so it installs on every leg of the matrix.
+            - name: Composer install
               shell: bash
-              run: composer update --prefer-dist --no-interaction
+              run: composer install --prefer-dist --no-interaction
 
             - name: Run PHPStan
               run: vendor/bin/phpstan analyse --no-progress

.github/workflows/build-release.yml

@@ -25,8 +25,10 @@ jobs:
             - name: Composer validate
               run: composer validate
 
-            - name: Composer update
-              run: composer update --prefer-dist --no-interaction
+            # From composer.lock, like build-master.yml: never re-resolve dependencies in the job
+            # that tags the release.
+            - name: Composer install
+              run: composer install --prefer-dist --no-interaction
 
             - name: Run PHPUnit
               env:

.gitignore

@@ -1,7 +1,6 @@
 .php_cs.cache
 phpunit.xml
 .phpunit.result.cache
-composer.lock
 composer.phar
 vendor/*
 *.iml

README.md

@@ -145,9 +145,11 @@ The exception encapsulates `http_metadata` and `$error_details`, if available.
 Once you check out the code from GitHub, the project can be built using composer:
 
 ```
-composer update
+composer install
 ```
 
+This installs the dependency versions pinned in `composer.lock`, the same ones CI uses. Run `composer update` only when you mean to move those pins, and commit the updated `composer.lock`.
+
 The execution of integration tests require the following environment variables set in your system:
 
 * For default account systems (NAS): `CHECKOUT_DEFAULT_PUBLIC_KEY` & `CHECKOUT_DEFAULT_SECRET_KEY`

composer.json

@@ -50,6 +50,11 @@
             "Checkout\\Tests\\": "test/Checkout/Tests/"
         }
     },
+    "config": {
+        "platform": {
+            "php": "8.1"
+        }
+    },
     "scripts": {
         "install-hooks": [
             "sh ./vendor/smgladkovskiy/phpcs-git-pre-commit/src/setup.sh"