Harden secure tests and pin Firebase CLI tooling

.github/workflows/ci.yml

@@ -128,7 +128,9 @@ jobs:
         run: composer --working-dir=tools/.phpstan install --no-interaction --no-progress --ansi
 
       - name: Setup problem matchers for PHP
-        run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"
+        run: echo "::add-matcher::${MATCHER_PATH}"
+        env:
+          MATCHER_PATH: ${{ runner.tool_cache }}/php.json
 
       - name: Run PHPStan
         run: XDEBUG_MODE=off tools/phpstan analyse --no-progress --error-format=github
@@ -303,10 +305,14 @@ jobs:
           fi
 
       - name: Setup problem matchers for PHP
-        run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"
+        run: echo "::add-matcher::${MATCHER_PATH}"
+        env:
+          MATCHER_PATH: ${{ runner.tool_cache }}/php.json
 
       - name: Setup Problem Matchers for PHPUnit
-        run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"
+        run: echo "::add-matcher::${MATCHER_PATH}"
+        env:
+          MATCHER_PATH: ${{ runner.tool_cache }}/phpunit.json
 
       - name: Run PHPUnit
         run: tools/phpunit --testsuite=unit --testdox
@@ -317,6 +323,9 @@ jobs:
       - tests
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write # authenticate uploads to Codecov with OIDC
 
     steps:
       - name: Checkout code
@@ -348,10 +357,14 @@ jobs:
         run: composer install --no-interaction --no-progress --ansi --ignore-platform-req=ext-grpc
 
       - name: Setup problem matchers for PHP
-        run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"
+        run: echo "::add-matcher::${MATCHER_PATH}"
+        env:
+          MATCHER_PATH: ${{ runner.tool_cache }}/php.json
 
       - name: Setup Problem Matchers for PHPUnit
-        run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"
+        run: echo "::add-matcher::${MATCHER_PATH}"
+        env:
+          MATCHER_PATH: ${{ runner.tool_cache }}/phpunit.json
 
       - name: Cache PHPUnit static analysis cache
         uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
@@ -373,7 +386,7 @@ jobs:
         if: ${{ !cancelled() }}
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
           flags: unit
           report_type: test_results
           files: ./build/test-results.xml
@@ -383,7 +396,7 @@ jobs:
         if: ${{ !cancelled() }}
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
           files: ./build/code-coverage.xml
           flags: unit
           fail_ci_if_error: false
@@ -425,3 +438,21 @@ jobs:
       - name: Skip Roave BC Check (no tags found)
         if: ${{ steps.check-tags.outputs.has_tags != 'true' }}
         run: echo "Skipping BC check because no git tags were found."
+
+  secure-tests:
+    name: Secure Tests
+    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/8.x' }}
+    needs:
+      - dependency-audit
+      - code-coverage
+      - bc-check
+    permissions:
+      contents: read
+      id-token: write # allow the reusable workflow to authenticate Codecov uploads
+    uses: ./.github/workflows/secure-tests.yml
+    secrets:
+      GOOGLE_APPLICATION_CREDENTIALS: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
+      TEST_FIREBASE_APP_ID: ${{ secrets.TEST_FIREBASE_APP_ID }}
+      TEST_FIREBASE_RTDB_URI: ${{ secrets.TEST_FIREBASE_RTDB_URI }}
+      TEST_FIREBASE_TENANT_ID: ${{ secrets.TEST_FIREBASE_TENANT_ID }}
+      TEST_REGISTRATION_TOKENS: ${{ secrets.TEST_REGISTRATION_TOKENS }}

.github/workflows/secure-tests.yml

@@ -1,29 +1,31 @@
 name: Secure Tests
 
-on: # zizmor: ignore[dangerous-triggers] workflow_run is guarded at job level: head_repository.full_name == github.repository prevents fork-triggered runs
-  workflow_run:
-    workflows: ["CI"]
-    types: [completed]
+on:
+  workflow_call:
+    secrets:
+      GOOGLE_APPLICATION_CREDENTIALS:
+        required: true
+      TEST_FIREBASE_APP_ID:
+        required: true
+      TEST_FIREBASE_RTDB_URI:
+        required: true
+      TEST_FIREBASE_TENANT_ID:
+        required: true
+      TEST_REGISTRATION_TOKENS:
+        required: true
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch || github.ref }}
-  cancel-in-progress: true
-
 jobs:
   dependency-validation:
     name: Dependency Validation
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    if: ${{ (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_repository.full_name == github.repository) }}
-
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
-          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
           persist-credentials: false
 
       - name: Setup PHP
@@ -58,6 +60,9 @@ jobs:
       - dependency-validation
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write # authenticate uploads to Codecov with OIDC
 
     env:
       php-version: '8.5'
@@ -66,7 +71,6 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
-          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
           persist-credentials: false
 
       - name: Setup PHP
@@ -77,7 +81,9 @@ jobs:
           coverage: xdebug
 
       - name: Setup problem matchers for PHP
-        run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"
+        run: echo "::add-matcher::${MATCHER_PATH}"
+        env:
+          MATCHER_PATH: ${{ runner.tool_cache }}/php.json
 
       - name: Get Composer cache directory
         id: composer-cache
@@ -96,7 +102,9 @@ jobs:
         run: composer install --no-interaction --no-progress --ansi --ignore-platform-req=ext-grpc
 
       - name: Setup Problem Matchers for PHPUnit
-        run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"
+        run: echo "::add-matcher::${MATCHER_PATH}"
+        env:
+          MATCHER_PATH: ${{ runner.tool_cache }}/phpunit.json
 
       - name: Run Integration Tests
         env:
@@ -114,7 +122,7 @@ jobs:
         if: ${{ !cancelled() }}
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
           flags: integration
           report_type: test_results
           files: ./build/test-report.xml
@@ -124,7 +132,7 @@ jobs:
         if: ${{ !cancelled() }}
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
           files: ./build/coverage.xml
           flags: integration
           fail_ci_if_error: false
@@ -135,6 +143,9 @@ jobs:
       - dependency-validation
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write # authenticate uploads to Codecov with OIDC
 
     env:
       php-version: '8.5'
@@ -143,7 +154,6 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
-          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
           persist-credentials: false
 
       - name: Setup PHP
@@ -154,7 +164,9 @@ jobs:
           coverage: xdebug
 
       - name: Setup problem matchers for PHP
-        run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"
+        run: echo "::add-matcher::${MATCHER_PATH}"
+        env:
+          MATCHER_PATH: ${{ runner.tool_cache }}/php.json
 
       - name: Get Composer cache directory
         id: composer-cache
@@ -173,7 +185,9 @@ jobs:
         run: composer install --no-interaction --no-progress --ansi --ignore-platform-req=ext-grpc
 
       - name: Setup Problem Matchers for PHPUnit
-        run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"
+        run: echo "::add-matcher::${MATCHER_PATH}"
+        env:
+          MATCHER_PATH: ${{ runner.tool_cache }}/phpunit.json
 
       - name: Set Up Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -187,7 +201,7 @@ jobs:
           java-version: '21'
 
       - name: Install Firebase Tools
-        run: npm install -g firebase-tools
+        run: composer tools:firebase:install
 
       - name: Run emulated Integration Tests
         env:
@@ -201,13 +215,13 @@ jobs:
           XDEBUG_MODE: coverage
         run: |
           mkdir -p build
-          firebase emulators:exec --only auth,database --project beste-firebase 'XDEBUG_MODE=coverage tools/phpunit --group=emulator --exclude-group grpc --coverage-clover=build/coverage.xml --log-junit=build/test-report.xml'
+          tools/.firebase/node_modules/.bin/firebase emulators:exec --only auth,database --project beste-firebase 'XDEBUG_MODE=coverage tools/phpunit --group=emulator --exclude-group grpc --coverage-clover=build/coverage.xml --log-junit=build/test-report.xml'
 
       - name: Upload emulator test results to Codecov
         if: ${{ !cancelled() }}
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
           flags: emulator
           report_type: test_results
           files: ./build/test-report.xml
@@ -217,7 +231,7 @@ jobs:
         if: ${{ !cancelled() }}
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
           files: ./build/coverage.xml
           flags: emulator
           fail_ci_if_error: false
@@ -228,6 +242,9 @@ jobs:
       - dependency-validation
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write # authenticate uploads to Codecov with OIDC
     # Non-blocking while the gRPC extension is broken/unstable on PHP 8.5.
     # See https://github.com/shivammathur/setup-php/issues/1041.
     # Remove this once upstream releases a stable extension and tests pass.
@@ -242,7 +259,6 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
-          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
           persist-credentials: false
 
       - name: Setup cache environment
@@ -270,7 +286,9 @@ jobs:
           coverage: xdebug
 
       - name: Setup problem matchers for PHP
-        run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"
+        run: echo "::add-matcher::${MATCHER_PATH}"
+        env:
+          MATCHER_PATH: ${{ runner.tool_cache }}/php.json
 
       - name: Verify gRPC extension
         id: grpc
@@ -296,7 +314,9 @@ jobs:
         run: composer install --no-interaction --no-progress --ansi
 
       - name: Setup Problem Matchers for PHPUnit
-        run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"
+        run: echo "::add-matcher::${MATCHER_PATH}"
+        env:
+          MATCHER_PATH: ${{ runner.tool_cache }}/phpunit.json
 
       - name: Run gRPC Tests
         id: grpc-tests
@@ -316,7 +336,7 @@ jobs:
         if: ${{ !cancelled() && steps.grpc.outcome == 'success' }}
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
           flags: grpc
           report_type: test_results
           files: ./build/test-report.xml
@@ -326,7 +346,7 @@ jobs:
         if: ${{ !cancelled() && steps.grpc.outcome == 'success' }}
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
           files: ./build/coverage.xml
           flags: grpc
           fail_ci_if_error: false

CONTRIBUTING.md

@@ -29,9 +29,10 @@ If you want to provide a bug fix, include tests that prove the bug exists and th
    - `TEST_REGISTRATION_TOKENS`
    - `TEST_FIRESTORE_CUSTOM_DB_NAME` if you use a custom Firestore database
 
-4. If you run emulator tests, install the Firebase CLI and make sure it can start Auth and Realtime Database emulators. The test suite uses ports `9099` and `9100`.
+4. If you run emulator tests, install the locked Firebase CLI and make sure it can start Auth and Realtime Database emulators. The test suite uses ports `9099` and `9100`.
 
    ```bash
+   composer tools:firebase:install
    composer test:emulator
    ```
 

README.md

@@ -8,7 +8,6 @@
 [![Monthly Downloads](https://img.shields.io/packagist/dm/kreait/firebase-php.svg)](https://packagist.org/packages/kreait/firebase-php/stats)
 [![Total Downloads](https://img.shields.io/packagist/dt/kreait/firebase-php.svg)](https://packagist.org/packages/kreait/firebase-php/stats)<br/>
 [![CI](https://github.com/beste/firebase-php/actions/workflows/ci.yml/badge.svg)](https://github.com/beste/firebase-php/actions/workflows/ci.yml)
-[![Secure Tests](https://github.com/beste/firebase-php/actions/workflows/secure-tests.yml/badge.svg)](https://github.com/beste/firebase-php/actions/workflows/secure-tests.yml)
 [![Docs](https://github.com/beste/firebase-php/actions/workflows/docs.yml/badge.svg)](https://github.com/beste/firebase-php/actions/workflows/docs.yml)
 [![Sponsor](https://img.shields.io/static/v1?logo=GitHub&label=Sponsor&message=%E2%9D%A4&color=ff69b4)](https://github.com/sponsors/jeromegamez)
 

composer.json

@@ -163,9 +163,10 @@
             "mkdir -p build",
             "XDEBUG_MODE=coverage tools/phpunit --colors=always --testdox --coverage-text --coverage-html=build/coverage --coverage-clover=build/coverage/clover.xml"
         ],
-        "test:emulator": "FIREBASE_AUTH_EMULATOR_HOST=localhost:9099 FIREBASE_DATABASE_EMULATOR_HOST=localhost:9100 firebase emulators:exec --only auth,database --project beste-firebase 'XDEBUG_MODE=off tools/phpunit --group=emulator'",
+        "test:emulator": "FIREBASE_AUTH_EMULATOR_HOST=localhost:9099 FIREBASE_DATABASE_EMULATOR_HOST=localhost:9100 tools/.firebase/node_modules/.bin/firebase emulators:exec --only auth,database --project beste-firebase 'XDEBUG_MODE=off tools/phpunit --group=emulator'",
         "test:integration": "XDEBUG_MODE=off tools/phpunit --testsuite=integration",
         "test:unit": "XDEBUG_MODE=off tools/phpunit --testsuite=unit --colors=always --testdox",
+        "tools:firebase:install": "npm ci --ignore-scripts --prefix tools/.firebase",
         "tools:install": "XDEBUG_MODE=off tools/phive --no-progress install --trust-gpg-keys E82B2FB314E9906E,4AA394086372C20A,C00543248C87FB13",
         "tools:link": [
             "ln -snf phpunit tools/phpunit.phar",

docs/index.rst

@@ -15,7 +15,6 @@ Firebase Admin SDK for PHP
          <a href="https://packagist.org/packages/kreait/firebase-php/stats"><img src="https://img.shields.io/packagist/dm/kreait/firebase-php.svg" alt="Monthly Downloads"></a>
          <a href="https://packagist.org/packages/kreait/firebase-php/stats"><img src="https://img.shields.io/packagist/dt/kreait/firebase-php.svg" alt="Total Downloads"></a><br/>
          <a href="https://github.com/beste/firebase-php/actions/workflows/ci.yml"><img src="https://github.com/beste/firebase-php/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
-         <a href="https://github.com/beste/firebase-php/actions/workflows/secure-tests.yml"><img src="https://github.com/beste/firebase-php/actions/workflows/secure-tests.yml/badge.svg" alt="Secure Tests"></a>
          <a href="https://github.com/beste/firebase-php/actions/workflows/docs.yml"><img src="https://github.com/beste/firebase-php/actions/workflows/docs.yml/badge.svg" alt="Docs"></a>
          <a href="https://github.com/sponsors/jeromegamez"><img src="https://img.shields.io/static/v1?logo=GitHub&label=Sponsor&message=%E2%9D%A4&color=ff69b4" alt="Sponsor"></a>
       </p>

tools/.firebase/.gitignore

@@ -0,0 +1,4 @@
+*
+!.gitignore
+!/package.json
+!/package-lock.json