Harden Dependabot and add composer audit

.github/dependabot.yml

@@ -7,14 +7,50 @@
 
 version: 2
 updates:
+  # GitHub Actions used in .github/workflows/ — keeps SHA pins fresh.
+  # note: directory: '/' is correct for github-actions even though the workflow
+  # files live in .github/workflows/.
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'monthly'
+    # Ignore releases younger than 7 days so a freshly published,
+    # potentially compromised version is given time to be flagged and yanked before we bump.
+    cooldown:
+      default-days: 7
+    groups:
+      actions-batch:
+        applies-to: version-updates
+        update-types:
+          - 'minor'
+          - 'patch'
+          - 'major'
+      # every security fix in one PR per run, instead of one PR per advisory
+      actions-security:
+        applies-to: security-updates
+        patterns:
+          - '*'
+
+  # composer — Dependabot resolves at config.platform.php from composer.json, so
+  # composer.lock must stay installable on that PHP version, or every update
+  # (security fixes included) fails silently as "update not possible".
   - package-ecosystem: 'composer'
     directory: '/'
     schedule:
       interval: 'monthly'
+    # Ignore releases younger than 7 days so a freshly published,
+    # potentially compromised version is given time to be flagged and yanked before we bump.
+    cooldown:
+      default-days: 7
     groups:
-      # group all updates that are minor or path versions
+      # group all updates that are minor or patch versions
       upgrade-batch:
         applies-to: version-updates
         update-types:
           - 'minor'
           - 'patch'
+      # every security fix in one PR per run, instead of one PR per advisory
+      security:
+        applies-to: security-updates
+        patterns:
+          - '*'

.github/workflows/code_checks.yaml

@@ -113,3 +113,15 @@ jobs:
 
       - run: composer install --prefer-dist --no-progress
       - run: composer phpstan
+
+  # Fails on any advisory against composer.lock, so the nightly run turns red
+  # when Dependabot cannot ship a security fix on its own.
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5
+      - uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f #v2
+        with:
+          php-version: 8.4
+          coverage: none
+      - run: composer audit --locked

composer.json

@@ -40,5 +40,10 @@
         "rector-check": "vendor/bin/rector --dry-run",
         "rector-fix": "vendor/bin/rector",
         "phpunit": "vendor/bin/phpunit"
+    },
+    "config": {
+        "platform": {
+            "php": "8.3.0"
+        }
     }
 }