Draft: TODOs

.github/workflows/security.yaml

@@ -0,0 +1,32 @@
+name: Security Check
+
+on:
+    push:
+        branches: [ main ]
+    pull_request:
+    release:
+        types: [ created ]
+
+jobs:
+    security:
+        runs-on: ubuntu-latest
+        name: PHP Security Checker
+        strategy:
+            fail-fast: false
+            matrix:
+                php: [ '8.1' ]
+        steps:
+            -   name: Checkout
+                uses: actions/checkout@v2
+                with:
+                    fetch-depth: 0
+
+            -   name: Cache the vulnerability database
+                uses: actions/cache@v2
+                id: cache-db
+                with:
+                    path: ~/.symfony/cache
+                    key: db
+
+            -   name: Checks dependencies for known vulnerabilities
+                uses: symfonycorp/security-checker-action@v4

src/Composer/ComposerOrchestrator.php

@@ -130,6 +130,7 @@ private static function generateAutoloadStatements(
 
     private static function retrieveComposerExecutable(): string
     {
+        // TODO: add env variable; check that env variables are not changed in the scoped version
         $executableFinder = new ExecutableFinder();
         $executableFinder->addSuffix('.phar');
 

src/Test/RequiresPharReadonlyOff.php

@@ -23,6 +23,8 @@ trait RequiresPharReadonlyOff
 {
     private function markAsSkippedIfPharReadonlyIsOn(): void
     {
+        // Should be supported in PHPUnit9 already
+        // TOOD: @require setting is missing from the doc; can contribute
         if (true === (bool) ini_get('phar.readonly')) {
             $this->markTestSkipped(
                 'Requires phar.readonly to be set to 0. Either update your php.ini file or run this test with '

tests/BoxTest.php

@@ -1366,6 +1366,7 @@ public function test_it_cannot_compress_the_phar_with_an_unknown_algorithm(int $
     public function test_it_cannot_compress_if_the_required_extension_is_not_loaded(): void
     {
         if (extension_loaded('bz2')) {
+            // TODO: should be supported<
             $this->markTestSkipped('Requires the extension bz2 to not be loaded.');
         }