From 7075063ab42f0e0c6a2ec36ca2bbd60d95134eb8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felipe=20Say=C3=A3o=20Lobato=20Abreu?=
 <github@mentordosnerds.com>
Date: Fri, 9 Oct 2026 20:44:32 -0300
Subject: [PATCH 1/4] ci: adopt native Pages reports with template 2.1

---
 .github/workflows/reports.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/reports.yml b/.github/workflows/reports.yml
index 993a891..1fd230f 100644
--- a/.github/workflows/reports.yml
+++ b/.github/workflows/reports.yml
@@ -2,16 +2,16 @@ name: "Fast Forward Reports"
 
 on:
   push:
-    branches:
-      - main
+    branches: [main]
+  pull_request:
   workflow_dispatch:
 
+# Caller permissions cap the callee; only its isolated deploy job writes Pages.
 permissions:
-  contents: write
+  contents: read
   pages: write
   id-token: write
 
 jobs:
   reports:
-    uses: php-fast-forward/dev-tools/.github/workflows/reports.yml@main
-    secrets: inherit
+    uses: php-fast-forward/dev-tools/.github/workflows/reports-native.yml@main

From 1260637329abd92fe72881812df357dccbe4704a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felipe=20Say=C3=A3o=20Lobato=20Abreu?=
 <github@mentordosnerds.com>
Date: Fri, 9 Oct 2026 20:58:37 -0300
Subject: [PATCH 2/4] ci: supply isolated test publisher permissions

---
 .github/workflows/tests.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 83ea015..92999fa 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -5,11 +5,13 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
-  pages: write
-  id-token: write
+  contents: read
+  actions: read
+  statuses: write
 
 jobs:
   tests:
     uses: php-fast-forward/dev-tools/.github/workflows/tests.yml@main
+    with:
+      publish-required-statuses: ${{ github.actor != 'dependabot[bot]' }}
     secrets: inherit

From 36e72a151871d2a13ce7358d498b56477387a133 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felipe=20Say=C3=A3o=20Lobato=20Abreu?=
 <github@mentordosnerds.com>
Date: Fri, 9 Oct 2026 21:49:15 -0300
Subject: [PATCH 3/4] fix(ci): recognise bundled HTTP utilities and publish
 native reports

---
 .gitattributes                   |  1 +
 .github/workflows/tests.yml      |  2 +-
 composer-dependency-analyser.php | 15 +++++++++++++++
 3 files changed, 17 insertions(+), 1 deletion(-)
 create mode 100644 composer-dependency-analyser.php

diff --git a/.gitattributes b/.gitattributes
index b85bc56..e7e4cc3 100755
--- a/.gitattributes
+++ b/.gitattributes
@@ -11,3 +11,4 @@
 /Dockerfile         export-ignore
 /infection.json5    export-ignore
 /phpunit.xml        export-ignore
+/composer-dependency-analyser.php export-ignore
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 92999fa..450fa4d 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -5,6 +5,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  # Ceiling for the checkout-free status publisher; test jobs retain read-only tokens.
   contents: read
   actions: read
   statuses: write
@@ -14,4 +15,3 @@ jobs:
     uses: php-fast-forward/dev-tools/.github/workflows/tests.yml@main
     with:
       publish-required-statuses: ${{ github.actor != 'dependabot[bot]' }}
-    secrets: inherit
diff --git a/composer-dependency-analyser.php b/composer-dependency-analyser.php
new file mode 100644
index 0000000..9b34c0c
--- /dev/null
+++ b/composer-dependency-analyser.php
@@ -0,0 +1,15 @@
+<?php
+
+declare(strict_types=1);
+
+use FastForward\DevTools\Config\ComposerDependencyAnalyserConfig;
+use ShipMonk\ComposerDependencyAnalyser\Config\Configuration;
+use ShipMonk\ComposerDependencyAnalyser\Config\ErrorType;
+
+return ComposerDependencyAnalyserConfig::configure(
+    static function (Configuration $configuration): void {
+        // This HTTP bundle deliberately provides these companion utilities to consumers.
+        // See docs/links/dependencies.rst; the provider itself does not call them.
+        $configuration->ignoreErrorsOnPackage('middlewares/utils', [ErrorType::UNUSED_DEPENDENCY]);
+    },
+);

From df8e641d6433211cdb5233bb08fee0958f3da290 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felipe=20Say=C3=A3o=20Lobato=20Abreu?=
 <github@mentordosnerds.com>
Date: Fri, 9 Oct 2026 21:50:53 -0300
Subject: [PATCH 4/4] docs(ci): explain each reusable workflow permission

---
 .github/workflows/tests.yml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 450fa4d..9c844e5 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -5,10 +5,9 @@ on:
   workflow_dispatch:
 
 permissions:
-  # Ceiling for the checkout-free status publisher; test jobs retain read-only tokens.
-  contents: read
-  actions: read
-  statuses: write
+  contents: read # Read source; matrix jobs retain read-only tokens.
+  actions: read # Allow the checkout-free publisher to inspect matrix job results.
+  statuses: write # Caller ceiling; only isolated callee publishers request this permission.
 
 jobs:
   tests: