Release 2.60 (#5971)

.github/release-drafter.yml

@@ -4,26 +4,37 @@ exclude-labels:
     - 'duplicate'
     - 'invalid'
     - 'wontfix'
-    - 'release'
 exclude-contributors:
     - 'dependabot'
     - 'weblate'
 change-template: '- $TITLE (#$NUMBER)'
 change-title-escapes: '\<*_&`#@'
+categories:
+    - title: "Features"
+      semver-increment: minor
+      when:
+          labels:
+              - "feature request"
+              - "enhancement"
+              - "technical debt"
+              - "translation"
+              - "release"
+    - title: "Bug Fixes"
+      when:
+          labels:
+              - "fix"
+              - "bugfix"
+              - "bug"
+    - title: "🚨 Security"
+      when:
+          label: "security"
 version-resolver:
-    minor:
-        labels:
-            - 'feature request'
-            - 'release'
-    patch:
-        labels:
-            - 'technical debt'
-            - 'bug'
-            - 'translation'
-    default: patch
+    default: minor
 template: |
     **Compatible with PHP 8.2 to 8.5**
     
     $CHANGES
     
+    You can read more about all security reports [here](https://www.kimai.org/documentation/bughunter.html#published-vulnerabilities) or grab this [RSS feed](https://www.kimai.org/security.xml) to get notified about new published advisories.
+
     Involved in this release: $CONTRIBUTORS

.github/renovate-config.js

@@ -0,0 +1,7 @@
+module.exports = {
+    branchPrefix: 'renovate/',
+    username: 'renovate-release',
+    gitAuthor: 'Renovate Bot <bot@renovateapp.com>',
+    onboarding: false,
+    platform: 'github'
+};

.github/workflows/linting.yaml

@@ -72,5 +72,8 @@ jobs:
             -   name: Lint codebase
                 run: composer linting
 
+            -   name: Check for published security advisories
+                run: composer audit --abandoned=report
+
             -   name: Check for security issues in packages
                 run: symfony security:check

.github/workflows/renovate.yaml

@@ -0,0 +1,23 @@
+name: Renovate
+
+permissions: {}
+
+on:
+    schedule:
+        - cron: '17 3 * * *'
+    workflow_dispatch:
+
+jobs:
+    renovate:
+        runs-on: ubuntu-latest
+        steps:
+            - name: Clone Kimai
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              with:
+                  persist-credentials: false
+
+            - name: Run Renovate
+              uses: renovatebot/github-action@693b9ef15eec82123529a37c782242f091365961 # v46.1.14
+              with:
+                  configurationFile: .github/renovate-config.js
+                  token: ${{ secrets.RENOVATE_TOKEN }}

.github/workflows/testing.yaml

@@ -96,7 +96,7 @@ jobs:
 
             -   name: Upload code coverage
                 if: matrix.php == '8.5'
-                uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+                uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
                 with:
                     token: ${{ secrets.CODECOV_TOKEN }}
                     files: ./coverage.xml