From a8cf0fe2cb1b94733411123030409cb5dc83fd3d Mon Sep 17 00:00:00 2001
From: nuno maduro <enunomaduro@gmail.com>
Date: Wed, 15 Apr 2026 08:20:50 -0700
Subject: [PATCH] chore: improves CI

---
 .github/workflows/static.yml | 5 ++++-
 .github/workflows/tests.yml  | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 68892bf2..2bfd4010 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -11,6 +11,9 @@ concurrency:
   group: static-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   static:
     if: github.event_name != 'schedule' || github.repository == 'pestphp/pest'
@@ -44,7 +47,7 @@ jobs:
       uses: actions/cache@v5
       with:
         path: ${{ steps.composer-cache.outputs.dir }}
-        key: static-php-8.3-${{ matrix.dependency-version }}-composer-${{ hashFiles('**/composer.json') }}
+        key: static-php-8.3-${{ matrix.dependency-version }}-composer-${{ hashFiles('**/composer.json', '**/composer.lock') }}
         restore-keys: |
           static-php-8.3-${{ matrix.dependency-version }}-composer-
           static-php-8.3-composer-
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 41abc6a1..ce3b3349 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -11,6 +11,9 @@ concurrency:
   group: tests-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.event_name != 'schedule' || github.repository == 'pestphp/pest'
@@ -51,7 +54,7 @@ jobs:
       uses: actions/cache@v5
       with:
         path: ${{ steps.composer-cache.outputs.dir }}
-        key: ${{ matrix.os }}-php-${{ matrix.php }}-symfony-${{ matrix.symfony }}-composer-${{ hashFiles('**/composer.json') }}
+        key: ${{ matrix.os }}-php-${{ matrix.php }}-symfony-${{ matrix.symfony }}-composer-${{ hashFiles('**/composer.json', '**/composer.lock') }}
         restore-keys: |
           ${{ matrix.os }}-php-${{ matrix.php }}-symfony-${{ matrix.symfony }}-composer-
           ${{ matrix.os }}-php-${{ matrix.php }}-composer-