SFSEC-331: Use composite action for checkout.

[shoppingfeed-titusm]

Link to the issue

https://shopping-feed.atlassian.net/browse/SFSEC-331

Reason for this PR

Aikido scan

What does the PR do

• update to shoppingflux/github-actions/checkout@main
• checked that fetch-depth param already exists;

How to test

[Copilot]

🟡 Changes recommended

The workflow YAML indentation makes the steps block invalid and the action reference should be pinned to an immutable ref rather than @main.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the CI workflow to use the organization’s composite checkout action instead of the upstream actions/checkout, aligning the pipeline with internal security/scanning requirements.

Changes:

• Switches the PHP workflow’s checkout step to shoppingflux/github-actions/checkout@main.

File summaries

File	Description
.github/workflows/php.yml	Replaces the checkout action used in the PHP CI workflow.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[d3vpasha]

@shoppingflux/squad-core we've also applied the PHP version changes to this public repo.

[Aurelieluciani]

@d3vpasha For a public library, we can't change the minimum PHP version like this. Please don't create a new release with this PR, as we could break the code of users who depend on our library.

[d3vpasha]

@shoppingfeed-titusm could you please revert this change asap ?

[shoppingfeed-titusm]

yes, on it

[shoppingfeed-titusm]

@Aurelieluciani @d3vpasha I've created #139 I hope that's ok.
The pipeline will still fail. Do you want me to look for alternate solutions?