chore(ci): add Composer audit gate and composer-normalize

Add a dedicated Composer security workflow that runs `composer audit`
on push, PR, and a weekly schedule, so advisories and malware in the
dependency tree fail CI independently of the build. Pins Composer to
2.10 and the GitHub Actions to commit SHAs; the job uses a read-only
token and resolves dependencies with `composer update` since the
package ships no lockfile.

Add a `config.policy` block (block on malware and advisories, report
abandoned packages) and wire in `ergebnis/composer-normalize` with a
`post-autoload-dump` hook so composer.json stays normalized, matching
the rest of the packages.

Author: leMaur

.github/workflows/composer-security.yml

@@ -0,0 +1,36 @@
+# managed-by: ComposerSecurityStamp (profile=oss) — edit the stamp, not this file
+name: Composer Security
+
+permissions:
+  contents: read
+
+on:
+  push:
+    paths:
+      - 'composer.json'
+      - '.github/workflows/composer-security.yml'
+  pull_request:
+  schedule:
+    - cron: '27 6 * * 1'  # weekly — catches deps newly flagged in an unchanged lockfile
+
+jobs:
+  audit:
+    name: Malware & advisory audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Setup PHP + pinned Composer
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2
+        with:
+          php-version: '8.4'
+          tools: composer:2.10
+          coverage: none
+
+      - name: Resolve dependencies (library ships no lock)
+        run: composer update --prefer-dist --no-interaction --no-progress
+
+      - name: Audit (Composer >= 2.10 fails on malware + advisories)
+        run: composer audit

composer.json

@@ -1,34 +1,37 @@
 {
     "name": "lemaur/markdown",
     "description": "Another Markdown parsers but with super powers",
+    "license": "MIT",
     "keywords": [
         "lemaur",
         "laravel",
         "markdown"
     ],
-    "homepage": "https://github.com/lemaur/markdown",
-    "license": "MIT",
     "authors": [
         {
             "name": "Maurizio",
             "email": "hello@lemaur.me",
             "role": "Developer"
         }
     ],
+    "homepage": "https://github.com/lemaur/markdown",
     "require": {
         "php": "^8.2",
-        "spatie/laravel-package-tools": "^1.4.3",
-        "illuminate/contracts": "^11.0|^12.0|^13.0",
-        "league/commonmark": "^2.0"
+        "illuminate/contracts": "^11.0 || ^12.0 || ^13.0",
+        "league/commonmark": "^2.0",
+        "spatie/laravel-package-tools": "^1.4.3"
     },
     "require-dev": {
+        "ergebnis/composer-normalize": "^2.42",
         "laravel/pint": "^1.0",
-        "orchestra/testbench": "^9.0|^10.0|^11.0",
-        "phpstan/phpstan-deprecation-rules": "^1.1.1|^2.0",
-        "phpstan/phpstan-phpunit": "^1.3.3|^2.0",
-        "phpunit/phpunit": "^11.0|^12.0",
+        "orchestra/testbench": "^9.0 || ^10.0 || ^11.0",
+        "phpstan/phpstan-deprecation-rules": "^1.1.1 || ^2.0",
+        "phpstan/phpstan-phpunit": "^1.3.3 || ^2.0",
+        "phpunit/phpunit": "^11.0 || ^12.0",
         "spatie/phpunit-snapshot-assertions": "^5.0"
     },
+    "minimum-stability": "dev",
+    "prefer-stable": true,
     "autoload": {
         "psr-4": {
             "Lemaur\\Markdown\\": "src"
@@ -39,13 +42,22 @@
             "Lemaur\\Markdown\\Tests\\": "tests"
         }
     },
-    "scripts": {
-        "analyse": "vendor/bin/phpstan analyse",
-        "test": "vendor/bin/phpunit",
-        "test-coverage": "vendor/bin/phpunit --coverage-html coverage",
-        "format": "vendor/bin/pint"
-    },
     "config": {
+        "allow-plugins": {
+            "ergebnis/composer-normalize": true
+        },
+        "policy": {
+            "advisories": {
+                "block": true
+            },
+            "malware": {
+                "block": true,
+                "block-scope": "all"
+            },
+            "abandoned": {
+                "audit": "report"
+            }
+        },
         "sort-packages": true
     },
     "extra": {
@@ -55,6 +67,11 @@
             ]
         }
     },
-    "minimum-stability": "dev",
-    "prefer-stable": true
+    "scripts": {
+        "post-autoload-dump": "composer normalize",
+        "analyse": "vendor/bin/phpstan analyse",
+        "format": "vendor/bin/pint",
+        "test": "vendor/bin/phpunit",
+        "test-coverage": "vendor/bin/phpunit --coverage-html coverage"
+    }
 }