Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 14-33: Replace mutable version tags with pinned commit SHAs for
all GitHub Action uses: change actions/checkout@v4, shivammathur/setup-php@v2,
and actions/cache@v4 to their respective full commit SHA refs (e.g.,
actions/checkout@<full-sha>) so the workflow references an immutable commit;
update the same pattern in the other occurrences (lines 62-82) and in phpcs.yml
and phpunit.yml to ensure every action use is pinned to a full commit SHA rather
than a tag.

In @.github/workflows/phpcs.yml:
- Around line 14-33: Replace mutable action references with pinned commit SHAs:
change uses: actions/checkout@v4, uses: shivammathur/setup-php@v2, and uses:
actions/cache@v4 to their corresponding full commit SHA pins (while keeping a
short comment indicating the original tag like "@v4" or "@v2" for
maintainability). Update the three "uses:" entries in the workflow to reference
the full SHAs for actions/checkout, shivammathur/setup-php, and actions/cache so
the workflow is immutable and add inline comments noting the semantic version
tag.

In @.github/workflows/phpunit.yml:
- Around line 31-48: Pin the GitHub Actions usages to full commit SHAs to
prevent tag drift: replace uses: actions/checkout@v4, uses:
shivammathur/setup-php@v2 and uses: actions/cache@v4 with their corresponding
full commit SHAs (e.g., actions/checkout@<full-commit-sha>,
shivammathur/setup-php@<full-commit-sha>, actions/cache@<full-commit-sha>), and
optionally append the human-friendly tag as a comment for traceability; obtain
the exact SHA from the GitHub UI or API as suggested and update those three
uses: entries accordingly.

In `@CONTRIBUTING.md`:
- Around line 33-37: Update CONTRIBUTING.md to remove or replace the invalid
reference to bin/install-wp-tests.sh: either add the missing script to the repo
or change the instructions to point to the correct test setup method used by
this project (e.g., provide steps for the actual test installer or the
alternative tool the repo uses), and ensure the example command and paths
mention the real script or tooling instead of bin/install-wp-tests.sh so users
can follow the instructions successfully.

In `@README.md`:
- Around line 13-16: The README's Dependabot schedule text ("Weekly (Monday
mornings)") doesn't match the actual Dependabot config, so either update the
Dependabot config to include explicit schedule fields (set day/time/timezone in
.github/dependabot.yml) or soften the README wording to remove the specific
day/time; update the README line under the Dependabot description to something
like "Weekly" or "Weekly (time configured in .github/dependabot.yml)" so the
docs can't drift from the config.

---

Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 9-96: CI duplicates PHPCS and PHPUnit runs between the phpcs and
phpunit jobs and the separate phpcs.yml/phpunit.yml workflows; to fix, remove
duplication by turning this combined workflow into a caller or consolidating
jobs: either delete the phpcs and/or phpunit jobs here and call the existing
phpcs.yml/phpunit.yml via workflow_call, or keep this workflow and remove the
separate workflow files and move their triggers into this file; update job names
phpcs and phpunit and their steps accordingly and ensure matrix, services
(mysql), and caching steps are preserved under the chosen single workflow so
tests and linting run only once per PR.

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In @.github/workflows/ci.yml:
- Around line 14-33: The workflow uses mutable action tags (actions/checkout@v4,
shivammathur/setup-php@v2, actions/cache@v4), so replace each referenced action
tag with the corresponding full commit SHA pin (e.g.,
actions/checkout@<full-sha>, shivammathur/setup-php@<full-sha>,
actions/cache@<full-sha>) to avoid tag drift; update every occurrence in the
file (including the similar blocks around lines 62-82) and verify by running a
workflow lint or dry-run that the pinned SHAs resolve correctly.

In @.github/workflows/phpunit.yml:
- Around line 31-48: The workflow uses mutable action tags (actions/checkout@v4,
shivammathur/setup-php@v2, actions/cache@v4); replace each tag with the
corresponding full commit SHA for that action (e.g.,
actions/checkout@<full-sha>, shivammathur/setup-php@<full-sha>,
actions/cache@<full-sha>) so the runs are pinned to an immutable revision —
update the three uses: the Checkout step, the Set up PHP step, and the Cache
Composer dependencies step to reference the full commit SHAs and commit the
updated workflow file.

---

Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 50-59: Replace the mutable tag in the CI service declaration by
pinning the mysql image to a specific digest: change the service entry that sets
image: mysql:5.7 (the "mysql" service) to image: mysql@sha256:<actual-digest>;
obtain the correct sha256 digest for the desired 5.7 manifest (for example via
docker pull mysql:5.7 && docker inspect --format='{{index .RepoDigests 0}}'
mysql:5.7 or by checking the official MySQL manifest list) and update the
workflow YAML so CI uses that immutable image reference.

In @.github/workflows/phpunit.yml:
- Around line 19-28: The CI uses the mutable tag services.mysql.image set to
"mysql:5.7"; replace that mutable tag with a pinned digest (e.g., use
services.mysql.image = mysql@sha256:<digest>) so the MySQL image is immutable
and reproducible across runs—obtain the correct sha256 digest for the desired
5.7 manifest from Docker Hub or by pulling the image locally (docker pull
mysql:5.7 && docker inspect --format='{{index .RepoDigests 0}}' mysql:5.7) and
update the image value accordingly in the workflow.