chore: extract releasing docs & update github actions

.github/workflows/codeql.yml

@@ -29,7 +29,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/init@0e9f55954318745b37b7933c693bc093f7336125 # v4.35.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -39,6 +39,6 @@ jobs:
           trap-caching: false
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/analyze@0e9f55954318745b37b7933c693bc093f7336125 # v4.35.1
         with:
           category: '/language:${{matrix.language}}'

.github/workflows/php.yml

@@ -16,7 +16,7 @@ jobs:
       matrix:
         php-version: [8.2, 8.3, 8.4, 8.5]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
 
       - name: Set up PHP ${{ matrix.php-version }}
         uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0
@@ -34,7 +34,7 @@ jobs:
   phpcs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0 # important!
 

.github/workflows/release.yml

@@ -27,7 +27,7 @@ jobs:
       bump-type: ${{ steps.check.outputs.bump-type }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: master
           fetch-depth: 0
@@ -85,13 +85,13 @@ jobs:
 
       - name: Get GitHub App token
         id: releaser
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
           app-id: ${{ secrets.GH_APP_POSTHOG_PHP_RELEASER_APP_ID }}
           private-key: ${{ secrets.GH_APP_POSTHOG_PHP_RELEASER_PRIVATE_KEY }} # Secrets available only inside the 'Release' environment, requires approval from a maintainer
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: master
           fetch-depth: 0
@@ -174,7 +174,7 @@ jobs:
 
       - name: Notify Slack - Failed
         if: ${{ failure() && needs.notify-approval-needed.outputs.slack_ts != '' }}
-        uses: posthog/.github/.github/actions/slack-thread-reply@9b04bf3288aca2b4cd3883070858b034b4f7f334
+        uses: posthog/.github/.github/actions/slack-thread-reply@main
         with:
           slack_bot_token: ${{ secrets.SLACK_CLIENT_LIBRARIES_BOT_TOKEN }}
           slack_channel_id: ${{ vars.SLACK_APPROVALS_CLIENT_LIBRARIES_CHANNEL_ID }}
@@ -189,10 +189,10 @@ jobs:
     if: always() && needs.release.result == 'success' && needs.notify-approval-needed.outputs.slack_ts != ''
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Notify Slack - Released
-        uses: posthog/.github/.github/actions/slack-thread-reply@9b04bf3288aca2b4cd3883070858b034b4f7f334
+        uses: posthog/.github/.github/actions/slack-thread-reply@main
         with:
           slack_bot_token: ${{ secrets.SLACK_CLIENT_LIBRARIES_BOT_TOKEN }}
           slack_channel_id: ${{ vars.SLACK_APPROVALS_CLIENT_LIBRARIES_CHANNEL_ID }}

README.md

@@ -33,26 +33,4 @@ Specifically, the [PHP integration](https://posthog.com/docs/integrations/php-in
 
 ## Releasing
 
-Releases are semi-automated via GitHub Actions. When a PR with the `release` and a version bump label is merged to `master`, the release workflow is triggered.
-
-You'll need an approval from a PostHog engineer. If you're an employee, you can see the request in the [#approvals-client-libraries](https://app.slack.com/client/TSS5W8YQZ/C0A3UEVDDNF) channel.
-
-### Release Process
-
-1. **Create your PR** with the changes you want to release
-2. **Add the `release` label** to the PR
-3. **Add a version bump label** that should be either `bump-patch`, `bump-minor` or `bump-major`
-4. **Merge the PR** to `master`
-
-Once merged, the following happens automatically:
-
-1. A Slack notification is sent to the client libraries channel requesting approval
-2. A maintainer approves the release in the GitHub `Release` environment
-3. The version is bumped in `lib/PostHog.php` and `composer.json` based on the version label (`patch`, `minor`, or `major`, extracted from the label)
-4. The `CHANGELOG.md` is updated with a link to the full changelog
-5. Changes are committed and pushed to `master`
-6. A git tag is created (e.g., `v1.8.0`)
-7. A GitHub release is created with the changelog content
-8. Slack is notified of the successful release
-
-Releases are installed directly from GitHub.
+See [RELEASING.md](RELEASING.md).

RELEASING.md

@@ -0,0 +1,25 @@
+# Releasing
+
+Releases are semi-automated via GitHub Actions. When a PR with the `release` and a version bump label is merged to `master`, the release workflow is triggered.
+
+You'll need an approval from a PostHog engineer. If you're an employee, you can see the request in the [#approvals-client-libraries](https://app.slack.com/client/TSS5W8YQZ/C0A3UEVDDNF) channel.
+
+## Release Process
+
+1. **Create your PR** with the changes you want to release
+2. **Add the `release` label** to the PR
+3. **Add a version bump label** that should be either `bump-patch`, `bump-minor` or `bump-major`
+4. **Merge the PR** to `master`
+
+Once merged, the following happens automatically:
+
+1. A Slack notification is sent to the client libraries channel requesting approval
+2. A maintainer approves the release in the GitHub `Release` environment
+3. The version is bumped in `lib/PostHog.php` and `composer.json` based on the version label (`patch`, `minor`, or `major`, extracted from the label)
+4. The `CHANGELOG.md` is updated with a link to the full changelog
+5. Changes are committed and pushed to `master`
+6. A git tag is created (e.g., `v1.8.0`)
+7. A GitHub release is created with the changelog content
+8. Slack is notified of the successful release
+
+Releases are installed directly from GitHub.