diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml index 2557a8c..6a4a4ec 100644 --- a/.github/workflows/bc.yml +++ b/.github/workflows/bc.yml @@ -17,5 +17,4 @@ jobs: roave_bc_check: uses: yiisoft/actions/.github/workflows/bc.yml@master with: - php: >- - ['8.1'] + php: '["8.4"]' diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index a34e727..f7f3c60 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -12,6 +12,9 @@ on: name: build +permissions: + contents: read + jobs: tests: name: PHP ${{ matrix.php }}-pgsql-${{ matrix.pgsql }} @@ -28,8 +31,6 @@ jobs: - ubuntu-latest php: - - 7.4 - - 8.0 - 8.1 pgsql: @@ -41,7 +42,7 @@ jobs: services: postgres: - image: postgres:${{ matrix.pgsql }} + image: postgres:${{ matrix.pgsql }} # zizmor: ignore[unpinned-images] env: POSTGRES_USER: root POSTGRES_PASSWORD: root-password @@ -52,10 +53,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + with: + persist-credentials: false - name: Install PHP - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 with: php-version: ${{ matrix.php }} extensions: ${{ env.extensions }} @@ -63,8 +66,23 @@ jobs: coverage: pcov tools: composer:v2 - - name: Install Composer dependencies - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0 + - name: Determine composer cache directory on Linux + if: matrix.os == 'ubuntu-latest' + run: echo "COMPOSER_CACHE_DIR=$(composer config cache-dir)" >> "$GITHUB_ENV" + + - name: Cache dependencies installed with composer + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 + with: + path: ${{ env.COMPOSER_CACHE_DIR }} + key: php${{ matrix.php }}-composer-${{ hashFiles('**/composer.json') }} + restore-keys: | + php${{ matrix.php }}-composer- + + - name: Update composer + run: composer self-update + + - name: Install dependencies with composer + run: composer update --prefer-dist --no-interaction --no-progress --optimize-autoloader --ansi - name: Run tests with phpunit run: vendor/bin/phpunit --coverage-clover=coverage.xml --colors=always diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml index c801f73..94cbc35 100644 --- a/.github/workflows/mutation.yml +++ b/.github/workflows/mutation.yml @@ -13,6 +13,9 @@ on: branches: ['master'] paths: *paths +permissions: + contents: read + jobs: mutation: name: PHP ${{ matrix.php }}-${{ matrix.os }} @@ -31,7 +34,7 @@ jobs: services: postgres: - image: postgres:13 + image: postgres:13 # zizmor: ignore[unpinned-images] env: POSTGRES_USER: root POSTGRES_PASSWORD: root-password @@ -42,10 +45,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + with: + persist-credentials: false - name: Install PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 with: php-version: ${{ matrix.php }} extensions: ${{ env.extensions }} @@ -53,11 +58,25 @@ jobs: coverage: pcov tools: composer:v2 - - name: Install Composer dependencies - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0 + - name: Determine composer cache directory + run: echo "COMPOSER_CACHE_DIR=$(composer config cache-dir)" >> "$GITHUB_ENV" + + - name: Cache dependencies installed with composer + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 + with: + path: ${{ env.COMPOSER_CACHE_DIR }} + key: php${{ matrix.php }}-composer-${{ hashFiles('**/composer.json') }} + restore-keys: | + php${{ matrix.php }}-composer- + + - name: Update composer + run: composer self-update + + - name: Install dependencies with composer + run: composer update --prefer-dist --no-interaction --no-progress --optimize-autoloader --ansi - name: Run infection run: | - vendor/bin/roave-infection-static-analysis-plugin --ignore-msi-with-no-mutations --only-covered + vendor/bin/roave-infection-static-analysis-plugin --threads=2 --ignore-msi-with-no-mutations --only-covered env: STRYKER_DASHBOARD_API_KEY: ${{ secrets.STRYKER_DASHBOARD_API_KEY }} diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml index e8415aa..a106b6e 100644 --- a/.github/workflows/static.yml +++ b/.github/workflows/static.yml @@ -21,53 +21,15 @@ on: name: static analysis -jobs: - mutation: - name: PHP ${{ matrix.php }}-${{ matrix.os }} +permissions: + contents: read - env: +jobs: + psalm: + uses: yiisoft/actions/.github/workflows/psalm.yml@master + with: extensions: pdo, pdo_pgsql - - runs-on: ${{ matrix.os }} - - strategy: - matrix: - os: - - ubuntu-latest - - php: - - 7.4 - - 8.0 - - 8.1 - - steps: - - name: Checkout - uses: actions/checkout@v7 - - - name: Install PHP - uses: shivammathur/setup-php@v2 - with: - php-version: ${{ matrix.php }} - extensions: ${{ env.extensions }} - tools: composer:v2, cs2pr - coverage: none - - - name: Determine composer cache directory - run: echo "COMPOSER_CACHE_DIR=$(composer config cache-dir)" >> $GITHUB_ENV - - - name: Cache dependencies installed with composer - uses: actions/cache@v6 - with: - path: ${{ env.COMPOSER_CACHE_DIR }} - key: php${{ matrix.php }}-composer-${{ hashFiles('**/composer.json') }} - restore-keys: | - php${{ matrix.php }}-composer- - - - name: Update composer - run: composer self-update - - - name: Install dependencies with composer - run: composer update --prefer-dist --no-interaction --no-progress --optimize-autoloader --ansi - - - name: Static analysis - run: vendor/bin/psalm --shepherd --stats --output-format=checkstyle | cs2pr --graceful-warnings --colorize + os: >- + ["ubuntu-latest"] + php: >- + ["8.1"] diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000..430255d --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,22 @@ +name: GitHub Actions Security Analysis with zizmor 🌈 + +on: + push: + branches: + - master + - main + paths: + - '.github/**.yml' + - '.github/**.yaml' + pull_request: + paths: + - '.github/**.yml' + - '.github/**.yaml' + +permissions: + actions: read # Required by zizmor when reading workflow metadata through the API. + contents: read # Required to read workflow files. + +jobs: + zizmor: + uses: yiisoft/actions/.github/workflows/zizmor.yml@master diff --git a/composer.json b/composer.json index e28d2bb..f547a2e 100644 --- a/composer.json +++ b/composer.json @@ -35,7 +35,7 @@ "phpunit/phpunit": "^9.6.35", "roave/infection-static-analysis-plugin": "^1.16", "spatie/phpunit-watcher": "^1.23", - "vimeo/psalm": "^4.30|^5.3" + "vimeo/psalm": "^4.30|^5.3|^6.0" }, "autoload": { "psr-4": { diff --git a/phpunit.xml.dist b/phpunit.xml.dist index 5262e67..957a914 100644 --- a/phpunit.xml.dist +++ b/phpunit.xml.dist @@ -1,13 +1,10 @@ - - + ./src - +