security-annotations/.github/workflows/ci.yaml at master · nepada/security-annotations · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
name: CI

on:
  push:
  pull_request:
  schedule:
    - cron: '0 10 * * 5'

permissions:
  contents: read

jobs:
  tests:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        php:
          - 8.1
          - 8.2
          - 8.3
          - 8.4
          - 8.5
        composer_args:
          - ''
          - '--prefer-stable'
          - '--prefer-stable --prefer-lowest'
    name: PHP ${{ matrix.php }} ${{ matrix.composer_args }}
    steps:
      - uses: actions/checkout@v6
      - uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php }}
          coverage: none
      - name: Build
        env:
          COMPOSER_ARGS: ${{ matrix.composer_args }}
        run: composer update --no-interaction --no-progress --prefer-dist $COMPOSER_ARGS
      - name: Lint
        run: vendor/bin/parallel-lint -e php,phpt --exclude tests/temp src tests
      - name: Tests
        run: vendor/bin/tester -c tests/php.ini -s tests
      - name: PHPStan
        run: |
          vendor/bin/phpstan analyse -v
          vendor/bin/phpstan analyse -v -c phpstan.tests.neon.dist
      - if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: output
          path: tests/**/output

  code_style:
    runs-on: ubuntu-latest
    needs: [ tests ]
    name: Code Style
    steps:
      - uses: actions/checkout@v6
      - uses: shivammathur/setup-php@v2
        with:
          php-version: 8.1
          coverage: none
      - name: Build
        run: composer update --no-interaction --no-progress --prefer-dist --prefer-stable
      - name: Check Code Style
        run: vendor/bin/phpcs

  code_coverage:
    runs-on: ubuntu-latest
    needs: [ tests ]
    continue-on-error: true
    name: Code Coverage
    steps:
      - uses: actions/checkout@v6
      - uses: shivammathur/setup-php@v2
        with:
          php-version: 8.1
          coverage: none
      - run: composer global require php-coveralls/php-coveralls
      - name: Build
        run: composer update --no-interaction --no-progress --prefer-dist --prefer-stable
      - name: Calculate coverage
        run: vendor/bin/tester -c tests/php.ini -p phpdbg tests --coverage coverage.xml --coverage-src src
      - name: Upload Coverage Report
        env:
          COVERALLS_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: php-coveralls --verbose --config tests/coveralls.yml

  dependabot:
    runs-on: ubuntu-latest
    needs: [tests, code_style]
    permissions:
      pull-requests: write
      contents: write
    if: ${{ github.actor == 'dependabot[bot]' && github.event_name == 'pull_request'}}
    steps:
      - id: metadata
        uses: dependabot/fetch-metadata@v2
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      - run: |
          gh pr review --approve "$PR_URL"
          gh pr merge --squash --auto "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}