Conversation
All badges referenced netresearch/contexts instead of netresearch/t3x-contexts. Removed reference to non-existent phpstan.yml workflow. Added badges for Documentation build, PHPStan level, PHP version, TYPO3 version, Contributor Covenant, SLSA 3, and Latest Release. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Renders RST documentation using typo3-documentation/render-guides on push/PR to Documentation/**. Uploads rendered docs as artifact on PRs. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Runs weekly and on push/PR to main. Gitleaks for secret scanning, composer audit for dependency vulnerability checking. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Includes PR size check and auto-approval after quality gates pass. Documents compensating security controls for OpenSSF Scorecard compliance. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Adds greetings (first-time contributors), PR labeler, stale issue management, and thread locking for resolved issues/PRs. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Audits PHP dependency licenses weekly and on composer.json changes. Reports license inventory in workflow summary. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Generates SPDX + CycloneDX SBOMs, signs all artifacts with Sigstore keyless cosign, creates build provenance attestation, and publishes signed GitHub Release. TER publishing handled by existing publish-to-ter.yml workflow triggered by release event. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
…dling Fix admin password display to match actual value set during setup. Add set -e to setup command for proper error propagation. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
The RST documentation listed PHP 8.2-8.4 while the extension supports PHP 8.2-8.5 as documented in README, composer.json, and ext_emconf.php. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Replaces outdated 5-workflow table with full 15-workflow inventory reflecting all new CI, security, and community workflows. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Bumps PHPStan from level 9 to 10 (strictest). 131 existing errors captured in phpstan-baseline.neon to be resolved incrementally. New code must pass level 10 without additions to the baseline. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Replace GrumPHP with CaptainHook for pre-commit, commit-msg, pre-push, post-merge, and post-checkout hooks. CaptainHook provides conventional commit validation via regex and runs CGL, PHPStan, and unit tests. Also exclude var/ directory from PHP-CS-Fixer to prevent linting generated TYPO3 cache files. Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de> Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Add comprehensive unit tests for: - DataHandlerService (26 tests): context settings persistence - CombinationContext (43 tests): logical expression matching - ContainerInitialization middleware (12 tests) - CombinationFormElement (14 tests) - DefaultSettingsFormElement (19 tests) - RecordSettingsFormElement (36 tests) - InstallService (13 tests): SQL generation - ContextConditionProvider (8 tests) - ContextFunctionsProvider (15 tests) Total: 676 tests (+186 new), 1112 assertions, all passing. Extends PHPStan test ignores for level 10 compatibility. Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de> Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Upstream labeler, lock, greetings, docs, stale, license-check, security, pr-quality, and release workflows to shared reusable workflow_call workflows in netresearch/typo3-ci-workflows. Each local workflow is now a thin caller that defines triggers and passes project-specific inputs/secrets. Reduces local workflow code from 550 to 175 lines (-68%). Version bumps and fixes now only need to be applied once in the upstream repository. Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de> Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
…hedules - docs.yml: add .github/workflows/docs.yml to pull_request paths filter to match the push trigger (ensures PR validation when workflow changes) - lock.yml: stagger cron from 0:00 to 1:00 UTC to avoid running simultaneously with stale.yml Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Dependency ReviewThe following issues were found:
Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. License Issues.github/workflows/lock.yml
.github/workflows/stale.yml
OpenSSF Scorecard
Scanned Files
|
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request delivers a significant modernization initiative, elevating the project's code quality, security, and development efficiency. Key improvements include upgrading static analysis to the strictest level, enhancing unit test coverage, streamlining CI/CD processes through reusable workflows, and integrating robust security controls. These changes collectively improve maintainability, reduce technical debt, and ensure a more secure and efficient development environment. Highlights
Changelog
Ignored Files
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a significant modernization of the project's development standards. Key improvements include upgrading PHPStan to level 10, replacing GrumPHP with CaptainHook for git hooks, and adding comprehensive unit test coverage for 9 previously untested classes. The CI/CD pipeline has also been streamlined by upstreaming several workflows.
The changes are of high quality and substantially improve the maintainability and reliability of the codebase. My review only identified a couple of minor inconsistencies in the new SECURITY_CONTROLS.md documentation file, which should be updated to reflect the changes to PHPStan and the git hook tool.
Welcome to Codecov 🎉Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests. Thanks for integrating Codecov - We've got you covered ☂️ |
- Fix TYPO3 v12 PHPStan errors: add baseline entries for v12-specific type resolution differences (event methods returning mixed) - Fix TYPO3 v12 unit test failures: use direct property assignment in testable form element constructors (v12 lacks injectNodeFactory/setData) - Apply Rector arrow function conversions (ClosureToArrowFunctionRector) - Fix docs build: remove unsupported extension-key attribute from guides.xml - Fix SECURITY_CONTROLS.md: correct PHPStan level (9→10) and tool name (GrumPHP→CaptainHook) Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
In TYPO3 v12, AbstractNode::__construct() calls GeneralUtility::makeInstance(IconFactory::class) which requires constructor dependencies unavailable in unit tests. TYPO3 v13 removed AbstractNode::__construct() so direct instantiation works there. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
make up now runs the full setup: ddev start, composer install, TYPO3 v12+v13 installation, and documentation rendering. Also adds standalone make docs target. Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de> Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
- sudo chown volume mount dirs (Docker volumes mount as root) - Use root credentials for CREATE DATABASE + GRANT - Re-enable packagist before requiring non-local packages - Stronger admin password meeting TYPO3 12+ requirements - Remove separate fluid_styled_content require (already in base) Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
The render-guides Docker container creates files as root. Use an Alpine container to clean up before re-rendering, avoiding permission denied errors on subsequent runs. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
- Ignore DDEV auto-generated scaffold/example directories - Ignore Build/.phpunit.cache/ - Add gold-standard-modernization design and plan documents Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
These files are regenerated by `ddev start` and already listed in .ddev/.gitignore. Remove them from the index so git status is clean. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
- Replace @var annotations with instanceof checks for fe_user (TYPO3 12 types it as non-nullable, v13 as nullable) - Mark codecov functional flag as informational (no functional coverage is uploaded to Codecov) Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
Add :name: options to confval directives that share labels across context types (expected-value, store-in-session). Change Sitemap.rst from toctree to menu directive to prevent document tree conflicts. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Use PSR-7 getHeaderLine() for standard HTTP header names (e.g., "User-Agent") with fallback to $_SERVER key format. Change value matching from exact to case-insensitive substring, enabling User-Agent pattern matching. Update and expand test coverage. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Add create-demo-content script with 6 context types (domain, IP, GET param, HTTP header, inverted header, combination) and context- controlled pages/content. Update install scripts to call demo content creation. Add cacheHash exclusion for debug parameter. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
The checkEnableFieldsForRootLine() method only checked pages with extendToSubpages enabled, skipping the current page's own context restrictions. This allowed direct access to context-restricted pages (e.g. /debug-dashboard was accessible without the debug context). Now the current page (rootline index 0) is always checked for its tx_contexts_enable/disable settings regardless of extendToSubpages. Parent pages continue to only apply restrictions when extendToSubpages is enabled. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
1 participant
Summary
netresearch/typo3-ci-workflowsas reusableworkflow_callworkflows, local files replaced with thin callers (-68% workflow LOC)make upfully bootstraps TYPO3 v12 + v13 with extension symlinkedDocker-based runTests.sh
unit/unitCoveragefunctional/functionalCoveragelintcgl-n)phpstan/phpstanBaselinerector-n)mutationcomposer/composerUpdate/composerValidateDDEV environment
make up— starts DDEV, installs deps, installs TYPO3 v12 + v13, renders docsmake ci— runs all quality checks (CGL, PHPStan, Rector, lint, unit, functional)sudo chowndb_v12,db_v13) with proper grantsWorkflows upstreamed (9 new reusable workflows)
labeler.ymllock.ymlgreetings.ymldocs.ymlstale.ymllicense-check.ymlsecurity.ymlpr-quality.ymlrelease.ymlSecurity review (20 cycles)
persist-credentials: falseon all checkout stepsattest-build-provenanceSHA typo that would have broken releasesTest plan
make upfully bootstraps DDEV with TYPO3 v12 + v13ddev render-docsrenders without errors