dependency-graph.md

Dependency graph

Existing application

flowchart TD
    Approval["TranslationWorkflowService approval"] --> Scheduler["StaticSiteWorkflowDispatchService"]
    Scheduler --> Cache["Laravel Cache dedup timestamp"]
    Scheduler --> Queue["DispatchGithubWorkflowJob"]
    Queue --> Artisan["Artisan github:dispatch-workflow"]
    Artisan --> Config["Laravel config/github.php"]
    Config --> Env["GITHUB_* environment values"]
    Artisan --> Key["GithubAppJwt key loader"]
    Key --> OpenSSL["ext-openssl"]
    Key --> JWT["RS256 GitHub App JWT"]
    JWT --> Token["GithubInstallationToken"]
    Token --> LaravelHTTP["Laravel HTTP facade / Guzzle"]
    LaravelHTTP --> TokenAPI["POST /app/installations/{id}/access_tokens"]
    TokenAPI --> InstallToken["Installation token string"]
    InstallToken --> Dispatch["POST /repos/{owner}/{repo}/actions/workflows/{workflow}/dispatches"]
    Health["Filament health widget/service"] --> Config
    Health --> Key

Loading

Proposed package boundary

flowchart LR
    Consumer["Laravel, Symfony, Slim, Laminas, or plain PHP"] --> Config["Configuration / Environment"]
    Consumer --> Client["GitHubAppClient"]
    Config --> Client
    Clock["psr/clock"] --> JWT["JwtGenerator"]
    OpenSSL["ext-openssl"] --> JWT
    Config --> JWT
    Client --> JWT
    Client --> HTTP["Internal GitHubApi"]
    PSR18["psr/http-client implementation supplied by consumer"] --> HTTP
    PSR17["PSR-17 request and stream factories supplied by consumer"] --> HTTP
    HTTP --> GitHub["GitHub REST API"]
    Logger["Optional psr/log logger"] --> Client
    Client --> TokenVO["InstallationToken"]
    Client --> Exceptions["Package exception hierarchy"]

    subgraph Package["FNET-GitHub Dispatch Workflow"]
        Config
        Client
        JWT
        HTTP
        TokenVO
        Exceptions
    end

Loading

Dependency decisions

Runtime dependencies are PHP 8.3+, ext-json, ext-openssl, PSR-18, PSR-7, PSR-17, PSR-3, and PSR Clock. The package supplies no HTTP implementation, container, framework adapter, dotenv loader, cache, or queue. Nyholm PSR-7 is development-only for real PSR-17 objects in tests.

Configuration flows into key loading and JWT claims. The JWT authorizes installation-token creation. That short-lived token authorizes workflow dispatch. Workflow coordinates and inputs are never used in authentication.