Skip to content

implementation-plan.md

Latest commit

 

History

History
51 lines (40 loc) · 2.74 KB

implementation-plan.md

File metadata and controls

51 lines (40 loc) · 2.74 KB
Raw

Implementation plan

Files and order

  1. Create Composer metadata, PHPUnit, PHPStan, PHP-CS-Fixer, Git ignore, and source/test autoloading.
  2. Implement exception marker/base and focused exception subclasses.
  3. Implement Environment, Configuration, and Workflow validation and environment overrides.
  4. Implement internal system clock, private-key loader, base64url encoding, and JWT generator.
  5. Implement InstallationToken and internal PSR GitHub API request/response handling.
  6. Implement GitHubAppClient orchestration and sanitized logging.
  7. Add deterministic configuration, key, JWT, token, dispatch, transport, malformed response, and secret-sanitization tests.
  8. Add README, changelog, contributing, security, and license-status documentation.
  9. Install dependencies and run Composer validation, PHPUnit, PHPStan, style checks, production-only install verification, secret scan, and original-repository integrity checks.
  10. Create logical Conventional Commits and leave the repository untagged because licensing is unresolved.

Component coverage

  • Environment/configuration: all three sources, precedence, explicit overrides, missing and invalid values.
  • Private keys/JWT: PEM, escaped newline, base64, path, missing path, invalid key, header, claims, timestamps, signature.
  • Installation token: method, endpoint, headers, success parsing, expiration, non-success, malformed JSON, missing fields, transport exception.
  • Workflow: environment/programmatic creation, method, encoded endpoint, headers, payload/ref/inputs, 204 success, other status, transport exception.
  • Safety: previous throwable retention and absence of private keys/JWTs/tokens/authorization values in exceptions and logs.

Documentation

The README will contain installation, transport setup, programmatic/environment usage, all public operations, framework notes, errors, security, development, stability, and licensing. Supporting files cover changes, contributions, vulnerability reporting, and the six required design/analysis phases.

Commit boundaries

  1. Architecture and extraction documents.
  2. Package and quality-tool scaffold.
  3. Configuration, private-key, and JWT implementation.
  4. Installation token and workflow dispatch implementation.
  5. Deterministic tests and any quality fixes.
  6. User and maintainer documentation.

Verification commands

composer validate --strict
composer install --no-interaction
composer test
composer analyse
composer check-style
composer install --no-dev --no-interaction
composer install --no-interaction
git grep -nEI '(BEGIN (RSA )?PRIVATE KEY|gh[opsu]_[A-Za-z0-9_]{20,}|github_pat_)'
git status --short

The original application will be checked with git status --short and git diff --exit-code before and after extraction.