code-standards/.github/workflows/code-standards-analysis.yml at main · php-fast-forward/code-standards · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
name: 'Internal: Optional PHP Analysis'
on:
  workflow_call:
    inputs:
      runs-on:
        default: '["ubuntu-latest"]'
        type: string
      php-version:
        default: '8.3'
        type: string
      magic-numbers:
        default: false
        type: boolean
      magic-numbers-policy:
        default: report
        type: string
      rector:
        default: false
        type: boolean
      rector-policy:
        default: report
        type: string
      rector-config:
        default: ''
        type: string
permissions:
  contents: read
jobs:
  analyze:
    runs-on: ${{ fromJSON(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && !inputs.rector && startsWith(toJSON(fromJSON(inputs.runs-on)), '[') && contains(fromJSON(inputs.runs-on), 'self-hosted') && contains(fromJSON(inputs.runs-on), 'Linux') && inputs.runs-on || '["ubuntu-latest"]') }}
    timeout-minutes: 15
    steps:
      - name: Reject privileged events and invalid refs
        id: runtime
        shell: bash
        env:
          STANDARDS_RUNNER_OS: ${{ runner.os }}
          STANDARDS_RECTOR_ENABLED: ${{ inputs.rector }}
          STANDARDS_RUNNER_ENVIRONMENT: ${{ runner.environment }}
          STANDARDS_HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
          STANDARDS_REPOSITORY: ${{ github.repository }}
          STANDARDS_EVENT: ${{ github.event_name }}
          STANDARDS_JOB_JSON: ${{ toJSON(job) }}
          STANDARDS_BASE: ${{ github.event.pull_request.base.sha }}
          STANDARDS_HEAD: ${{ github.event.pull_request.head.sha }}
        run: |
          set -euo pipefail
          [[ "$STANDARDS_EVENT" == pull_request ]] || exit 1
          [[ "$STANDARDS_RUNNER_OS" == Linux ]] || exit 1
          [[ "$STANDARDS_RUNNER_ENVIRONMENT" == github-hosted || "$STANDARDS_RUNNER_ENVIRONMENT" == self-hosted ]] || exit 1
          if [[ "$STANDARDS_RUNNER_ENVIRONMENT" == self-hosted ]]; then
            [[ -n "$STANDARDS_REPOSITORY" && "$STANDARDS_HEAD_REPOSITORY" == "$STANDARDS_REPOSITORY" ]] || exit 1
            [[ "$STANDARDS_RECTOR_ENABLED" == false ]] || exit 1
          fi
          [[ "$STANDARDS_BASE" =~ ^[a-fA-F0-9]{40}$ ]] || exit 1
          [[ "$STANDARDS_HEAD" =~ ^[a-fA-F0-9]{40}$ ]] || exit 1
          runtime=$(jq --slurp --raw-output --exit-status '
            select(length == 1) | .[0] | select(type == "object")
            | select(.workflow_repository | type == "string")
            | select(.workflow_repository == "php-fast-forward/code-standards")
            | select(.workflow_sha | type == "string")
            | select(.workflow_sha | length == 40 and test("^[a-f0-9]+$"))
            | .workflow_sha
          ' <<< "$STANDARDS_JOB_JSON") || {
            echo '::error::Invalid executing workflow identity in native job context.' >&2
            exit 1
          }
          {
            printf 'repository=php-fast-forward/code-standards\n'
            printf 'sha=%s\n' "$runtime"
          } >> "$GITHUB_OUTPUT"
      - name: Validate explicit optional findings policies
        env:
          STANDARDS_MAGIC_POLICY: ${{ inputs.magic-numbers-policy }}
          STANDARDS_RECTOR_POLICY: ${{ inputs.rector-policy }}
        run: |
          set -euo pipefail
          for policy in "$STANDARDS_MAGIC_POLICY" "$STANDARDS_RECTOR_POLICY"; do
            [[ "$policy" == report || "$policy" == fail ]] || {
              echo '::error::Optional findings policies must be report or fail.' >&2
              exit 1
            }
          done
      - name: Check out reviewed tool runtime
        if: inputs.magic-numbers || inputs.rector
        uses: actions/checkout@v7
        with:
          repository: ${{ steps.runtime.outputs.repository }}
          ref: ${{ steps.runtime.outputs.sha }}
          path: tool
          persist-credentials: false
      - name: Set up PHP
        if: inputs.magic-numbers || inputs.rector
        uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ inputs.php-version }}
          extensions: dom, posix
          coverage: none
          tools: composer:v2
      - name: Install only the reviewed tool
        if: inputs.magic-numbers || inputs.rector
        working-directory: tool
        env:
          COMPOSER_HOME: ${{ runner.temp }}/standards-analysis-composer-home
          COMPOSER_CACHE_DIR: ${{ runner.temp }}/standards-analysis-composer-cache
        run: composer install --no-dev --no-plugins --no-scripts --no-interaction --prefer-dist --no-progress
      - name: Check out exact consumer head
        if: inputs.magic-numbers || inputs.rector
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          path: consumer
          fetch-depth: 0
          persist-credentials: false
      - name: Classify optional analyses
        id: analysis
        if: inputs.magic-numbers || inputs.rector
        uses: ./tool/.github/actions/analyze
        with:
          directory: ${{ github.workspace }}/consumer
          base-sha: ${{ github.event.pull_request.base.sha }}
          head-sha: ${{ github.event.pull_request.head.sha }}
          magic-numbers: ${{ inputs.magic-numbers }}
          magic-numbers-policy: ${{ inputs.magic-numbers-policy }}
          rector: ${{ inputs.rector }}
          rector-policy: ${{ inputs.rector-policy }}
          rector-config: ${{ inputs.rector-config }}
      - name: Always summarize unavailable or disabled analyses
        if: always() && steps.analysis.outputs.summary-written != 'true'
        env:
          STANDARDS_MAGIC_ENABLED: ${{ inputs.magic-numbers }}
          STANDARDS_RECTOR_ENABLED: ${{ inputs.rector }}
        run: |
          set -euo pipefail
          {
            printf '## Optional Code Standards analyses\n\n'
            printf '| Tool | Status | Findings |\n| --- | --- | --- |\n'
            if [[ "$STANDARDS_MAGIC_ENABLED" == true ]]; then
              printf '| Magic Numbers | operational-error | unavailable |\n'
            else
              printf '| Magic Numbers | disabled | not executed |\n'
            fi
            if [[ "$STANDARDS_RECTOR_ENABLED" == true ]]; then
              printf '| Rector | operational-error | unavailable |\n'
            else
              printf '| Rector | disabled | not executed |\n'
            fi
            printf '\nEnabled analyses without a complete classified result are operational errors, never clean passes.\n'
          } >> "$GITHUB_STEP_SUMMARY"
      - name: Enforce explicit optional-analysis result
        if: always()
        env:
          STANDARDS_MAGIC_ENABLED: ${{ inputs.magic-numbers }}
          STANDARDS_RECTOR_ENABLED: ${{ inputs.rector }}
          STANDARDS_SUMMARY_WRITTEN: ${{ steps.analysis.outputs.summary-written }}
          STANDARDS_BLOCKING: ${{ steps.analysis.outputs.blocking }}
        run: |
          set -euo pipefail
          if [[ "$STANDARDS_MAGIC_ENABLED" != true && "$STANDARDS_RECTOR_ENABLED" != true ]]; then
            exit 0
          fi
          [[ "$STANDARDS_SUMMARY_WRITTEN" == true ]] || exit 1
          [[ "$STANDARDS_BLOCKING" == false ]]