[TASK] Check the ci/ PHP code with GrumPHP and add PHPUnit tests

.github/workflows/build.yaml

@@ -27,14 +27,27 @@ jobs:
       -
         name: 'Validate .github/workflows/build.yaml is up to date'
         run: |-
-          docker run --rm -v $PWD:/app -w /app/ci webdevops/php:8.4-alpine composer install
+          docker run --rm -v $PWD:/app -w /app/ci webdevops/php:8.4-alpine composer install --no-dev
           docker run --rm -v $PWD:/app -w /app webdevops/php:8.4-alpine ci/console github:generate-ci
           git diff --exit-code --color=always
       -
         name: 'Validate the README banner is up to date'
         run: |-
           docker run --rm -v $PWD:/app -w /app webdevops/php:8.4-alpine ci/console readme-banner:generate
           git diff --exit-code --color=always
+  check-ci-code:
+    name: 'Check ci/ (GrumPHP and PHPUnit)'
+    runs-on: ubuntu-latest
+    steps:
+      -
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      -
+        name: 'Run GrumPHP'
+        run: |-
+          docker run --rm -v $PWD:/app -w /app/ci webdevops/php:8.4-alpine composer install
+          docker run --rm -v $PWD:/app -w /app/ci webdevops/php:8.4-alpine sh -c 'apk add --no-cache file && git config --global --add safe.directory /app && vendor/bin/grumphp run --no-interaction'
   apache_alpine:
     strategy:
       fail-fast: false

AGENTS.md

@@ -10,6 +10,8 @@
 | `docker/<image>/<tag>/Dockerfile`, `docker/<image>/<tag>/conf/` | Generated by `make provision`, never edited by hand |
 | `bin/` | Old Python 2 tools behind `make provision` |
 | `ci/` | PHP generators for `.github/workflows/build.yaml` (`ci/console github:generate-ci`) and the README banner (`ci/console readme-banner:generate`) |
+| `ci/tests/` | PHPUnit tests of `ci/src`; `ci/tests/Fixtures/repository` is a small repository they run against |
+| `ci/grumphp.yml`, `ci/phpstan.neon`, `ci/rector.php`, `ci/fractor.php` | Checks of the PHP code in `ci/`, from pluswerk/grumphp-config |
 | `conf/readme-banner.yml`, `ci/resources/readme-banner/` | Texts and font outlines of the README banner (source) |
 | `docs/assets/readme-banner-*.svg` | README banner, generated by `ci/console readme-banner:generate`, never edited by hand |
 | `tests/` | serverspec (Ruby) and container-structure-test definitions run by the CI |
@@ -24,6 +26,8 @@ Only these commands are known to work:
 - `docker run --rm -v $PWD:/app -w /app webdevops/dockerfile-build-env make provision` regenerates `docker/`. Run it after every change to `template/`, `provisioning/` or a `Dockerfile.jinja2`, and commit the result.
 - `docker build -t webdevops/<image>:<tag> docker/<image>/<tag>` builds one image; its parent and `webdevops/toolbox` come from local images or Docker Hub.
 - `./build-local.sh [version]` builds all PHP images of one version.
+- `docker run --rm -v $PWD:/app -w /app/ci webdevops/php:8.4-alpine composer install` installs the PHP tools of `ci/`.
+- `docker run --rm -v $PWD:/app -w /app/ci webdevops/php:8.4-alpine sh -c 'apk add --no-cache file && git config --global --add safe.directory /app && vendor/bin/grumphp run'` checks the PHP code in `ci/`: coding standard, PHPStan, Rector, `composer audit` and the PHPUnit tests. Run it after every change to `ci/`. GrumPHP and PHPStan only check files that Git knows (`git ls-files`), so `git add` new files first; PHPUnit runs every test anyway. `vendor/bin/phpunit` instead of `vendor/bin/grumphp run` runs only the tests. Changes to `ci/src` come with tests.
 
 Besides `provision`, the Makefile has `structure-test` and `setup`, which the `webdevops/dockerfile-build-env` image runs while it is built. `make structure-test` runs container-structure-test against your local images of `bootstrap`, `base`, `base-app`, `php`, `php-dev` and `php-nginx`, the images that have a suite in `tests/structure-test`. It tests only the tags in `.github/workflows/build.yaml` and fails if a test fails, if `docker` fails or if no such image exists locally; run it inside `webdevops/dockerfile-build-env` with the Docker socket mounted. The CI runs serverspec for every image except `toolbox` and `dockerfile-build-env`, and container-structure-test for the six images above; to check a change by hand, start the image and try it as described below.
 

README.md

@@ -75,6 +75,15 @@ docker run --rm -ti -v $PWD:/app -w /app webdevops/php:8.4-alpine ci/console rea
 The banner (`docs/assets/readme-banner-*.svg`) takes the PHP versions, web servers, base OS suffixes, Debian releases and platforms from the images that are built.
 Its texts are in `conf/readme-banner.yml`; the SVG files are never modified manually. The CI fails if the workflow or the banner is out of date.
 
+The PHP code in `ci/` follows the rules of [pluswerk/grumphp-config](https://github.com/andersundsehr/grumphp-config) (PSR-12, PHPStan level 8, Rector, `composer audit`) and has PHPUnit tests in `ci/tests`.
+GrumPHP runs all of them; after a change to `ci/`, run it with:
+
+```
+docker run --rm -ti -v $PWD:/app -w /app/ci webdevops/php:8.4-alpine sh -c 'apk add --no-cache file && git config --global --add safe.directory /app && vendor/bin/grumphp run'
+```
+
+The CI job "Check ci/" runs the same checks. No image build waits for it.
+
 GitHub Actions builds every image independently and runs the serverspec and structure tests
 defined for it before pushing it to Docker Hub. The CI also uses `ghcr.io/webdevops/`, but only
 internally; pull the images from Docker Hub.

ci/composer.json

@@ -1,22 +1,46 @@
 {
-    "name": "webdevops/dockerfile",
-    "type": "project",
-    "license": "MIT",
-    "authors": [
-        {
-            "name": "Hans Tuscher",
-            "email": "hhoechtl@1drop.de"
-        }
-    ],
-    "require": {
-        "bluem/tree": "^3.1",
-        "symfony/yaml": "^6.0",
-        "symfony/console": "^6.0",
-        "symfony/process": "^6.0"
-    },
-    "autoload": {
-        "psr-4": {
-            "Webdevops\\Build\\": "src/"
-        }
+  "name": "webdevops/dockerfile",
+  "license": "MIT",
+  "type": "project",
+  "authors": [
+    {
+      "name": "Hans Tuscher",
+      "email": "hhoechtl@1drop.de"
     }
+  ],
+  "require": {
+    "php": "^8.4",
+    "bluem/tree": "^4.0",
+    "symfony/console": "^6.0",
+    "symfony/process": "^6.0",
+    "symfony/yaml": "^6.0"
+  },
+  "require-dev": {
+    "phpunit/phpunit": "^12",
+    "pluswerk/grumphp-config": "^11.2"
+  },
+  "autoload": {
+    "psr-4": {
+      "Webdevops\\Build\\": "src/"
+    }
+  },
+  "autoload-dev": {
+    "psr-4": {
+      "Webdevops\\Build\\Tests\\": "tests/"
+    }
+  },
+  "config": {
+    "allow-plugins": {
+      "a9f/fractor-extension-installer": true,
+      "ergebnis/composer-normalize": true,
+      "phpro/grumphp": true,
+      "phpstan/extension-installer": true,
+      "pluswerk/grumphp-config": true
+    }
+  },
+  "extra": {
+    "grumphp": {
+      "disable-plugin": true
+    }
+  }
 }