From d1b04cd8e38489dd00f9f8f07faf004fccf527fa Mon Sep 17 00:00:00 2001 From: Martin Georgiev Date: Fri, 15 May 2026 16:04:40 +0100 Subject: [PATCH 1/5] chore: modernise GitHub workflows - Split CI into static-analysis and tests jobs using PHP Alpine containers - Switch all runners to ubuntu-24.04 - Add Sloth as a single required check gate - Auto-merge for internal PRs - Stale branch cleanup - Harden workflows with explicit permissions and fork PR guards --- .github/workflows/automerge.yml | 32 +++++++ .github/workflows/ci.yml | 98 ++++++++++++++-------- .github/workflows/conventional-commits.yml | 12 ++- .github/workflows/release.yml | 5 +- .github/workflows/sloth.yml | 19 +++++ .github/workflows/stale-activity.yml | 26 ++++++ 6 files changed, 151 insertions(+), 41 deletions(-) create mode 100644 .github/workflows/automerge.yml create mode 100644 .github/workflows/sloth.yml create mode 100644 .github/workflows/stale-activity.yml diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml new file mode 100644 index 00000000..4f2e5fd9 --- /dev/null +++ b/.github/workflows/automerge.yml @@ -0,0 +1,32 @@ +name: "Enable auto-merge" + +on: + pull_request: + types: + - opened + - ready_for_review + - reopened + - edited + +permissions: {} + +jobs: + enable-automerge: + name: "Enable auto-merge" + runs-on: ubuntu-24.04 + if: > + github.event.pull_request.base.ref == 'master' && + github.event.pull_request.draft == false && + github.event.pull_request.auto_merge == null && + github.event.pull_request.head.repo.full_name == github.repository + steps: + - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 + id: app-token + with: + app-id: ${{ secrets.LENDABOT_APP_ID }} + private-key: ${{ secrets.LENDABOT_APP_PRIVATE_KEY }} + - env: + GH_TOKEN: ${{ steps.app-token.outputs.token }} + PR_NUMBER: ${{ github.event.pull_request.number }} + REPO: ${{ github.event.repository.full_name }} + run: gh pr merge -R "$REPO" "$PR_NUMBER" --auto diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6aeed6ca..ec8f60be 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -11,10 +11,58 @@ on: branches: - "master" +permissions: + contents: read + jobs: - ci: - name: "Execute (PHP ${{ matrix.php-version }} with ${{ matrix.dependencies }} deps)" - runs-on: "ubuntu-latest" + static-analysis: + name: "Static analysis" + runs-on: ubuntu-24.04 + container: + image: public.ecr.aws/docker/library/php:8.3-cli-alpine + env: + COMPOSER_ALLOW_SUPERUSER: true + COMPOSER_ROOT_VERSION: dev-master + + steps: + - name: "Install bash, git" + run: apk add --no-cache bash git + + - name: "Install Composer" + run: curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/bin --filename=composer --version=2.9.8 + + - name: "Checkout" + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + + - name: "Install dependencies" + uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0 + + - name: "Validate Composer dependencies" + run: composer validate + + - name: "Check Composer dependency licenses" + run: composer licenses:check + + - name: "Run linting" + run: composer lint + + - name: "Run coding style" + run: composer code-style:check + + - name: "Run PHPStan" + run: composer phpstan + + - name: "Run Rector" + run: composer rector:check + + tests: + name: "Tests (PHP ${{ matrix.php-version }}, ${{ matrix.dependencies }} deps)" + runs-on: ubuntu-24.04 + container: + image: public.ecr.aws/docker/library/php:${{ matrix.php-version }}-cli-alpine + env: + COMPOSER_ALLOW_SUPERUSER: true + COMPOSER_ROOT_VERSION: dev-master strategy: fail-fast: false @@ -29,45 +77,23 @@ jobs: - "8.5" steps: - - name: "Checkout" - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6 + - name: "Install bash, git" + run: apk add --no-cache bash git - - name: "Install PHP" - uses: "shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc" # v2 - with: - php-version: "${{ matrix.php-version }}" - ini-values: memory_limit=-1 + - name: "Install Composer" + run: curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/bin --filename=composer --version=2.9.8 + + - name: "Checkout" + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: "Update Composer platform version" if: ${{ matrix.dependencies != 'locked' && matrix.php-version != '8.3' }} - shell: bash - run: "composer config platform.php ${{ matrix.php-version }}" + run: composer config platform.php ${{ matrix.php-version }} - name: "Install dependencies" - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # 4.0.0 + uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0 with: dependency-versions: "${{ matrix.dependencies }}" - - name: "Validate Composer dependencies" - run: "composer validate" - - - name: "Check Composer dependency licenses" - run: "composer licenses:check" - - - name: "Run linting" - run: "composer lint" - - - name: "Run coding style" - if: ${{ matrix.dependencies == 'locked' && matrix.php-version == '8.3' }} - run: "composer code-style:check" - - - name: "Run PHPStan" - if: ${{ matrix.dependencies == 'locked' }} - run: "composer phpstan" - - - name: "Run Rector" - if: ${{ matrix.dependencies == 'locked' }} - run: "composer rector:check" - - - name: "Tests" - run: "composer tests" + - name: "Run tests" + run: composer tests diff --git a/.github/workflows/conventional-commits.yml b/.github/workflows/conventional-commits.yml index 7f599be0..ca35a9b3 100644 --- a/.github/workflows/conventional-commits.yml +++ b/.github/workflows/conventional-commits.yml @@ -1,7 +1,6 @@ -name: Conventional Commits +name: "Conventional Commits" on: - # https://github.com/marketplace/actions/semantic-pull-request#event-triggers pull_request: types: - opened @@ -11,13 +10,20 @@ on: merge_group: permissions: + contents: read pull-requests: read jobs: main: - name: Validate PR title + name: "Validate PR title" runs-on: ubuntu-24.04 steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + sparse-checkout: | + .github/commitlint.config.js + sparse-checkout-cone-mode: false + - uses: benhodgson87/conventional-pull-request-action@14ff798e4d745c3e3e951f6ef472ff598b9c47a5 # v1 if: ${{ github.event_name == 'pull_request' }} env: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d499c5d3..3e8c69f8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,4 +1,4 @@ -name: Release +name: "Release" on: push: @@ -13,11 +13,12 @@ permissions: concurrency: group: "release-${{ github.ref_name }}" + cancel-in-progress: true jobs: release-please: + name: "Make a new release" runs-on: ubuntu-24.04 - name: Release Automation steps: - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 id: generate-token diff --git a/.github/workflows/sloth.yml b/.github/workflows/sloth.yml new file mode 100644 index 00000000..586ec504 --- /dev/null +++ b/.github/workflows/sloth.yml @@ -0,0 +1,19 @@ +name: "Sloth" + +on: + pull_request: + merge_group: + +permissions: + contents: read + checks: read + +jobs: + sloth: + name: "Sloth" + runs-on: ubuntu-24.04 + steps: + - name: Sloth + uses: lendable/sloth@c4a89bf8c6c41c5c0d69b05344e18481ea62993d # v1.1 + with: + token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/stale-activity.yml b/.github/workflows/stale-activity.yml new file mode 100644 index 00000000..48633d19 --- /dev/null +++ b/.github/workflows/stale-activity.yml @@ -0,0 +1,26 @@ +name: "Stale Activity" + +on: + schedule: + - cron: "30 7 * * 1-5" + workflow_dispatch: + +permissions: + contents: write + actions: read + pull-requests: read + +jobs: + remove-stale-branches: + name: "Remove stale branches" + runs-on: ubuntu-24.04 + steps: + - uses: fpicalausa/remove-stale-branches@9b829bc2975ade0c61e64e9613def53ec0732440 # v2.6.1 + with: + exempt-branches-regex: "^(master)$" + days-before-branch-stale: 182 + days-before-branch-delete: 7 + stale-branch-message: > + This branch [{branchName}]({branchUrl}) hasn't been updated in the last 6 months and is marked as stale. + + It will be removed in a week. If you want to keep this branch around, delete this comment or add new commits to this branch. From e94415c3e9d90cb1ea9649ec80c1e23c85bc6c71 Mon Sep 17 00:00:00 2001 From: Martin Georgiev Date: Fri, 15 May 2026 16:08:37 +0100 Subject: [PATCH 2/5] install pcov via pecl in the tests job setup step (PHPIZE_DEPS is predefined in the official PHP Docker image and provides the build toolchain) --- .github/workflows/ci.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ec8f60be..a6085140 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -77,8 +77,11 @@ jobs: - "8.5" steps: - - name: "Install bash, git" - run: apk add --no-cache bash git + - name: "Install bash, git, and pcov" + run: | + apk add --no-cache bash git $PHPIZE_DEPS + pecl install pcov + docker-php-ext-enable pcov - name: "Install Composer" run: curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/bin --filename=composer --version=2.9.8 From 233a5ad411fc43b6714d07546001e7b0a8da66b5 Mon Sep 17 00:00:00 2001 From: Martin Georgiev Date: Fri, 15 May 2026 17:01:30 +0100 Subject: [PATCH 3/5] bump sloth --- .github/workflows/sloth.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/sloth.yml b/.github/workflows/sloth.yml index 586ec504..20213436 100644 --- a/.github/workflows/sloth.yml +++ b/.github/workflows/sloth.yml @@ -14,6 +14,6 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Sloth - uses: lendable/sloth@c4a89bf8c6c41c5c0d69b05344e18481ea62993d # v1.1 + uses: lendable/sloth@dbff4bbe34557fd3bd3865387f900d92034b9259 # v1.2 with: token: ${{ secrets.GITHUB_TOKEN }} From 12bfffad7f7ec048438207853a8a6ee55edab540 Mon Sep 17 00:00:00 2001 From: Martin Georgiev Date: Fri, 15 May 2026 17:06:46 +0100 Subject: [PATCH 4/5] tweak ignore matching settings --- .github/workflows/sloth.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/sloth.yml b/.github/workflows/sloth.yml index 20213436..a1934ab0 100644 --- a/.github/workflows/sloth.yml +++ b/.github/workflows/sloth.yml @@ -17,3 +17,4 @@ jobs: uses: lendable/sloth@dbff4bbe34557fd3bd3865387f900d92034b9259 # v1.2 with: token: ${{ secrets.GITHUB_TOKEN }} + case-sensitive: false From bd4324a741ba9c1d9857546e7439f9ea6d01d69f Mon Sep 17 00:00:00 2001 From: Martin Georgiev Date: Wed, 27 May 2026 17:33:10 +0100 Subject: [PATCH 5/5] Delete .github/workflows/automerge.yml --- .github/workflows/automerge.yml | 32 -------------------------------- 1 file changed, 32 deletions(-) delete mode 100644 .github/workflows/automerge.yml diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml deleted file mode 100644 index 4f2e5fd9..00000000 --- a/.github/workflows/automerge.yml +++ /dev/null @@ -1,32 +0,0 @@ -name: "Enable auto-merge" - -on: - pull_request: - types: - - opened - - ready_for_review - - reopened - - edited - -permissions: {} - -jobs: - enable-automerge: - name: "Enable auto-merge" - runs-on: ubuntu-24.04 - if: > - github.event.pull_request.base.ref == 'master' && - github.event.pull_request.draft == false && - github.event.pull_request.auto_merge == null && - github.event.pull_request.head.repo.full_name == github.repository - steps: - - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 - id: app-token - with: - app-id: ${{ secrets.LENDABOT_APP_ID }} - private-key: ${{ secrets.LENDABOT_APP_PRIVATE_KEY }} - - env: - GH_TOKEN: ${{ steps.app-token.outputs.token }} - PR_NUMBER: ${{ github.event.pull_request.number }} - REPO: ${{ github.event.repository.full_name }} - run: gh pr merge -R "$REPO" "$PR_NUMBER" --auto