continuous-integration.yml

# GitHub Actions Documentation: https://docs.github.com/en/actions

name: "Continuous Integration"

on:
  push:
    branches:
      - "main"
    tags:
      - "*"
  pull_request:
    branches:
      - "main"

# Cancels all previous workflow runs for the same branch that have not yet completed.
concurrency:
  # The concurrency group contains the workflow name and the branch name.
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  COMPOSER_ROOT_VERSION: "1.99.99"

jobs:
  coding-standards:
    name: "Coding standards"
    runs-on: "ubuntu-latest"

    steps:
      - name: "Checkout repository"
        uses: "actions/checkout@v4.2.2"

      - name: "Install PHP"
        uses: "shivammathur/setup-php@2.31.1"
        with:
          php-version: "latest"
          coverage: "none"

      - name: "Install dependencies (Composer)"
        uses: "ramsey/composer-install@3.0.0"

      - name: "Check syntax (php-parallel-lint)"
        run: "composer dev:lint:syntax"

      - name: "Check coding standards (PHP_CodeSniffer)"
        run: "composer dev:lint:style"

  static-analysis:
    name: "Static analysis"
    runs-on: "ubuntu-latest"

    steps:
      - name: "Checkout repository"
        uses: "actions/checkout@v4.2.2"

      - name: "Install PHP"
        uses: "shivammathur/setup-php@2.31.1"
        with:
          php-version: "latest"
          coverage: "none"
          ini-values: "memory_limit=-1"

      - name: "Install dependencies (Composer)"
        uses: "ramsey/composer-install@3.0.0"

      - name: "Statically analyze code (PHPStan)"
        run: "composer dev:analyze:phpstan"

      - name: "Statically analyze code (Psalm)"
        run: "composer dev:analyze:psalm -- --shepherd"

  security-analysis:
    name: "Security analysis"
    needs: ["coding-standards", "static-analysis"]
    runs-on: "ubuntu-latest"

    # If you encounter "Resource not accessible by integration" errors on
    # GitHub Actions for this job, uncomment the following lines. Your
    # organization permissions may not be set to allow writing security events.
    permissions:
      security-events: write

    steps:
      - name: "Checkout repository"
        uses: "actions/checkout@v4.2.2"

      - name: "Install PHP"
        uses: "shivammathur/setup-php@2.31.1"
        with:
          php-version: "latest"
          coverage: "none"

      - name: "Install dependencies (Composer)"
        uses: "ramsey/composer-install@3.0.0"

      - name: "Analyze security of code (Psalm)"
        run: "./vendor/bin/psalm --taint-analysis --report=build/logs/psalm.sarif"

      - name: "Upload security analysis results to GitHub"
        uses: "github/codeql-action/upload-sarif@v3"
        with:
          sarif_file: "build/logs/psalm.sarif"

  code-coverage:
    name: "Code coverage"
    needs: ["coding-standards", "static-analysis"]
    runs-on: "ubuntu-latest"

    steps:
      - name: "Checkout repository"
        uses: "actions/checkout@v4.2.2"

      - name: "Install PHP"
        uses: "shivammathur/setup-php@2.31.1"
        with:
          php-version: "latest"
          coverage: "pcov"
          ini-values: "memory_limit=-1"

      - name: "Install dependencies (Composer)"
        uses: "ramsey/composer-install@3.0.0"

      - name: "Run unit tests (PHPUnit)"
        run: "composer dev:test:coverage:ci"

      - name: "Publish coverage report to Codecov"
        uses: "codecov/codecov-action@v4.4.1"

  unit-tests:
    name: "Unit tests"
    needs: ["code-coverage"]
    runs-on: ${{ matrix.os }}

    strategy:
      fail-fast: false
      matrix:
        php:
          - "8.1"
          - "8.2"
        os:
          - "macos-latest"
          - "ubuntu-latest"
          - "windows-latest"
        composer-deps:
          - "lowest"
          - "highest"
        include:
          - php: "8.3"
            os: "macos-latest"
            composer-deps: "highest"
            composer-options: "--ignore-platform-reqs"
          - php: "8.3"
            os: "ubuntu-latest"
            composer-deps: "highest"
            composer-options: "--ignore-platform-reqs"
          - php: "8.3"
            os: "windows-latest"
            composer-deps: "highest"
            composer-options: "--ignore-platform-reqs"

    steps:
      - name: "Configure Git (for Windows)"
        if: ${{ matrix.os == 'windows-latest' }}
        shell: "bash"
        run: |
          git config --system core.autocrlf false
          git config --system core.eol lf

      - name: "Checkout repository"
        uses: "actions/checkout@v4.2.2"

      - name: "Install PHP"
        uses: "shivammathur/setup-php@2.31.1"
        with:
          php-version: "${{ matrix.php }}"
          coverage: "none"

      - name: "Install dependencies (Composer)"
        uses: "ramsey/composer-install@3.0.0"
        with:
          dependency-versions: "${{ matrix.composer-deps }}"
          composer-options: "${{ matrix.composer-options }}"

      - name: "Run unit tests (PHPUnit)"
        shell: "bash"
        run: "composer dev:test:unit"