Workflow improvements (cancel in progress action and only install nec…

.github/workflows/cypress.yml

@@ -8,6 +8,13 @@ on:
     types: [ opened, labeled, synchronize ]
 
 name: E2E Test
+# Cancel superseded runs for the same branch. The group is named explicitly
+# rather than derived from github.workflow: several files share the workflow
+# name `Inspections` and would otherwise cancel each other.
+concurrency:
+  group: formidable-cypress-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   cypress:
     if: contains(github.event.pull_request.labels.*.name, 'run tests')

.github/workflows/jscs.yml

@@ -7,6 +7,13 @@ on:
   pull_request:
     types: [opened, labeled, synchronize]
 
+# Cancel superseded runs for the same branch. The group is named explicitly
+# rather than derived from github.workflow: several files share the workflow
+# name `Inspections` and would otherwise cancel each other.
+concurrency:
+  group: formidable-jscs-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   runESLintInspection:
     if: contains(github.event.pull_request.labels.*.name, 'run analysis')

.github/workflows/mago.yml

@@ -1,6 +1,13 @@
 on: [push]
 
 name: Mago Code Analysis and Linting
+# Cancel superseded runs for the same branch. The group is named explicitly
+# rather than derived from github.workflow: several files share the workflow
+# name `Inspections` and would otherwise cancel each other.
+concurrency:
+  group: formidable-mago-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   mago:
     name: Mago
@@ -16,8 +23,22 @@ jobs:
         with:
           php-version: '8.1'
 
-      - name: Install dependencies
-        run: composer install --dev --prefer-dist --no-progress
+      # Install only what this job runs, instead of every require-dev package.
+      # mago.toml lists vendor/php-stubs/wordpress-stubs/wordpress-stubs.php under
+      # includes. Without it `mago analyze` reports 8000+ non-existent-function
+      # errors for every WordPress call.
+      # The guard fails the job if a package is renamed or dropped from
+      # composer.json, rather than silently narrowing to nothing.
+      - name: Install Mago
+        run: |
+          NEED='carthage-software/mago php-stubs/wordpress-stubs'
+          for pkg in $NEED; do
+            jq -e --arg pkg "$pkg" '."require-dev" | has($pkg)' composer.json > /dev/null \
+              || { echo "::error::composer.json has no require-dev entry for $pkg"; exit 1; }
+          done
+          jq '{require, autoload, config, "require-dev": (."require-dev" | with_entries(select(.key as $k | $ARGS.positional | index($k))))}' \
+            composer.json --args $NEED > composer.ci.json
+          COMPOSER=composer.ci.json composer install --prefer-dist --no-progress
 
       - name: "✅ Mago Lint"
         run: vendor/bin/mago lint

.github/workflows/oxlint.yml

@@ -7,6 +7,13 @@ on:
   pull_request:
     types: [opened, labeled, synchronize]
 
+# Cancel superseded runs for the same branch. The group is named explicitly
+# rather than derived from github.workflow: several files share the workflow
+# name `Inspections` and would otherwise cancel each other.
+concurrency:
+  group: formidable-oxlint-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   runOxlintInspection:
     if: contains(github.event.pull_request.labels.*.name, 'run analysis')

.github/workflows/php-cs-fixer.yml

@@ -8,15 +8,35 @@ on:
     types: [ opened, labeled, synchronize ]
 
 name: Inspections
+# Cancel superseded runs for the same branch. The group is named explicitly
+# rather than derived from github.workflow: several files share the workflow
+# name `Inspections` and would otherwise cancel each other.
+concurrency:
+  group: formidable-php-cs-fixer-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   runPHPCSFixerInspection:
     if: contains(github.event.pull_request.labels.*.name, 'run analysis')
     name: Run PHP CS Fixer inspection
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4.1.1
-      - name: Install dependencies
-        run: composer install --dev --prefer-dist --no-progress
+      # Install only what this job runs, instead of every require-dev package.
+      # .php-cs-fixer.php references PhpCsFixerCustomFixers\Fixer\* rules, which is
+      # what the second package provides.
+      # The guard fails the job if a package is renamed or dropped from
+      # composer.json, rather than silently narrowing to nothing.
+      - name: Install PHP-CS-Fixer
+        run: |
+          NEED='friendsofphp/php-cs-fixer kubawerlos/php-cs-fixer-custom-fixers'
+          for pkg in $NEED; do
+            jq -e --arg pkg "$pkg" '."require-dev" | has($pkg)' composer.json > /dev/null \
+              || { echo "::error::composer.json has no require-dev entry for $pkg"; exit 1; }
+          done
+          jq '{require, autoload, config, "require-dev": (."require-dev" | with_entries(select(.key as $k | $ARGS.positional | index($k))))}' \
+            composer.json --args $NEED > composer.ci.json
+          COMPOSER=composer.ci.json composer install --prefer-dist --no-progress
 
       - name: PHPCSFixer check
         run: ./vendor/bin/php-cs-fixer fix --dry-run --allow-risky=yes --verbose

.github/workflows/phpcs.yml

@@ -8,15 +8,36 @@ on:
     types: [ opened, labeled, synchronize ]
 
 name: Inspections
+# Cancel superseded runs for the same branch. The group is named explicitly
+# rather than derived from github.workflow: several files share the workflow
+# name `Inspections` and would otherwise cancel each other.
+concurrency:
+  group: formidable-phpcs-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   runPHPCSInspection:
     if: contains(github.event.pull_request.labels.*.name, 'run analysis')
     name: Run PHPCS inspection
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4.1.1
-      - name: Install dependencies
-        run: composer install --dev --prefer-dist --no-progress
+      # Install only what this job runs, instead of every require-dev package.
+      # phpcs.xml references WordPress, WordPressVIPMinimum and SlevomatCodingStandard;
+      # wpcs also pulls phpcsextra/phpcsutils and the dealerdirect installer that
+      # registers all three standards with phpcs.
+      # The guard fails the job if a package is renamed or dropped from
+      # composer.json, rather than silently narrowing to nothing.
+      - name: Install PHPCS and its standards
+        run: |
+          NEED='squizlabs/php_codesniffer wp-coding-standards/wpcs automattic/vipwpcs slevomat/coding-standard'
+          for pkg in $NEED; do
+            jq -e --arg pkg "$pkg" '."require-dev" | has($pkg)' composer.json > /dev/null \
+              || { echo "::error::composer.json has no require-dev entry for $pkg"; exit 1; }
+          done
+          jq '{require, autoload, config, "require-dev": (."require-dev" | with_entries(select(.key as $k | $ARGS.positional | index($k))))}' \
+            composer.json --args $NEED > composer.ci.json
+          COMPOSER=composer.ci.json composer install --prefer-dist --no-progress
 
       - name: Register custom PHPCS sniffs
         run: |

.github/workflows/phpstan.yml

@@ -1,6 +1,13 @@
 on: [push]
 
 name: PHPStan Code Analysis
+# Cancel superseded runs for the same branch. The group is named explicitly
+# rather than derived from github.workflow: several files share the workflow
+# name `Inspections` and would otherwise cancel each other.
+concurrency:
+  group: formidable-phpstan-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   phpstan:
     name: PHPStan
@@ -19,8 +26,40 @@ jobs:
           ini-values: display_errors = on, error_reporting = E_ALL
           tools: composer
 
-      - name: "💽  Installing Composer Packages"
-        run: composer install
+      # Install only what this job runs, instead of every require-dev package.
+      # phpstan.neon bootstraps vendor/php-stubs/wordpress-stubs and stubs.php, and
+      # stubs.php references PHPUnit\Framework\TestCase - without phpunit-polyfills
+      # the run dies while loading the bootstrap file.
+      # The guard fails the job if a package is renamed or dropped from
+      # composer.json, rather than silently narrowing to nothing.
+      - name: Install PHPStan
+        run: |
+          NEED='phpstan/phpstan phpstan/extension-installer phpstan/phpstan-strict-rules php-stubs/wordpress-stubs yoast/phpunit-polyfills'
+          for pkg in $NEED; do
+            jq -e --arg pkg "$pkg" '."require-dev" | has($pkg)' composer.json > /dev/null \
+              || { echo "::error::composer.json has no require-dev entry for $pkg"; exit 1; }
+          done
+          jq '{require, autoload, config, "require-dev": (."require-dev" | with_entries(select(.key as $k | $ARGS.positional | index($k))))}' \
+            composer.json --args $NEED > composer.ci.json
+          COMPOSER=composer.ci.json composer install --prefer-dist --no-progress
+
+      # PHPStan's result cache means only changed files get re-analysed.
+      # /tmp/phpstan is where it lands by default (sys_get_temp_dir() +
+      # '/phpstan'); this PHPStan build has no flag to relocate it, and pointing
+      # tmpDir into the working tree would make `analyze ./` walk its own
+      # cache. PHPStan
+      # validates the cache against its own version and the config, so a stale
+      # restore degrades to a full analysis rather than a wrong result. The sha
+      # suffix is needed because cache entries are immutable - without it the
+      # first entry would win forever and the cache would never advance.
+      - name: Cache PHPStan results
+        uses: actions/cache@v4
+        with:
+          path: /tmp/phpstan
+          key: formidable-phpstan-${{ hashFiles('composer.json', 'phpstan.neon') }}-${{ github.sha }}
+          restore-keys: |
+            formidable-phpstan-${{ hashFiles('composer.json', 'phpstan.neon') }}-
+            formidable-phpstan-
 
       - name: "🧪 Test"
         run: vendor/bin/phpstan analyze ./ --memory-limit=2G

.github/workflows/phpunit.yml

@@ -8,6 +8,13 @@ on:
     types: [ opened, labeled, synchronize ]
 
 name: PHPUnit
+# Cancel superseded runs for the same branch. The group is named explicitly
+# rather than derived from github.workflow: several files share the workflow
+# name `Inspections` and would otherwise cancel each other.
+concurrency:
+  group: formidable-phpunit-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build-test:
     if: contains(github.event.pull_request.labels.*.name, 'run tests')

.github/workflows/psalm.yml

@@ -9,6 +9,13 @@ on:
       - master
 
 name: Psalm Code Analysis
+# Cancel superseded runs for the same branch. The group is named explicitly
+# rather than derived from github.workflow: several files share the workflow
+# name `Inspections` and would otherwise cancel each other.
+concurrency:
+  group: formidable-psalm-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   psalm:
     name: Psalm

.github/workflows/rector.yml

@@ -8,15 +8,37 @@ on:
     types: [ opened, labeled, synchronize ]
 
 name: Inspections
+# Cancel superseded runs for the same branch. The group is named explicitly
+# rather than derived from github.workflow: several files share the workflow
+# name `Inspections` and would otherwise cancel each other.
+concurrency:
+  group: formidable-rector-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   runRectorInspection:
     if: contains(github.event.pull_request.labels.*.name, 'run analysis')
     name: Run Rector inspection
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4.1.1
-      - name: Install dependencies
-        run: composer install --dev --prefer-dist --no-progress
+      # Install only what this job runs, instead of every require-dev package.
+      # phpstan/phpstan is here for its exact pin, which is what holds Rector at
+      # 2.3.5 - resolving without it picks Rector 2.6.2, which fails this job on
+      # deprecated-rule warnings. phpunit-polyfills supplies the PHPUnit classes
+      # that rector.php's withAutoloadPaths() ends up loading.
+      # The guard fails the job if a package is renamed or dropped from
+      # composer.json, rather than silently narrowing to nothing.
+      - name: Install Rector
+        run: |
+          NEED='rector/rector phpstan/phpstan yoast/phpunit-polyfills'
+          for pkg in $NEED; do
+            jq -e --arg pkg "$pkg" '."require-dev" | has($pkg)' composer.json > /dev/null \
+              || { echo "::error::composer.json has no require-dev entry for $pkg"; exit 1; }
+          done
+          jq '{require, autoload, config, "require-dev": (."require-dev" | with_entries(select(.key as $k | $ARGS.positional | index($k))))}' \
+            composer.json --args $NEED > composer.ci.json
+          COMPOSER=composer.ci.json composer install --prefer-dist --no-progress
 
       - name: Rector check
         run: ./vendor/bin/rector process --dry-run

.github/workflows/stylelint.yml

@@ -7,6 +7,13 @@ on:
   pull_request:
     types: [opened, labeled, synchronize]
 
+# Cancel superseded runs for the same branch. The group is named explicitly
+# rather than derived from github.workflow: several files share the workflow
+# name `Inspections` and would otherwise cancel each other.
+concurrency:
+  group: formidable-stylelint-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   runStylelintInspection:
     if: contains(github.event.pull_request.labels.*.name, 'run analysis')

.github/workflows/syntax.yml

@@ -8,6 +8,13 @@ on:
     types: [ opened, labeled, synchronize ]
 
 name: PHP Syntax Check
+# Cancel superseded runs for the same branch. The group is named explicitly
+# rather than derived from github.workflow: several files share the workflow
+# name `Inspections` and would otherwise cancel each other.
+concurrency:
+  group: formidable-syntax-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   runPHPSyntaxCheck:
     if: contains(github.event.pull_request.labels.*.name, 'run analysis')

.github/workflows/typos.yml

@@ -9,6 +9,13 @@ on:
       - master
 
 name: Typo Checks
+# Cancel superseded runs for the same branch. The group is named explicitly
+# rather than derived from github.workflow: several files share the workflow
+# name `Inspections` and would otherwise cancel each other.
+concurrency:
+  group: formidable-typos-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   run:
     name: Spell Check with Typos

composer.json

@@ -42,7 +42,7 @@
 		"rector/rector": "^2.3.4",
 		"phpstan/phpstan-strict-rules": "^2.0",
 		"kubawerlos/php-cs-fixer-custom-fixers": "^3.36",
-		"carthage-software/mago": "^1.40.1"
+		"carthage-software/mago": "1.46.0"
 	},
 	"config": {
 		"allow-plugins": {