Current score → target
CI health / meta-gate integrity: 3/5 → 5/5. This gate protects every other gate.
Defect class prevented
A PR silently weakening quality thresholds — lowering the Infection MSI, relaxing PHPInsights minima, loosening Deptrac layers, downgrading Psalm — turning every downstream check into theater.
Evidence
- The repo already ships this gate:
scripts/validate-configuration.sh fails if any LOCKED file (phpinsights.php, phpinsights-tests.php, psalm.xml, deptrac.yaml, infection.json5, phpmd.xml, phpmd.tests.xml, .php-cs-fixer.dist.php — lines 50-59) is modified relative to origin/main, and validates required directory structure.
- It is invoked only from
make ci (Makefile:589-596) — which no workflow runs. grep -rn validate-configuration .github/ → zero hits.
- Bonus signal of the class:
.php-cs-fixer.dist.php is a LOCKED file for a tool that itself never runs in any workflow.
Proposed fix
# add to symfony.yml (or a tiny standalone workflow), on: pull_request
- uses: actions/checkout@<sha>
with: {fetch-depth: 0} # script diffs against origin/main
- run: make validate-configurationLegitimate config changes must update the script's locked list in the same PR — that friction is the script's documented intent. Note: the Psalm-tightening issue and PHPUnit-strictness issue both touch locked/lockable files and must update the list in their PRs; add phpunit.xml.dist/phpunit.memory.xml.dist to the LOCKED list once strict mode lands.
Effort
S
Acceptance criteria
Filed by an automated CI/CD verification-coverage audit (OpenSSF Scorecard baseline: aggregate 6.0/10, local mode — SAST 0, Fuzzing 0, Token-Permissions 0, Pinned-Dependencies 5, Vulnerabilities 4). Audit method: inventory → gap analysis → git-history evidence mining → 3-iteration adversarial critique loop.
Generated by Claude Code
Current score → target
CI health / meta-gate integrity: 3/5 → 5/5. This gate protects every other gate.
Defect class prevented
A PR silently weakening quality thresholds — lowering the Infection MSI, relaxing PHPInsights minima, loosening Deptrac layers, downgrading Psalm — turning every downstream check into theater.
Evidence
scripts/validate-configuration.shfails if any LOCKED file (phpinsights.php,phpinsights-tests.php,psalm.xml,deptrac.yaml,infection.json5,phpmd.xml,phpmd.tests.xml,.php-cs-fixer.dist.php— lines 50-59) is modified relative to origin/main, and validates required directory structure.make ci(Makefile:589-596) — which no workflow runs.grep -rn validate-configuration .github/→ zero hits..php-cs-fixer.dist.phpis a LOCKED file for a tool that itself never runs in any workflow.Proposed fix
Legitimate config changes must update the script's locked list in the same PR — that friction is the script's documented intent. Note: the Psalm-tightening issue and PHPUnit-strictness issue both touch locked/lockable files and must update the list in their PRs; add
phpunit.xml.dist/phpunit.memory.xml.distto the LOCKED list once strict mode lands.Effort
S
Acceptance criteria
make validate-configurationruns blocking on every PR (green day one — it diffs against main)--min-msiin infection.json5 (or editing psalm.xml) fails the checkFiled by an automated CI/CD verification-coverage audit (OpenSSF Scorecard baseline: aggregate 6.0/10, local mode — SAST 0, Fuzzing 0, Token-Permissions 0, Pinned-Dependencies 5, Vulnerabilities 4). Audit method: inventory → gap analysis → git-history evidence mining → 3-iteration adversarial critique loop.
Generated by Claude Code