Repository navigation
chore(deps): bump anchore/sbom-action from 0.24.2 to 0.24.3 #75
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| - master | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| quality: | |
| name: Quality and contracts | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up PHP | |
| uses: shivammathur/setup-php@db91e1a0e48e84637d325a7ee4d2677e146ceec4 # 2.36.0 | |
| with: | |
| php-version: "8.2" | |
| coverage: none | |
| tools: composer:v2 | |
| - name: Validate Composer metadata | |
| run: composer validate --strict | |
| - name: Install locked dependencies | |
| run: composer install --no-interaction --prefer-dist | |
| - name: Run quality and contract gates | |
| run: composer check | |
| - name: Test release workflow detection | |
| run: node --test tools/tests/release-detection.test.mjs | |
| compatibility: | |
| name: PHP ${{ matrix.php }} / ${{ matrix.dependencies }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| php: ["7.4", "8.0", "8.1", "8.2", "8.3", "8.4", "8.5"] | |
| dependencies: [lowest, latest] | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up PHP | |
| uses: shivammathur/setup-php@db91e1a0e48e84637d325a7ee4d2677e146ceec4 # 2.36.0 | |
| with: | |
| php-version: ${{ matrix.php }} | |
| coverage: none | |
| tools: composer:v2 | |
| - name: Resolve dependencies | |
| run: composer update --no-interaction --prefer-dist ${{ matrix.dependencies == 'lowest' && '--prefer-lowest' || '' }} | |
| - name: Run hermetic unit tests | |
| run: composer test:unit | |
| coverage: | |
| name: Coverage evidence | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up PHP with Xdebug | |
| uses: shivammathur/setup-php@db91e1a0e48e84637d325a7ee4d2677e146ceec4 # 2.36.0 | |
| with: | |
| php-version: "8.2" | |
| # Keep branch-coverage semantics stable across runner image updates. | |
| extensions: xdebug-3.5.3 | |
| coverage: xdebug | |
| tools: composer:v2 | |
| - name: Verify pinned coverage driver | |
| run: php -r 'if (phpversion("xdebug") !== "3.5.3") { fwrite(STDERR, "Expected Xdebug 3.5.3\n"); exit(1); }' | |
| - name: Install locked dependencies | |
| run: composer install --no-interaction --prefer-dist | |
| - name: Generate fresh line and branch coverage | |
| run: composer test:coverage | |
| env: | |
| XDEBUG_MODE: coverage | |
| - name: Print coverage summary | |
| run: | | |
| cat build/coverage/summary.txt | |
| php tools/report-uncovered.php build/coverage/clover.xml | |
| php tools/report-uncovered-branches.php build/coverage/coverage.php | |
| - name: Enforce complete line and branch coverage | |
| run: php tools/check-coverage.php build/coverage/summary.txt 100 | |
| - name: Upload fresh coverage evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: coverage-evidence | |
| path: | | |
| build/coverage/clover.xml | |
| build/coverage/cobertura.xml | |
| build/coverage/summary.txt | |
| if-no-files-found: error | |
| retention-days: 14 | |
| mutation: | |
| name: Mutation baseline | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up PHP with Xdebug | |
| uses: shivammathur/setup-php@db91e1a0e48e84637d325a7ee4d2677e146ceec4 # 2.36.0 | |
| with: | |
| php-version: "8.3" | |
| extensions: xdebug-3.5.3 | |
| coverage: xdebug | |
| tools: composer:v2 | |
| - name: Verify pinned coverage driver | |
| run: php -r 'if (phpversion("xdebug") !== "3.5.3") { fwrite(STDERR, "Expected Xdebug 3.5.3\n"); exit(1); }' | |
| - name: Install locked dependencies | |
| run: composer install --no-interaction --prefer-dist | |
| - name: Download and verify Infection 0.35.3 | |
| run: | | |
| curl --fail --location --silent --show-error --output /tmp/infection.phar https://github.com/infection/infection/releases/download/0.35.3/infection.phar | |
| echo "f7109fe91555eba08657c789a55377a1d27809fdb50d553de5654b196eb221aa /tmp/infection.phar" | sha256sum --check | |
| - name: Run full-source mutation baseline | |
| run: php /tmp/infection.phar --configuration=infection.json5.dist --no-progress | |
| env: | |
| XDEBUG_MODE: coverage | |
| - name: Print mutation summary | |
| if: always() | |
| run: cat build/mutation/summary.log | |
| - name: Upload mutation evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: mutation-evidence | |
| path: build/mutation/ | |
| if-no-files-found: warn | |
| retention-days: 14 | |
| consumers: | |
| name: ${{ matrix.fixture }} consumer | |
| needs: archive | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| fixture: [plain, laravel, symfony] | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up PHP | |
| uses: shivammathur/setup-php@db91e1a0e48e84637d325a7ee4d2677e146ceec4 # 2.36.0 | |
| with: | |
| php-version: "8.2" | |
| coverage: none | |
| tools: composer:v2 | |
| - name: Download inspected source archive | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: distribution-archive | |
| path: build/dist | |
| - name: Prepare archive-backed package repository | |
| run: | | |
| mkdir -p build/consumer-source | |
| tar -xzf build/dist/fleetbase-php-dev.tar.gz -C build/consumer-source | |
| php tools/configure-consumer-fixture.php "fixtures/consumer/${{ matrix.fixture }}" "build/consumer-source/fleetbase-php-dev" | |
| - name: Install consumer from inspected archive | |
| run: composer update --working-dir=fixtures/consumer/${{ matrix.fixture }} --no-interaction --prefer-dist | |
| - name: Verify framework integration | |
| run: composer verify --working-dir=fixtures/consumer/${{ matrix.fixture }} | |
| - name: Verify optimized production autoloading | |
| run: composer install --working-dir=fixtures/consumer/${{ matrix.fixture }} --no-interaction --no-dev --optimize-autoloader | |
| archive: | |
| name: Distribution archive | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up PHP | |
| uses: shivammathur/setup-php@db91e1a0e48e84637d325a7ee4d2677e146ceec4 # 2.36.0 | |
| with: | |
| php-version: "8.2" | |
| coverage: none | |
| - name: Build deterministic source archive | |
| run: | | |
| mkdir -p build/dist | |
| git archive --format=tar.gz --prefix=fleetbase-php-dev/ --output=build/dist/fleetbase-php-dev.tar.gz HEAD | |
| - name: Inspect distribution contents | |
| run: php tools/check-release-archive.php build/dist/fleetbase-php-dev.tar.gz | |
| - name: Upload inspected source archive | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: distribution-archive | |
| path: build/dist/fleetbase-php-dev.tar.gz | |
| if-no-files-found: error | |
| retention-days: 14 | |
| release-candidate: | |
| name: Release candidate dry run | |
| if: startsWith(github.head_ref || github.ref_name, 'release/') | |
| needs: [quality, compatibility, coverage, mutation, consumers, archive] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Check out complete source history | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up PHP and Composer | |
| uses: shivammathur/setup-php@db91e1a0e48e84637d325a7ee4d2677e146ceec4 # 2.36.0 | |
| with: | |
| php-version: "8.2" | |
| coverage: none | |
| tools: composer:v2 | |
| - name: Derive version from release branch | |
| shell: bash | |
| run: | | |
| branch="${GITHUB_HEAD_REF:-$GITHUB_REF_NAME}" | |
| version="${branch#release/}" | |
| version="${version#v}" | |
| echo "RELEASE_VERSION=$version" >> "$GITHUB_ENV" | |
| - name: Validate release identity and dependency security | |
| run: | | |
| php tools/check-release-version.php "$RELEASE_VERSION" --allow-non-main | |
| composer audit --locked --no-interaction | |
| - name: Download exact coverage evidence | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: coverage-evidence | |
| path: build/coverage | |
| - name: Build and inspect the release archive | |
| run: | | |
| mkdir -p build/release-candidate | |
| git archive --format=tar.gz --prefix="fleetbase-php-${RELEASE_VERSION}/" --output="build/release-candidate/fleetbase-php-${RELEASE_VERSION}.tar.gz" HEAD | |
| php tools/check-release-archive.php "build/release-candidate/fleetbase-php-${RELEASE_VERSION}.tar.gz" | |
| - name: Generate CycloneDX SBOM | |
| uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 | |
| with: | |
| path: . | |
| format: cyclonedx-json | |
| output-file: build/release-candidate/fleetbase-php-release.sbom.cdx.json | |
| upload-artifact: false | |
| dependency-snapshot: false | |
| - name: Collect release evidence and checksums | |
| run: | | |
| cp build/coverage/summary.txt build/release-candidate/coverage-summary.txt | |
| cp docs/api-coverage.md build/release-candidate/api-coverage.md | |
| cd build/release-candidate | |
| sha256sum fleetbase-php-* > SHA256SUMS | |
| - name: Upload complete release candidate | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: fleetbase-php-release-candidate | |
| path: build/release-candidate/ | |
| if-no-files-found: error | |
| retention-days: 30 |