ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main
      - master

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  quality:
    name: Quality and contracts
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up PHP
        uses: shivammathur/setup-php@db91e1a0e48e84637d325a7ee4d2677e146ceec4 # 2.36.0
        with:
          php-version: "8.2"
          coverage: none
          tools: composer:v2
      - name: Validate Composer metadata
        run: composer validate --strict
      - name: Install locked dependencies
        run: composer install --no-interaction --prefer-dist
      - name: Run quality and contract gates
        run: composer check
      - name: Test release workflow detection
        run: node --test tools/tests/release-detection.test.mjs

  compatibility:
    name: PHP ${{ matrix.php }} / ${{ matrix.dependencies }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        php: ["7.4", "8.0", "8.1", "8.2", "8.3", "8.4", "8.5"]
        dependencies: [lowest, latest]
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up PHP
        uses: shivammathur/setup-php@db91e1a0e48e84637d325a7ee4d2677e146ceec4 # 2.36.0
        with:
          php-version: ${{ matrix.php }}
          coverage: none
          tools: composer:v2
      - name: Resolve dependencies
        run: composer update --no-interaction --prefer-dist ${{ matrix.dependencies == 'lowest' && '--prefer-lowest' || '' }}
      - name: Run hermetic unit tests
        run: composer test:unit

  coverage:
    name: Coverage evidence
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up PHP with Xdebug
        uses: shivammathur/setup-php@db91e1a0e48e84637d325a7ee4d2677e146ceec4 # 2.36.0
        with:
          php-version: "8.2"
          # Keep branch-coverage semantics stable across runner image updates.
          extensions: xdebug-3.5.3
          coverage: xdebug
          tools: composer:v2
      - name: Verify pinned coverage driver
        run: php -r 'if (phpversion("xdebug") !== "3.5.3") { fwrite(STDERR, "Expected Xdebug 3.5.3\n"); exit(1); }'
      - name: Install locked dependencies
        run: composer install --no-interaction --prefer-dist
      - name: Generate fresh line and branch coverage
        run: composer test:coverage
        env:
          XDEBUG_MODE: coverage
      - name: Print coverage summary
        run: |
          cat build/coverage/summary.txt
          php tools/report-uncovered.php build/coverage/clover.xml
          php tools/report-uncovered-branches.php build/coverage/coverage.php
      - name: Enforce complete line and branch coverage
        run: php tools/check-coverage.php build/coverage/summary.txt 100
      - name: Upload fresh coverage evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-evidence
          path: |
            build/coverage/clover.xml
            build/coverage/cobertura.xml
            build/coverage/summary.txt
          if-no-files-found: error
          retention-days: 14

  mutation:
    name: Mutation baseline
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up PHP with Xdebug
        uses: shivammathur/setup-php@db91e1a0e48e84637d325a7ee4d2677e146ceec4 # 2.36.0
        with:
          php-version: "8.3"
          extensions: xdebug-3.5.3
          coverage: xdebug
          tools: composer:v2
      - name: Verify pinned coverage driver
        run: php -r 'if (phpversion("xdebug") !== "3.5.3") { fwrite(STDERR, "Expected Xdebug 3.5.3\n"); exit(1); }'
      - name: Install locked dependencies
        run: composer install --no-interaction --prefer-dist
      - name: Download and verify Infection 0.35.3
        run: |
          curl --fail --location --silent --show-error --output /tmp/infection.phar https://github.com/infection/infection/releases/download/0.35.3/infection.phar
          echo "f7109fe91555eba08657c789a55377a1d27809fdb50d553de5654b196eb221aa  /tmp/infection.phar" | sha256sum --check
      - name: Run full-source mutation baseline
        run: php /tmp/infection.phar --configuration=infection.json5.dist --no-progress
        env:
          XDEBUG_MODE: coverage
      - name: Print mutation summary
        if: always()
        run: cat build/mutation/summary.log
      - name: Upload mutation evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: mutation-evidence
          path: build/mutation/
          if-no-files-found: warn
          retention-days: 14

  consumers:
    name: ${{ matrix.fixture }} consumer
    needs: archive
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        fixture: [plain, laravel, symfony]
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up PHP
        uses: shivammathur/setup-php@db91e1a0e48e84637d325a7ee4d2677e146ceec4 # 2.36.0
        with:
          php-version: "8.2"
          coverage: none
          tools: composer:v2
      - name: Download inspected source archive
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: distribution-archive
          path: build/dist
      - name: Prepare archive-backed package repository
        run: |
          mkdir -p build/consumer-source
          tar -xzf build/dist/fleetbase-php-dev.tar.gz -C build/consumer-source
          php tools/configure-consumer-fixture.php "fixtures/consumer/${{ matrix.fixture }}" "build/consumer-source/fleetbase-php-dev"
      - name: Install consumer from inspected archive
        run: composer update --working-dir=fixtures/consumer/${{ matrix.fixture }} --no-interaction --prefer-dist
      - name: Verify framework integration
        run: composer verify --working-dir=fixtures/consumer/${{ matrix.fixture }}
      - name: Verify optimized production autoloading
        run: composer install --working-dir=fixtures/consumer/${{ matrix.fixture }} --no-interaction --no-dev --optimize-autoloader

  archive:
    name: Distribution archive
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up PHP
        uses: shivammathur/setup-php@db91e1a0e48e84637d325a7ee4d2677e146ceec4 # 2.36.0
        with:
          php-version: "8.2"
          coverage: none
      - name: Build deterministic source archive
        run: |
          mkdir -p build/dist
          git archive --format=tar.gz --prefix=fleetbase-php-dev/ --output=build/dist/fleetbase-php-dev.tar.gz HEAD
      - name: Inspect distribution contents
        run: php tools/check-release-archive.php build/dist/fleetbase-php-dev.tar.gz
      - name: Upload inspected source archive
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: distribution-archive
          path: build/dist/fleetbase-php-dev.tar.gz
          if-no-files-found: error
          retention-days: 14

  release-candidate:
    name: Release candidate dry run
    if: startsWith(github.head_ref || github.ref_name, 'release/')
    needs: [quality, compatibility, coverage, mutation, consumers, archive]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Check out complete source history
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Set up PHP and Composer
        uses: shivammathur/setup-php@db91e1a0e48e84637d325a7ee4d2677e146ceec4 # 2.36.0
        with:
          php-version: "8.2"
          coverage: none
          tools: composer:v2
      - name: Derive version from release branch
        shell: bash
        run: |
          branch="${GITHUB_HEAD_REF:-$GITHUB_REF_NAME}"
          version="${branch#release/}"
          version="${version#v}"
          echo "RELEASE_VERSION=$version" >> "$GITHUB_ENV"
      - name: Validate release identity and dependency security
        run: |
          php tools/check-release-version.php "$RELEASE_VERSION" --allow-non-main
          composer audit --locked --no-interaction
      - name: Download exact coverage evidence
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: coverage-evidence
          path: build/coverage
      - name: Build and inspect the release archive
        run: |
          mkdir -p build/release-candidate
          git archive --format=tar.gz --prefix="fleetbase-php-${RELEASE_VERSION}/" --output="build/release-candidate/fleetbase-php-${RELEASE_VERSION}.tar.gz" HEAD
          php tools/check-release-archive.php "build/release-candidate/fleetbase-php-${RELEASE_VERSION}.tar.gz"
      - name: Generate CycloneDX SBOM
        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
        with:
          path: .
          format: cyclonedx-json
          output-file: build/release-candidate/fleetbase-php-release.sbom.cdx.json
          upload-artifact: false
          dependency-snapshot: false
      - name: Collect release evidence and checksums
        run: |
          cp build/coverage/summary.txt build/release-candidate/coverage-summary.txt
          cp docs/api-coverage.md build/release-candidate/api-coverage.md
          cd build/release-candidate
          sha256sum fleetbase-php-* > SHA256SUMS
      - name: Upload complete release candidate
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: fleetbase-php-release-candidate
          path: build/release-candidate/
          if-no-files-found: error
          retention-days: 30