tests.yml

name: Tests

on:
  push:
    branches: [3.x]
  pull_request:
    branches: [3.x]
  workflow_call:

permissions:
  contents: read

jobs:
  actions-pinned:
    name: Actions pinned to SHA
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Assert every third-party action is pinned to a full commit SHA
        run: |
          unpinned=$(grep -rhoE '^[[:space:]]*-?[[:space:]]*uses:[[:space:]]*[^[:space:]]+' .github/workflows \
            | sed -E 's/.*uses:[[:space:]]*//' \
            | grep -v '^\./' \
            | grep -vE '@[0-9a-f]{40}$' \
            | sort -u || true)

          if [ -n "$unpinned" ]; then
            echo "Third-party actions must be pinned to a full 40-character commit SHA."
            echo "Unpinned references:"
            echo "$unpinned" | sed 's/^/  /'
            exit 1
          fi

          echo "All third-party action references are pinned to a full commit SHA."

  tests:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: true
      matrix:
        php: [8.4]
        laravel: [12.*, 13.*]
        stability: [prefer-stable]
        include:
          - laravel: 12.*
            testbench: 10.*
          - laravel: 13.*
            testbench: 11.*

    name: P${{ matrix.php }} - L${{ matrix.laravel }} - ${{ matrix.stability }}

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup PHP
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
        with:
          php-version: ${{ matrix.php }}
          extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick, fileinfo
          coverage: none

      - name: Install dependencies
        run: |
          composer require "laravel/framework:${{ matrix.laravel }}" "orchestra/testbench:${{ matrix.testbench }}" --no-interaction --no-update
          composer update --${{ matrix.stability }} --prefer-dist --no-interaction

      - name: Run Pint
        run: vendor/bin/pint --test

      - name: Run PHPStan
        run: vendor/bin/phpstan analyse --no-progress

      - name: Run Rector
        run: vendor/bin/rector --dry-run --no-progress-bar

      - name: Run Pest
        run: vendor/bin/pest --ci

  gate:
    name: Tests passed
    runs-on: ubuntu-latest
    needs: [actions-pinned, tests]
    if: always()

    steps:
      - name: Fail unless every job succeeded
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')
        run: exit 1