ci.yml

name: CI

on:
  push:
    branches:
      - '3.*.x'
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  PHP_EXTENSIONS: ctype, dom, fileinfo, filter, iconv, intl, json, mbstring, openssl, pdo, pdo_sqlite, readline, simplexml, tokenizer, xml, xmlreader, zip

jobs:
  analyze:
    name: Static analysis (PHP ${{ matrix.php }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        php: ['8.3', '8.4', '8.5']
    steps:
      - uses: actions/checkout@v7

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php }}
          extensions: ${{ env.PHP_EXTENSIONS }}
          coverage: none
          tools: composer:v2

      - name: Get composer cache directory
        id: composer-cache
        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"

      - name: Cache composer downloads
        uses: actions/cache@v6
        with:
          path: ${{ steps.composer-cache.outputs.dir }}
          key: composer-${{ runner.os }}-php${{ matrix.php }}-analyze-${{ hashFiles('composer.json') }}
          restore-keys: composer-${{ runner.os }}-php${{ matrix.php }}-analyze-

      # Only the root dependencies (PHPStan) are installed here:
      # core/vendor is committed and provides everything phpstan.neon bootstraps.
      - name: Install root dependencies
        run: composer install --no-interaction --no-progress --prefer-dist

      - name: Run PHPStan
        run: composer analyze

  tests:
    name: Unit tests (PHP ${{ matrix.php }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        php: ['8.3', '8.4', '8.5']
    steps:
      - uses: actions/checkout@v7

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php }}
          extensions: ${{ env.PHP_EXTENSIONS }}
          coverage: none
          tools: composer:v2

      - name: Get composer cache directory
        id: composer-cache
        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"

      - name: Cache composer downloads
        uses: actions/cache@v6
        with:
          path: ${{ steps.composer-cache.outputs.dir }}
          key: composer-${{ runner.os }}-php${{ matrix.php }}-core-${{ hashFiles('core/composer.lock') }}
          restore-keys: composer-${{ runner.os }}-php${{ matrix.php }}-core-

      - name: Install core dependencies
        working-directory: core
        run: composer install --no-interaction --no-progress --prefer-dist

      - name: Run Pest
        working-directory: core
        run: composer test -- --compact

  php86-rc:
    name: PHP 8.6 RC compatibility (Docker)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      # The official 8.6-rc alias follows the latest PHP 8.6 release candidate.
      # Report prerelease failures as warnings so this compatibility signal never
      # marks the workflow build as failed.
      - name: Build and test the PHP 8.6 RC image
        env:
          IMAGE: evo-ci-php:8.6-rc
        run: |
          if docker build --build-arg PHP_VERSION=8.6-rc -f .github/docker/ci/Dockerfile -t "$IMAGE" .; then
            build_result=passed
          else
            build_result=failed
          fi

          version_result=skipped
          test_result=skipped
          if [ "$build_result" = passed ]; then
            if docker run --rm --entrypoint php "$IMAGE" -r 'if (PHP_VERSION_ID < 80600 || PHP_VERSION_ID >= 80700 || !str_contains(PHP_VERSION, "RC")) { fwrite(STDERR, PHP_VERSION . PHP_EOL); exit(1); } echo PHP_VERSION, PHP_EOL;'; then
              version_result=passed
            else
              version_result=failed
            fi

            # Locked dev tools still declare an upper PHP bound of 8.5; ignore
            # only that metadata to exercise them on this prerelease runtime.
            if docker run --rm --entrypoint sh "$IMAGE" -c 'cd core && php vendor/bin/composer install --no-interaction --no-progress --prefer-dist --ignore-platform-req=php && php vendor/bin/pest --compact'; then
              test_result=passed
            else
              test_result=failed
            fi
          fi

          {
            echo '### PHP 8.6 RC compatibility'
            echo "- Docker image build: **${build_result}**"
            echo "- PHP RC version check: **${version_result}**"
            echo "- Pest: **${test_result}**"
          } >> "$GITHUB_STEP_SUMMARY"

          if [ "$build_result" != passed ] || [ "$version_result" = failed ] || [ "$test_result" = failed ]; then
            echo "::warning title=PHP 8.6 RC compatibility::Image build=${build_result}, version check=${version_result}, Pest=${test_result}"
          fi
          exit 0

  install:
    name: Install on ${{ matrix.db }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        # Every database the CLI installer supports. The build workflow also
        # installs on sqlite to produce the nightly zip, but it stops at an HTTP
        # check - the seeded data and the updater are only asserted here.
        # One PHP version only: what this job proves is the installer's database
        # paths, and those do not vary with the PHP minor. The matrix above
        # already runs the analysis and the tests on every supported version.
        include:
          - db: mysql
            user: root
            password: secret
          - db: pgsql
            user: evo
            password: secret
          # A file, so there is no server, no user and no password.
          - db: sqlite
    env:
      COMPOSE: .github/docker/ci/docker-compose.yml
    steps:
      - uses: actions/checkout@v7

      # Only the database server runs in a container, straight from its official
      # image - nothing is built here. The installer itself runs on the runner's
      # own PHP, which already carries the PDO drivers; building a PHP image for
      # it would cost minutes per leg to reproduce what setup-php hands over
      # prebuilt. .github/docker/ci/ still describes the full containerised run
      # for local use.
      - name: Start ${{ matrix.db }}
        if: matrix.db != 'sqlite'
        run: docker compose -f "$COMPOSE" --profile ${{ matrix.db }} up -d --wait ${{ matrix.db }}

      # error_log to stderr for the same reason the CI image sets it: the
      # installer runs the migrations inside an output buffer it later discards,
      # so a warning raised during one only reaches the log the script greps if
      # PHP also writes it outside that buffer.
      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
          extensions: ${{ env.PHP_EXTENSIONS }}, pdo_mysql, pdo_pgsql, sqlite3
          ini-values: error_reporting=E_ALL, display_errors=On, display_startup_errors=On, log_errors=On, error_log=/dev/stderr
          coverage: none
          tools: composer:v2

      # core/vendor is committed, so there is no composer step: the script calls
      # the installer with --skipComposer=y. See .github/docker/ci/ for what the
      # run asserts - it fails on any PHP diagnostic, on missing or wrong seeded
      # data, and on a site that does not answer.
      - name: Install and smoke test
        env:
          EVO_APP_DIR: ${{ github.workspace }}
          EVO_DB_TYPE: ${{ matrix.db }}
          EVO_DB_HOST: 127.0.0.1
          EVO_DB_USER: ${{ matrix.user }}
          EVO_DB_PASSWORD: ${{ matrix.password }}
          EVO_DB_NAME: evolution
          EVO_DB_PREFIX: evo_
        run: .github/docker/ci/install-and-smoke.sh

      - name: Database server log
        if: failure() && matrix.db != 'sqlite'
        run: docker compose -f "$COMPOSE" --profile ${{ matrix.db }} logs ${{ matrix.db }}

      - name: Tear down
        if: always() && matrix.db != 'sqlite'
        run: docker compose -f "$COMPOSE" --profile ${{ matrix.db }} down -v

  audit:
    name: Dependency audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          # The audit reads composer.lock and the advisory database; it does not run the code,
          # so one version is enough. Kept at the lowest supported one for consistency.
          php-version: '8.3'
          extensions: ${{ env.PHP_EXTENSIONS }}
          coverage: none
          tools: composer:v2

      # --locked audits the lock file directly: no vendor tree has to be installed, and what is
      # audited is exactly what a site gets. core/ is where the shipped dependencies live.
      - name: Audit shipped dependencies
        working-directory: core
        run: composer audit --locked --no-dev

      # Dev-only tooling (Pest and friends) never reaches a live site, so an advisory there is
      # worth seeing but must not block a release. The root composer.json holds PHPStan alone and
      # ships no lock file, so there is nothing to audit there.
      - name: Audit development dependencies
        continue-on-error: true
        working-directory: core
        run: composer audit --locked