Skip to content

Commit 5faadb6

Browse files
adelinnadelinn
authored
Merge pull request #213 from bcc-code/test/psalm-analysis
Add PHPStan as linter before pushing new version and switching to Psalm fore Vulnerability analysis
2 parents 19d8715 + cc39dbf commit 5faadb6

File tree

9 files changed

+202
-38
lines changed

9 files changed

+202
-38
lines changed

‎.github/workflows/bcc-keep-translated-posts-status-same-as-original-plugin-release.yml‎

Lines changed: 44 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,57 @@ on:
2525

2626
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
2727
jobs:
28-
# This workflow contains a single job called "build"
28+
lint:
29+
name: Lint PHP - validate code
30+
runs-on: ubuntu-latest
31+
permissions:
32+
contents: read
33+
34+
defaults:
35+
run:
36+
shell: bash
37+
working-directory: ./plugins/bcc-keep-translated-posts-status-same-as-original
38+
39+
steps:
40+
- uses: actions/checkout@v6
41+
42+
# This config file gets auto-loaded by PHPStan
43+
- name: Set PHPStan config
44+
run: |
45+
cat <<'EOF' > phpstan.neon
46+
parameters:
47+
level: 1 # form 0 to 11 where 0 is the loosest and 11 the strictest
48+
errorFormat: github
49+
paths:
50+
- .
51+
excludePaths:
52+
- vendor
53+
scanFiles:
54+
- dependencies.stub
55+
# One can ignore errors like this
56+
# ignoreErrors:
57+
# - '#Path in require\(\) "build/.+\.asset\.php" is not a file or it does not exist\.#'
58+
includes:
59+
- vendor/szepeviktor/phpstan-wordpress/extension.neon
60+
EOF
61+
62+
- name: Install PHPStan and Wordpress-stub
63+
run: |
64+
composer require --dev phpstan/phpstan
65+
composer require --dev szepeviktor/phpstan-wordpress
66+
67+
- name: Run PHPStan
68+
run: vendor/bin/phpstan analyse --no-progress
69+
2970
build:
71+
needs: lint
3072
# The type of runner that the job will run on
3173
runs-on: ubuntu-latest
3274

3375
# Steps represent a sequence of tasks that will be executed as part of the job
3476
steps:
3577
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
36-
- uses: actions/checkout@v2
78+
- uses: actions/checkout@v6
3779

3880
- name: Get Package Version
3981
id: version

‎.github/workflows/bcc-login-plugin-release.yml‎

Lines changed: 45 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,58 @@ on:
2525

2626
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
2727
jobs:
28-
# This workflow contains a single job called "build"
28+
lint:
29+
name: Lint PHP - validate code
30+
runs-on: ubuntu-latest
31+
permissions:
32+
contents: read
33+
34+
defaults:
35+
run:
36+
shell: bash
37+
working-directory: ./plugins/bcc-login
38+
39+
steps:
40+
- uses: actions/checkout@v6
41+
42+
# This config file gets auto-loaded by PHPStan
43+
- name: Set PHPStan config
44+
run: |
45+
cat <<'EOF' > phpstan.neon
46+
parameters:
47+
level: 1 # form 0 to 11 where 0 is the loosest and 11 the strictest
48+
errorFormat: github
49+
paths:
50+
- .
51+
excludePaths:
52+
- vendor
53+
scanFiles:
54+
- dependencies.stub
55+
bootstrapFiles:
56+
- bcc-login.php
57+
ignoreErrors:
58+
- '#Path in require\(\) "build/.+\.asset\.php" is not a file or it does not exist\.#'
59+
includes:
60+
- vendor/szepeviktor/phpstan-wordpress/extension.neon
61+
EOF
62+
63+
- name: Install PHPStan and Wordpress-stub
64+
run: |
65+
composer require --dev phpstan/phpstan
66+
composer require --dev szepeviktor/phpstan-wordpress
67+
68+
- name: Run PHPStan
69+
run: vendor/bin/phpstan analyse --no-progress
70+
2971
build:
72+
needs: lint
3073
# The type of runner that the job will run on
3174
runs-on: ubuntu-latest
3275

3376
# Steps represent a sequence of tasks that will be executed as part of the job
3477
steps:
3578
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
36-
- uses: actions/checkout@v2
79+
- uses: actions/checkout@v6
3780

3881
- name: Get Package Version
3982
id: version

‎.github/workflows/bcc-post-update-translations-notifier-plugin-release.yml‎

Lines changed: 44 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,57 @@ on:
2525

2626
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
2727
jobs:
28-
# This workflow contains a single job called "build"
28+
lint:
29+
name: Lint PHP - validate code
30+
runs-on: ubuntu-latest
31+
permissions:
32+
contents: read
33+
34+
defaults:
35+
run:
36+
shell: bash
37+
working-directory: ./plugins/bcc-post-update-translations-notifier
38+
39+
steps:
40+
- uses: actions/checkout@v6
41+
42+
# This config file gets auto-loaded by PHPStan
43+
- name: Set PHPStan config
44+
run: |
45+
cat <<'EOF' > phpstan.neon
46+
parameters:
47+
level: 1 # form 0 to 11 where 0 is the loosest and 11 the strictest
48+
errorFormat: github
49+
paths:
50+
- .
51+
excludePaths:
52+
- vendor
53+
scanFiles:
54+
- dependencies.stub
55+
# One can ignore errors like this
56+
# ignoreErrors:
57+
# - '#Path in require\(\) "build/.+\.asset\.php" is not a file or it does not exist\.#'
58+
includes:
59+
- vendor/szepeviktor/phpstan-wordpress/extension.neon
60+
EOF
61+
62+
- name: Install PHPStan and Wordpress-stub
63+
run: |
64+
composer require --dev phpstan/phpstan
65+
composer require --dev szepeviktor/phpstan-wordpress
66+
67+
- name: Run PHPStan
68+
run: vendor/bin/phpstan analyse --no-progress
69+
2970
build:
71+
needs: lint
3072
# The type of runner that the job will run on
3173
runs-on: ubuntu-latest
3274

3375
# Steps represent a sequence of tasks that will be executed as part of the job
3476
steps:
3577
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
36-
- uses: actions/checkout@v2
78+
- uses: actions/checkout@v6
3779

3880
- name: Get Package Version
3981
id: version

‎.github/workflows/php-sast.yml‎

Lines changed: 40 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ on:
1313

1414
permissions:
1515
contents: read
16+
security-events: write # Required to upload SARIF files
1617

1718
jobs:
1819
scan:
@@ -21,33 +22,36 @@ jobs:
2122
steps:
2223
- uses: actions/checkout@v6
2324

24-
# - name: Validate composer.json and composer.lock
25-
# run: composer validate --strict
26-
27-
# This config file gets auto-loaded by PHPStan
25+
# This config file gets auto-loaded by Psalm
2826
# !!!! The old bcc-signon plugin and the bcc-wp-proxy plugin are excluded from analysis!
29-
- name: Set PHPStan config
27+
- name: Set Psalm config
3028
run: |
31-
cat <<'EOF' > phpstan.neon
32-
parameters:
33-
level: 1 # form 0 to 11 where 0 is the loosest and 11 the strictest
34-
errorFormat: github
35-
paths:
36-
- plugins
37-
scanFiles:
38-
- custom-defs.stub
39-
bootstrapFiles:
40-
- plugins/bcc-login/bcc-login.php
41-
ignoreErrors:
42-
- '#Path in require\(\) "build/.+\.asset\.php" is not a file or it does not exist\.#'
43-
excludePaths:
44-
- plugins/bcc-signon/*
45-
- plugins/bcc-wp-proxy/*
46-
includes:
47-
- vendor/szepeviktor/phpstan-wordpress/extension.neon
29+
cat <<'EOF' > psalm.xml
30+
<?xml version="1.0"?>
31+
<!-- Psalm has levels of strictness (errorLevel) from 1 (most strict) to 8 (most lenient). -->
32+
<psalm
33+
xmlns="https://getpsalm.org/schema/config"
34+
errorLevel="2"
35+
>
36+
<projectFiles>
37+
<directory name="plugins" />
38+
<ignoreFiles>
39+
<directory name="plugins/bcc-signon" />
40+
<directory name="plugins/bcc-wp-proxy" />
41+
</ignoreFiles>
42+
</projectFiles>
43+
<stubs>
44+
<file name="custom-defs.stub" />
45+
</stubs>
46+
<plugins>
47+
<pluginClass class="PsalmWordPress\Plugin">
48+
<requireAllParams value="true" />
49+
</pluginClass>
50+
</plugins>
51+
</psalm>
4852
EOF
4953
50-
- name: Create custom stubs for plugin functions. If this grows too big it can be commited as a separate file
54+
- name: Create stubs for dependency functions (e.g. other plugin funcions). If this grows too big it can be commited as a separate file
5155
run: |
5256
cat <<'EOF' > custom-defs.stub
5357
<?php
@@ -69,11 +73,19 @@ jobs:
6973
function get_culture() {};
7074
EOF
7175
72-
- name: Install PHPStan and Wordpress-stub
76+
- name: Install Psalm and Wordpress stubs
7377
run: |
74-
composer require --dev phpstan/phpstan
75-
composer require --dev szepeviktor/phpstan-wordpress
78+
composer require --dev php-stubs/wordpress-stubs ~6.8.0
79+
composer require --dev humanmade/psalm-plugin-wordpress
7680
77-
- name: Run PHPStan
78-
run: vendor/bin/phpstan analyse --no-progress
81+
- name: Run Psalm
82+
uses: psalm/psalm-github-actions@26f175f4d1d9006ea675bb78831ae94126017b07
83+
with:
84+
security_analysis: true
85+
composer_require_dev: true
86+
report_file: results.sarif
7987

88+
- name: Upload Security Analysis results to GitHub
89+
uses: github/codeql-action/upload-sarif@v4
90+
with:
91+
sarif_file: results.sarif

‎plugins/bcc-keep-translated-posts-status-same-as-original/dependencies.stub‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<?php
2+
3+
// No plugin/theme dependencies so no stubs needed

‎plugins/bcc-login/bcc-login.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,15 @@
33
/**
44
* Plugin Name: BCC Login
55
* Description: Integration to BCC's Login System.
6-
* Version: 1.1.431
6+
* Version: 1.1.433
77
* Author: BCC IT
88
* License: GPL2
99
*/
1010

11+
if ( ! defined( 'ABSPATH' ) ) {
12+
exit; // Exit if accessed directly.
13+
}
14+
1115
define( 'BCC_LOGIN_PATH', plugin_dir_path( __FILE__ ) );
1216
define( 'BCC_LOGIN_URL', plugin_dir_url( __FILE__ ) );
1317

@@ -30,7 +34,7 @@ class BCC_Login {
3034
* The plugin instance.
3135
*/
3236
private static $instance = null;
33-
private $plugin_version = "1.1.431";
37+
private $plugin_version = "1.1.433";
3438
private $plugin;
3539
private $plugin_slug;
3640
private $plugin_name = "BCC Login";

‎plugins/bcc-login/dependencies.stub‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?php
2+
3+
/**
4+
* @return string
5+
*/
6+
function get_culture() {};

‎plugins/bcc-login/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
{
22
"private": true,
33
"name": "bcc-login",
4-
"version": "1.1.431",
4+
"version": "1.1.433",
55
"slug": "bcc-login",
66
"author": "<a href='https://github.com/bcc-code'>BCC Code</a>",
77
"author_profile": "https://github.com/bcc-code",
88
"requires": "3.0",
99
"tested": "5.8",
1010
"requires_php": "5.3",
11-
"last_updated": "2026-01-15 11:18:18",
11+
"last_updated": "2026-01-16 18:44:44",
1212
"sections": {
1313
"description": "BCC Login",
1414
"installation": "Add OIDC_CLIENT_ID and OIDC_CLIENT_SECRET as environment variables or constants in wp-config.php, and active plugin",

‎plugins/bcc-post-update-translations-notifier/dependencies.stub‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<?php
2+
3+
/**
4+
* @param mixed $post_id
5+
* @return mixed|null
6+
*/
7+
function get_field(
8+
string $selector,
9+
$post_id = false,
10+
bool $format_value = true,
11+
bool $escape_html = false
12+
) {};

0 commit comments

Comments
 (0)