php-modernization-skill/skills/php-modernization/templates/github-actions/php-modernization.yml at main · netresearch/php-modernization-skill · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
# TEMPLATE: copy this file to your project's .github/workflows/ and adjust as
# needed. It is NOT yet published as a reusable workflow at
# netresearch/php-modernization-skill/.github/workflows/* — that lives in the
# typo3-ci-workflows meta-package or can be added there once stable.
#
# Consumers should pin third-party actions to a SHA in production. The major
# tags below (@v2, @v3, @v4, @v6) are convenient defaults but allow upstream
# changes through; replace with `<owner>/<repo>@<sha> # <tag>` for SLSA-grade
# supply-chain hygiene. The `# nosemgrep: github-actions-mutable-action-tag`
# markers on those lines record that
# the mutable default is intentional for this template so SAST does not flag
# it — drop the marker when you pin to a SHA.
#
# Local consumption:
#   cp skills/php-modernization/templates/github-actions/php-modernization.yml \
#     .github/workflows/php-modernization.yml
#   # then edit `php-version` to match your project's PHP requirement.
---
name: php-modernization

"on":
  workflow_call:
    inputs:
      php-version:
        description: PHP version for the verifier and orchestrator runs
        required: false
        default: "8.3"
        type: string
      enable-sarif:
        description: Emit SARIF and upload to GitHub code scanning
        required: false
        default: false
        type: boolean
      enable-infection-diff:
        description: Run Infection in PR diff-mode against the base ref
        required: false
        default: true
        type: boolean

permissions:
  contents: read
  pull-requests: write
  security-events: write

jobs:
  verify:
    name: Verify and orchestrate
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4  # nosemgrep: github-actions-mutable-action-tag
        with:
          # Infection diff-mode needs the base branch in history.
          fetch-depth: 0

      - name: Set up PHP
        uses: shivammathur/setup-php@v2  # nosemgrep: github-actions-mutable-action-tag
        with:
          php-version: ${{ inputs.php-version }}
          coverage: none
          tools: composer:v2

      - name: Install composer dependencies
        run: composer install --no-interaction --prefer-dist --no-progress

      - name: Install uv
        uses: astral-sh/setup-uv@v6  # nosemgrep: github-actions-mutable-action-tag
        with:
          enable-cache: true

      - name: Run verifier (JSON)
        id: verify-json
        run: |
          uv run skills/php-modernization/scripts/verify_php_project.py \
            --root . --format json | tee php-modernization-report.json

      - name: Run verifier (SARIF)
        if: ${{ inputs.enable-sarif }}
        run: |
          uv run skills/php-modernization/scripts/verify_php_project.py \
            --root . --format sarif | tee php-modernization.sarif

      - name: Upload SARIF to code scanning
        if: ${{ inputs.enable-sarif }}
        uses: github/codeql-action/upload-sarif@v3  # nosemgrep: github-actions-mutable-action-tag
        with:
          sarif_file: php-modernization.sarif
          category: php-modernization

      - name: Run orchestrator (dry-run)
        if: ${{ inputs.enable-infection-diff && github.event_name == 'pull_request' }}
        run: |
          uv run skills/php-modernization/scripts/modernize_loop.py \
            --mode dry-run \
            --git-diff-base=origin/${{ github.base_ref }} \
            | tee modernize-loop.json

      - name: Run orchestrator (dry-run, no infection)
        if: ${{ !inputs.enable-infection-diff || github.event_name != 'pull_request' }}
        run: |
          uv run skills/php-modernization/scripts/modernize_loop.py \
            --mode dry-run \
            --tools php-cs-fixer,rector,phpstan \
            | tee modernize-loop.json

      - name: Upload artifacts
        if: ${{ always() }}
        uses: actions/upload-artifact@v4  # nosemgrep: github-actions-mutable-action-tag
        with:
          name: php-modernization-${{ github.run_id }}
          path: |
            php-modernization-report.json
            php-modernization.sarif
            modernize-loop.json
            .build/php-modernization/
          if-no-files-found: ignore

      - name: PR summary comment
        if: ${{ github.event_name == 'pull_request' }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          uv run skills/php-modernization/scripts/verify_php_project.py \
            --root . --format json --summary --no-cache > php-modernization-summary.json

          status=$(python3 -c 'import json,sys; print(json.load(open("php-modernization-summary.json")).get("summary",{}).get("status","fail"))')
          if [ "$status" = "fail" ]; then
            {
              echo "### php-modernization verifier — failures detected"
              echo
              echo '```json'
              cat php-modernization-summary.json
              echo '```'
            } > php-modernization-comment.md
            gh pr comment "${{ github.event.pull_request.number }}" \
              --body-file php-modernization-comment.md
          fi