CI: replace pwn-request php-cs-fixer and repoint dead static-analysis reference - #55
Merged
Merged
Conversation
…t_target The inline workflow ran under pull_request_target with contents: write while checking out fork-controlled content, and php-cs-fixer executes the fork-controlled .php-cs-fixer.dist.php. Replace it with the push-only reusable caller already used on 2026.x. Refs pimcore/service-operations#1083. Same change as pimcore/tinymce-bundle#34 and pimcore/web2print-tools#121. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The previous caller referenced a reusable workflow retired in workflows-collection-public on 2025-12-09, so every run start-failed with zero jobs. Replace it with the unified pattern validated in pimcore/web2print-tools#121, with paths-ignore, push scoped to version branches, and a concurrency group with cancel-in-progress. Refs pimcore/DevOps-Tasks#47, pimcore/DevOps-Tasks#44. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Updates CI workflows to use safer, maintained reusable workflows.
Changes:
- Replaces unsafe fork-aware PHP-CS-Fixer execution with push-only automation.
- Migrates static analysis to the unified reusable workflow and dynamic matrix.
- Adds scheduling, path filtering, and concurrency controls.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
.github/workflows/static-analysis.yml |
Migrates PHPStan CI to the unified workflow. |
.github/workflows/php-cs-fixer.yaml |
Uses the push-only reusable formatter workflow. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
|
||
| static-analysis: | ||
| needs: setup-matrix | ||
| uses: pimcore/workflows-collection-public/.github/workflows/reusable-static-analysis-unified.yaml@main |
| APP_ENV: test | ||
| PIMCORE_TEST: 1 | ||
| REQUIRE_ADMIN_BUNDLE: "false" | ||
| COVERAGE: "none" |
berfinyuksel
added
the
Skip Milestone Check
Pimcore ^10/^11 releases are all blocked by Packagist security advisories under Composer 2.9 policy, so the unified workflow cannot install on this version line (verified in this PR's runs). The dead-reference repoint moves to the lowest 12-era branch instead; the state of this branch's static analysis is documented on pimcore/DevOps-Tasks#47. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security fix (pimcore/service-operations#1083): the inline php-cs-fixer workflow ran under
pull_request_targetwithcontents: writewhile checking out fork-controlled content — the classic pwn-request. Replaced with the push-only reusable caller this repo already uses on its default branch (byte-identical file swap). Pattern validated on pimcore/web2print-tools#121.Scope note: this PR originally also repointed the static-analysis workflow. That was reverted after verification: this version line cannot install any Pimcore ^10/^11 release under Composer 2.9's Packagist advisory policy, so the unified workflow cannot go green here. The dead-reference repoint landed on the lowest 12-era branch instead; this branch's static-analysis state is documented on pimcore/DevOps-Tasks#47.
Expected on this PR: php-cs-fixer does NOT run (push-only trigger). The old-style
Static Analysischecks pinned to retired ubuntu-20.04 runners queue forever and never conclude — pre-existing on this branch, not caused or required by this PR. Repoint for this repo: #56 (@3.0).