From 225c506e7e4b49b760e078f195b1581b4e2fa157 Mon Sep 17 00:00:00 2001 From: berfinyuksel <99557970+berfinyuksel@users.noreply.github.com> Date: Wed, 26 Aug 2026 13:29:59 +0200 Subject: [PATCH 1/3] Run PHP-CS-Fixer on push via reusable workflow instead of pull_request_target The inline workflow ran under pull_request_target with contents: write while checking out fork-controlled content, and php-cs-fixer executes the fork-controlled .php-cs-fixer.dist.php. Replace it with the push-only reusable caller already used on 2026.x. Refs pimcore/service-operations#1083. Same change as pimcore/tinymce-bundle#34 and pimcore/web2print-tools#121. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/php-cs-fixer.yaml | 44 +++++++++++------------------ 1 file changed, 16 insertions(+), 28 deletions(-) diff --git a/.github/workflows/php-cs-fixer.yaml b/.github/workflows/php-cs-fixer.yaml index 6d19d4f..2e0fbbf 100644 --- a/.github/workflows/php-cs-fixer.yaml +++ b/.github/workflows/php-cs-fixer.yaml @@ -1,35 +1,23 @@ name: "PHP-CS-Fixer" on: - pull_request_target: - branches: - - "[0-9]+.[0-9]+" - - "[0-9]+.x" - - "feature-*" - push: - branches: - - "[0-9]+.[0-9]+" - - "[0-9]+.x" - - "*_actions" - - "feature-*" + workflow_dispatch: + push: + branches: + - "[0-9]+.[0-9]+" + - "[0-9]+.x" + - "*_actions" + - "feature-*" permissions: - contents: read + contents: write jobs: - php-cs-fixer: - permissions: - contents: write # for stefanzweifel/git-auto-commit-action to push code in repo - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - with: - ref: ${{ github.event.pull_request.head.ref }} - repository: ${{ github.event.pull_request.head.repo.full_name }} - - - name: PHP-CS-Fixer - uses: docker://oskarstark/php-cs-fixer-ga:latest - - - uses: stefanzweifel/git-auto-commit-action@v5 - with: - commit_message: Apply php-cs-fixer changes + php-style: + uses: pimcore/workflows-collection-public/.github/workflows/reusable-php-cs-fixer.yaml@main + with: + head_ref: ${{ github.head_ref || github.ref_name }} + repository: ${{ github.repository }} + config_file: ".php-cs-fixer.dist.php" + secrets: + PHP_CS_FIXER_GITHUB_TOKEN: ${{ secrets.PHP_CS_FIXER_GITHUB_TOKEN }} From 70527a52f1e68bf822737e6355e0839a58eec322 Mon Sep 17 00:00:00 2001 From: berfinyuksel <99557970+berfinyuksel@users.noreply.github.com> Date: Wed, 26 Aug 2026 13:29:59 +0200 Subject: [PATCH 2/3] Repoint static analysis to reusable-static-analysis-unified The previous caller referenced a reusable workflow retired in workflows-collection-public on 2025-12-09, so every run start-failed with zero jobs. Replace it with the unified pattern validated in pimcore/web2print-tools#121, with paths-ignore, push scoped to version branches, and a concurrency group with cancel-in-progress. Refs pimcore/DevOps-Tasks#47, pimcore/DevOps-Tasks#44. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/static-analysis.yml | 130 ++++++++++++++++---------- 1 file changed, 80 insertions(+), 50 deletions(-) diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml index c6a627d..3d38ad4 100644 --- a/.github/workflows/static-analysis.yml +++ b/.github/workflows/static-analysis.yml @@ -1,54 +1,84 @@ -name: "Static Analysis" +name: "Static analysis centralised" on: - pull_request: - branches: - - "[0-9]+.[0-9]+" - - "[0-9]+.x" - push: - branches: - - "[0-9]+.[0-9]+" - - "[0-9]+.x" + schedule: + - cron: '0 3 * * 1,3,5' + workflow_dispatch: + pull_request: + types: [ opened, synchronize, reopened ] + paths-ignore: + - 'doc/**' + - '**.md' + push: + paths-ignore: + - 'doc/**' + - '**.md' + branches: + - "[0-9]+.[0-9]+" + - "[0-9]+.x" + +env: + PIMCORE_PROJECT_ROOT: ${{ github.workspace }} + PRIVATE_REPO: ${{ github.event.repository.private }} + +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }} + cancel-in-progress: true jobs: - static-analysis-phpstan: - name: "Static Analysis with PHPStan" - runs-on: "ubuntu-20.04" - strategy: - matrix: - include: - - { php-version: "8.0", database: "mariadb:10.7", dependencies: "lowest", pimcore_version: "", phpstan_args: "", experimental: false } - - { php-version: "8.1", database: "mariadb:10.7", dependencies: "highest", pimcore_version: "", phpstan_args: "", experimental: false } - - { php-version: "8.1", database: "mariadb:10.7", dependencies: "highest", pimcore_version: "11.x-dev", phpstan_args: "", experimental: true } - steps: - - name: "Checkout code" - uses: "actions/checkout@v2" - - - name: "Install PHP" - uses: "shivammathur/setup-php@v2" - with: - coverage: "none" - php-version: "${{ matrix.php-version }}" - - - name: "Setup Pimcore environment" - run: | - .github/ci/scripts/setup-pimcore-environment.sh - - name: "Update Pimcore version" - env: - PIMCORE_VERSION: "${{ matrix.pimcore_version }}" - run: | - if [ ! -z "$PIMCORE_VERSION" ]; then - composer require --no-update pimcore/pimcore:"${PIMCORE_VERSION} as 11.99.9" - fi - - name: "Install dependencies with Composer" - uses: "ramsey/composer-install@v2" - with: - dependency-versions: "${{ matrix.dependencies }}" - - - name: "Run a static analysis with phpstan/phpstan (highest)" - if: ${{ matrix.dependencies == 'highest' }} - run: "vendor/bin/phpstan analyse --memory-limit=-1" - - - name: "Run a static analysis with phpstan/phpstan (lowest)" - if: ${{ matrix.dependencies == 'lowest' }} - run: "vendor/bin/phpstan analyse --memory-limit=-1 -c phpstan-lowest.neon" \ No newline at end of file + setup-matrix: + runs-on: ubuntu-latest + outputs: + php_versions: ${{ steps.parse-php-versions.outputs.php_versions }} + phpstan_matrix: ${{ steps.set-matrix.outputs.phpstan_matrix }} + private_repo: ${{ env.PRIVATE_REPO }} + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Checkout reusable workflow repo + uses: actions/checkout@v4 + with: + repository: pimcore/workflows-collection-public + ref: main + path: reusable-workflows + + - name: Parse PHP versions from composer.json + id: parse-php-versions + run: | + if [ -f composer.json ]; then + php_versions=$(jq -r '.require.php' composer.json | grep -oP '\d+\.\d+' | tr '\n' ',' | sed 's/,$//') + if [ -z "$php_versions" ]; then + echo "php_versions=default" >> "$GITHUB_OUTPUT" + else + echo "php_versions=$php_versions" >> "$GITHUB_OUTPUT" + fi + else + exit 1 + fi + + - name: Set up matrix JSON + id: set-matrix + run: | + php_versions="${{ steps.parse-php-versions.outputs.php_versions }}" + MATRIX_JSON=$(cat reusable-workflows/phpstan-configuration/matrix-config.json) + FILTERED_MATRIX_JSON=$(echo "$MATRIX_JSON" | jq --arg php_versions "$php_versions" '{ include: [ .configs[] | select(.php_version == $php_versions) | .matrix[] ] }') + ENCODED_MATRIX_JSON=$(echo "$FILTERED_MATRIX_JSON" | jq -c .) + echo "phpstan_matrix=$ENCODED_MATRIX_JSON" >> "$GITHUB_OUTPUT" + + static-analysis: + needs: setup-matrix + uses: pimcore/workflows-collection-public/.github/workflows/reusable-static-analysis-unified.yaml@main + with: + phpstan_matrix: ${{ needs.setup-matrix.outputs.phpstan_matrix }} + private_repo: ${{ needs.setup-matrix.outputs.private_repo }} + APP_ENV: test + PIMCORE_TEST: 1 + REQUIRE_ADMIN_BUNDLE: "false" + COVERAGE: "none" + secrets: + SSH_PRIVATE_KEY_PIMCORE_DEPLOYMENTS_USER: ${{ secrets.SSH_PRIVATE_KEY_PIMCORE_DEPLOYMENTS_USER }} + COMPOSER_PIMCORE_REPO_PACKAGIST_TOKEN: ${{ secrets.COMPOSER_PIMCORE_REPO_PACKAGIST_TOKEN }} + PIMCORE_CI_INSTANCE_IDENTIFIER: ${{ secrets.PIMCORE_CI_INSTANCE_IDENTIFIER }} + PIMCORE_CI_ENCRYPTION_SECRET: ${{ secrets.PIMCORE_CI_ENCRYPTION_SECRET }} + PIMCORE_CI_PRODUCT_KEY: ${{ secrets.PIMCORE_CI_PRODUCT_KEY }} From 62e5ee684002519fe380e67fc848bba37f1077cb Mon Sep 17 00:00:00 2001 From: berfinyuksel <99557970+berfinyuksel@users.noreply.github.com> Date: Wed, 26 Aug 2026 14:09:21 +0200 Subject: [PATCH 3/3] Revert static-analysis convergence on this branch Pimcore ^10/^11 releases are all blocked by Packagist security advisories under Composer 2.9 policy, so the unified workflow cannot install on this version line (verified in this PR's runs). The dead-reference repoint moves to the lowest 12-era branch instead; the state of this branch's static analysis is documented on pimcore/DevOps-Tasks#47. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/static-analysis.yml | 130 ++++++++++---------------- 1 file changed, 50 insertions(+), 80 deletions(-) diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml index 3d38ad4..c6a627d 100644 --- a/.github/workflows/static-analysis.yml +++ b/.github/workflows/static-analysis.yml @@ -1,84 +1,54 @@ -name: "Static analysis centralised" +name: "Static Analysis" on: - schedule: - - cron: '0 3 * * 1,3,5' - workflow_dispatch: - pull_request: - types: [ opened, synchronize, reopened ] - paths-ignore: - - 'doc/**' - - '**.md' - push: - paths-ignore: - - 'doc/**' - - '**.md' - branches: - - "[0-9]+.[0-9]+" - - "[0-9]+.x" - -env: - PIMCORE_PROJECT_ROOT: ${{ github.workspace }} - PRIVATE_REPO: ${{ github.event.repository.private }} - -concurrency: - group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }} - cancel-in-progress: true + pull_request: + branches: + - "[0-9]+.[0-9]+" + - "[0-9]+.x" + push: + branches: + - "[0-9]+.[0-9]+" + - "[0-9]+.x" jobs: - setup-matrix: - runs-on: ubuntu-latest - outputs: - php_versions: ${{ steps.parse-php-versions.outputs.php_versions }} - phpstan_matrix: ${{ steps.set-matrix.outputs.phpstan_matrix }} - private_repo: ${{ env.PRIVATE_REPO }} - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Checkout reusable workflow repo - uses: actions/checkout@v4 - with: - repository: pimcore/workflows-collection-public - ref: main - path: reusable-workflows - - - name: Parse PHP versions from composer.json - id: parse-php-versions - run: | - if [ -f composer.json ]; then - php_versions=$(jq -r '.require.php' composer.json | grep -oP '\d+\.\d+' | tr '\n' ',' | sed 's/,$//') - if [ -z "$php_versions" ]; then - echo "php_versions=default" >> "$GITHUB_OUTPUT" - else - echo "php_versions=$php_versions" >> "$GITHUB_OUTPUT" - fi - else - exit 1 - fi - - - name: Set up matrix JSON - id: set-matrix - run: | - php_versions="${{ steps.parse-php-versions.outputs.php_versions }}" - MATRIX_JSON=$(cat reusable-workflows/phpstan-configuration/matrix-config.json) - FILTERED_MATRIX_JSON=$(echo "$MATRIX_JSON" | jq --arg php_versions "$php_versions" '{ include: [ .configs[] | select(.php_version == $php_versions) | .matrix[] ] }') - ENCODED_MATRIX_JSON=$(echo "$FILTERED_MATRIX_JSON" | jq -c .) - echo "phpstan_matrix=$ENCODED_MATRIX_JSON" >> "$GITHUB_OUTPUT" - - static-analysis: - needs: setup-matrix - uses: pimcore/workflows-collection-public/.github/workflows/reusable-static-analysis-unified.yaml@main - with: - phpstan_matrix: ${{ needs.setup-matrix.outputs.phpstan_matrix }} - private_repo: ${{ needs.setup-matrix.outputs.private_repo }} - APP_ENV: test - PIMCORE_TEST: 1 - REQUIRE_ADMIN_BUNDLE: "false" - COVERAGE: "none" - secrets: - SSH_PRIVATE_KEY_PIMCORE_DEPLOYMENTS_USER: ${{ secrets.SSH_PRIVATE_KEY_PIMCORE_DEPLOYMENTS_USER }} - COMPOSER_PIMCORE_REPO_PACKAGIST_TOKEN: ${{ secrets.COMPOSER_PIMCORE_REPO_PACKAGIST_TOKEN }} - PIMCORE_CI_INSTANCE_IDENTIFIER: ${{ secrets.PIMCORE_CI_INSTANCE_IDENTIFIER }} - PIMCORE_CI_ENCRYPTION_SECRET: ${{ secrets.PIMCORE_CI_ENCRYPTION_SECRET }} - PIMCORE_CI_PRODUCT_KEY: ${{ secrets.PIMCORE_CI_PRODUCT_KEY }} + static-analysis-phpstan: + name: "Static Analysis with PHPStan" + runs-on: "ubuntu-20.04" + strategy: + matrix: + include: + - { php-version: "8.0", database: "mariadb:10.7", dependencies: "lowest", pimcore_version: "", phpstan_args: "", experimental: false } + - { php-version: "8.1", database: "mariadb:10.7", dependencies: "highest", pimcore_version: "", phpstan_args: "", experimental: false } + - { php-version: "8.1", database: "mariadb:10.7", dependencies: "highest", pimcore_version: "11.x-dev", phpstan_args: "", experimental: true } + steps: + - name: "Checkout code" + uses: "actions/checkout@v2" + + - name: "Install PHP" + uses: "shivammathur/setup-php@v2" + with: + coverage: "none" + php-version: "${{ matrix.php-version }}" + + - name: "Setup Pimcore environment" + run: | + .github/ci/scripts/setup-pimcore-environment.sh + - name: "Update Pimcore version" + env: + PIMCORE_VERSION: "${{ matrix.pimcore_version }}" + run: | + if [ ! -z "$PIMCORE_VERSION" ]; then + composer require --no-update pimcore/pimcore:"${PIMCORE_VERSION} as 11.99.9" + fi + - name: "Install dependencies with Composer" + uses: "ramsey/composer-install@v2" + with: + dependency-versions: "${{ matrix.dependencies }}" + + - name: "Run a static analysis with phpstan/phpstan (highest)" + if: ${{ matrix.dependencies == 'highest' }} + run: "vendor/bin/phpstan analyse --memory-limit=-1" + + - name: "Run a static analysis with phpstan/phpstan (lowest)" + if: ${{ matrix.dependencies == 'lowest' }} + run: "vendor/bin/phpstan analyse --memory-limit=-1 -c phpstan-lowest.neon" \ No newline at end of file