feat: add dependency updater command (#222) #76
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Static Analysis | |
| # Builds a full Magento install ONCE (build-magento) and shares it via an | |
| # artifact, so multiple static-analysis tools (PHPStan, Mago analyze) run | |
| # against the same Magento codebase instead of each rebuilding it. The analysis | |
| # jobs need no live database — they only read code — so they run in parallel | |
| # without service containers. | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| concurrency: | |
| # Heavy shared Magento build — cancel superseded PR runs to save CI minutes; | |
| # let push/main runs finish so main is always validated directly. | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| permissions: | |
| contents: read | |
| jobs: | |
| build-magento: | |
| name: Build Magento (shared) | |
| runs-on: ubuntu-latest | |
| services: | |
| mariadb: | |
| image: mariadb:11.4 | |
| env: | |
| MYSQL_ROOT_PASSWORD: magento | |
| MYSQL_DATABASE: magento | |
| ports: | |
| - 3306:3306 | |
| options: --health-cmd="healthcheck.sh --connect --innodb_initialized" --health-interval=10s --health-timeout=5s --health-retries=3 | |
| opensearch: | |
| image: opensearchproject/opensearch:3 | |
| ports: | |
| - 9200:9200 | |
| env: | |
| discovery.type: single-node | |
| DISABLE_SECURITY_PLUGIN: true | |
| OPENSEARCH_JAVA_OPTS: -Xms512m -Xmx512m | |
| options: --health-cmd="curl http://localhost:9200/_cluster/health" --health-interval=10s --health-timeout=5s --health-retries=10 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| path: mageforge | |
| - name: Set up Magento | |
| uses: ./mageforge/.github/actions/setup-magento | |
| with: | |
| php-version: "8.4" | |
| magento-version: 2.4.8 | |
| magento-source: mage-os | |
| composer-auth: ${{ secrets.COMPOSER_AUTH }} | |
| - name: Install MageForge module and PHPStan tooling | |
| working-directory: magento2 | |
| run: | | |
| # Add the module from the current checkout as a copied (non-symlinked) | |
| # path repository so its source ends up inside the shared artifact. | |
| composer config repositories.mageforge-local '{"type": "path", "url": "../mageforge", "options": {"symlink": false}}' | |
| composer require --no-update openforgeproject/mageforge:@dev | |
| # Allow the PHPStan extension installer plugin | |
| composer config --no-plugins allow-plugins.phpstan/extension-installer true | |
| # PHPStan + Magento extension (consumed by the phpstan job). Pinned to | |
| # exact versions: phpstan.neon opts into bleedingEdge, whose rules | |
| # change between releases, so an unpinned `^2.0` lets a new PHPStan | |
| # release fail unrelated PRs. Bump these deliberately (keep in sync | |
| # with the locally installed PHPStan) instead of floating. | |
| composer require --dev --no-update "bitexpert/phpstan-magento:0.43.0" "phpstan/phpstan:2.2.2" phpstan/extension-installer | |
| composer update --with-dependencies | |
| bin/magento setup:upgrade | |
| # phpstan.neon and tests/ are export-ignored, so the copied path | |
| # repository omits them; place them next to the analysed source so the | |
| # phpstan job can analyse both `src` and `tests` (per phpstan.neon). | |
| cp ../mageforge/phpstan.neon vendor/openforgeproject/mageforge/phpstan.neon | |
| cp -r ../mageforge/tests vendor/openforgeproject/mageforge/tests | |
| - name: Pack Magento install | |
| run: | | |
| # Exclude runtime-only/disposable dirs to keep the artifact small; | |
| # static analysis only needs vendor/, app/, generated/ and app/etc/. | |
| tar czf magento.tar.gz \ | |
| --exclude='magento2/var' \ | |
| --exclude='magento2/pub/static' \ | |
| --exclude='magento2/pub/media' \ | |
| --exclude='magento2/.git' \ | |
| --exclude='magento2/dev/tests' \ | |
| magento2 | |
| - name: Upload Magento artifact | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: magento-build | |
| path: magento.tar.gz | |
| retention-days: 1 | |
| compression-level: 0 # already gzipped | |
| phpstan: | |
| name: PHPStan Analysis | |
| runs-on: ubuntu-latest | |
| needs: build-magento | |
| steps: | |
| - name: Setup PHP | |
| uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2 | |
| with: | |
| php-version: "8.4" | |
| extensions: mbstring, intl, gd, xml, soap, zip, bcmath, pdo_mysql, curl, sockets | |
| tools: composer:v2 | |
| - name: Download Magento artifact | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 | |
| with: | |
| name: magento-build | |
| - name: Unpack Magento install | |
| run: tar xzf magento.tar.gz | |
| - name: Run PHPStan | |
| working-directory: magento2 | |
| run: | | |
| vendor/bin/phpstan analyse -c vendor/openforgeproject/mageforge/phpstan.neon | |
| mago-analyze: | |
| name: Mago Analyze | |
| runs-on: ubuntu-latest | |
| needs: build-magento | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| path: mageforge | |
| - name: Setup PHP | |
| uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2 | |
| with: | |
| php-version: "8.4" | |
| tools: composer:v2 | |
| - name: Cache Composer packages | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 | |
| with: | |
| path: ~/.composer/cache/files | |
| key: ${{ runner.os }}-composer-mago-${{ hashFiles('mageforge/composer.json') }} | |
| restore-keys: ${{ runner.os }}-composer-mago | |
| - name: Install module dev dependencies (Mago binary) | |
| working-directory: mageforge | |
| run: composer install --no-interaction --no-progress | |
| - name: Download Magento artifact | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 | |
| with: | |
| name: magento-build | |
| - name: Unpack Magento install | |
| run: tar xzf magento.tar.gz | |
| # Run Mago from inside the built Magento (workspace = magento2), so the | |
| # `includes = ["vendor"]` from mago.toml resolves the full Magento class | |
| # graph. Only the module source is analyzed; phtml templates and the | |
| # Magento-idiomatic `mixed-*` codes are filtered via mago.toml. The Mago | |
| # binary and config come from the separate module checkout (its | |
| # require-dev isn't part of the artifact). mago.toml sets | |
| # `minimum-fail-level = "note"`, so any finding (including warnings and | |
| # help messages) fails this job — green means a completely clean report. | |
| - name: Mago analyze | |
| working-directory: magento2 | |
| env: | |
| # `paths = ["src"]` from mago.toml has no match under this workspace | |
| # (module source is analyzed via the vendor copy), which logs a | |
| # harmless "Failed to walk" warning. Log only real errors — findings | |
| # and the exit code are unaffected. Raise to `warn` when debugging | |
| # incomplete-analysis problems (e.g. vendor files that fail to parse). | |
| MAGO_LOG: error | |
| run: | | |
| ../mageforge/vendor/bin/mago \ | |
| --config ../mageforge/mago.toml \ | |
| analyze vendor/openforgeproject/mageforge/src \ | |
| --reporting-format=github |