chore: governance snapshot from registry@78a426f #950
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CI Workflow | |
| # Purpose: Execute full linting, static analysis, and integration tests for pushes and pull requests. | |
| name: CI | |
| on: | |
| push: | |
| pull_request: | |
| jobs: | |
| build: | |
| # Use least-privilege static permissions; this job only needs repository read access. | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup PHP | |
| uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f | |
| # uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: '8.3' | |
| # Composer >= 2.9.8 closes CVE-2026-45793 (GitHub App token leak to logs) | |
| tools: composer:2.9.8 | |
| - name: Run API contract smoke test | |
| run: composer run smoke:api-contract | |
| - name: Mint Composer resolver token | |
| id: composer-token | |
| uses: actions/create-github-app-token@v3 | |
| with: | |
| client-id: ${{ vars.COMPOSER_RESOLVER_CLIENT_ID }} | |
| private-key: ${{ secrets.COMPOSER_RESOLVER_PRIVATE_KEY }} | |
| owner: Starisian-Technologies | |
| repositories: sparxstar-ouroboros-integrity | |
| - name: Wire git to use Composer resolver token for Ouroboros | |
| env: | |
| TOKEN: ${{ steps.composer-token.outputs.token }} | |
| run: git config --global url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/" | |
| - name: Cache Composer packages | |
| uses: actions/cache@v4 | |
| with: | |
| path: vendor | |
| key: composer-v2-${{ hashFiles('**/composer.lock') }} | |
| restore-keys: composer-v2- | |
| - name: Install PHP dependencies | |
| env: | |
| COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ steps.composer-token.outputs.token }}"}}' | |
| run: composer install --no-interaction | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 | |
| # uses: pnpm/action-setup@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '24' | |
| cache: 'pnpm' | |
| - name: Install JS dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Validate STAR/AIWA compliance | |
| run: | | |
| php -r '$file = file_get_contents("sparxstar-user-environment-check.php"); if ($file === false || ! str_contains($file, "Plugin Name:")) { fwrite(STDERR, "Missing plugin header\n"); exit(1); }' | |
| git grep -q "star-" -- src || { echo "STAR prefix not found in source"; exit 1; } | |
| - name: Run frontend linting | |
| run: pnpm run lint | |
| - name: Check PHP formatting without modifying files | |
| run: composer run phpfix:dry | |
| - name: Build assets | |
| run: pnpm run build | |
| - name: Run PHP unit tests | |
| run: composer run test:unit |