code-quality.yml

name: Code Quality & Auto-Fix

on:
  push:
    branches: [ universe, main ]
  pull_request:
    branches: [ universe, main ]

jobs:
  php-quality:
    name: PHP Code Quality
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup PHP
        uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f
        with:
          php-version: '8.3'
          # Composer >= 2.9.8 closes CVE-2026-45793 (GitHub App token leak to logs)
          tools: composer:2.9.8
          coverage: none

      - name: Mint Composer resolver token
        id: composer-token
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ vars.COMPOSER_RESOLVER_CLIENT_ID }}
          private-key: ${{ secrets.COMPOSER_RESOLVER_PRIVATE_KEY }}
          owner: Starisian-Technologies
          repositories: sparxstar-ouroboros-integrity

      - name: Wire git to use Composer resolver token for Ouroboros
        env:
          TOKEN: ${{ steps.composer-token.outputs.token }}
        run: git config --global url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/"

      - name: Cache Composer dependencies
        uses: actions/cache@v4
        with:
          path: vendor
          key: ${{ runner.os }}-composer-v2-${{ hashFiles('**/composer.lock') }}
          restore-keys: |
            ${{ runner.os }}-composer-v2-

      - name: Install PHP dependencies
        env:
          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ steps.composer-token.outputs.token }}"}}'
        run: composer install --prefer-dist --no-interaction --no-progress

      # PHPCS and PHPStan run independently via standards.yml (sparxstar-code-conformance).
      # Do not duplicate them here — it masks PHPStan behind a PHPCS short-circuit.

      - name: Run Rector (dry-run)
        run: composer rector

  js-quality:
    name: JavaScript/CSS Code Quality
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '24'
      
      - name: Setup pnpm
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
        with:
          version: 8.6.0
      
      - name: Cache pnpm dependencies
        uses: actions/cache@v4
        with:
          path: ~/.pnpm-store
          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-
      
      - name: Install Node dependencies
        run: pnpm install --frozen-lockfile
      
      - name: Run ESLint
        run: pnpm run lint:js
      
      - name: Run Stylelint
        run: pnpm run lint:css

  auto-fix:
    name: Auto-Fix Code Issues
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/universe'
    needs: [php-quality, js-quality]
    permissions:
      contents: write
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}
          token: ${{ secrets.GITHUB_TOKEN }}
          fetch-depth: 0
      
      - name: Setup PHP
        uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f
        with:
          php-version: '8.3'
          # Composer >= 2.9.8 closes CVE-2026-45793 (GitHub App token leak to logs)
          tools: composer:2.9.8

      - name: Mint Composer resolver token
        id: composer-token
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ vars.COMPOSER_RESOLVER_CLIENT_ID }}
          private-key: ${{ secrets.COMPOSER_RESOLVER_PRIVATE_KEY }}
          owner: Starisian-Technologies
          repositories: sparxstar-ouroboros-integrity

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '24'

      - name: Setup pnpm
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
        with:
          version: 8.6.0

      - name: Wire git to use Composer resolver token for Ouroboros
        env:
          TOKEN: ${{ steps.composer-token.outputs.token }}
        run: git config --global url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/"

      - name: Install dependencies
        env:
          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ steps.composer-token.outputs.token }}"}}'
        run: |
          composer install --prefer-dist --no-interaction
          pnpm install --frozen-lockfile
      
      - name: Run Rector fixes
        run: composer rector:fix || true
      
      - name: Run PHP CS Fixer
        run: composer phpfix || true
      
      - name: Run PHPCBF
        run: composer phpcbf || true
      
      - name: Run ESLint fixes
        run: pnpm run lint:fix || true
      
      - name: Run Stylelint fixes
        run: pnpm run stylelint:fix || true
      
      - name: Run Prettier
        run: pnpm run format || true
      
      - name: Commit and push changes
        uses: stefanzweifel/git-auto-commit-action@28e16e81777b558cc906c8750092100bbb34c5e3
        with:
          commit_message: "style: auto-fix code quality issues [skip ci]"
          commit_user_name: "github-actions[bot]"
          commit_user_email: "github-actions[bot]@users.noreply.github.com"
          branch: ${{ github.event_name == 'pull_request' && github.head_ref || github.ref }}
          file_pattern: "src/**/*.php src/**/*.js src/**/*.css"