lint.yml

# https://help.github.com/en/categories/automating-your-workflow-with-github-actions

name: "Lint"

on:
  pull_request:
  push:
    branches:
      - "2.3.x"

concurrency:
  group: lint-${{ github.head_ref || github.run_id }} # will be canceled on subsequent pushes in pull requests but not branches
  cancel-in-progress: true

jobs:
  lint:
    name: "Lint"
    runs-on: "ubuntu-latest"
    timeout-minutes: 60

    strategy:
      fail-fast: false
      matrix:
        php-version:
          - "7.4"
          - "8.0"
          - "8.1"
          - "8.2"
          - "8.3"
          - "8.4"
          - "8.5"
          - "8.6"

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: "Install PHP"
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        with:
          coverage: "none"
          php-version: "${{ matrix.php-version }}"

      - name: "Downgrade PHPUnit"
        if: matrix.php-version == '7.4' || matrix.php-version == '8.0' || matrix.php-version == '8.1'
        run: "composer require --dev phpunit/phpunit:^9.6 sebastian/diff:^4.0 doctrine/instantiator:^1.0 --update-with-dependencies --ignore-platform-reqs"

      - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0

      - uses: ./.github/actions/downgrade-code
        with:
          php-version: "${{ matrix.php-version }}"

      - name: "Validate Composer"
        run: "composer validate"

      - name: "Lint"
        run: "make lint"

  turbo-lint:
    name: "Turbo Extension Lint"

    runs-on: "ubuntu-latest"
    timeout-minutes: 30

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # only the PHP development headers are needed (php-config --includes);
      # the extension is not built here
      - name: "Install PHP"
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        with:
          coverage: "none"
          php-version: "8.5"

      # The pinned major version is read from the Makefile rather than
      # repeated here, so CI and a local run gate on the same checks — the
      # target refuses to run with any other version. Ubuntu ships an older
      # clang-tidy than the pin, so it comes from apt.llvm.org.
      - name: "Install the pinned clang-tidy"
        run: |
          CLANG_TIDY_VERSION="$(make -s -C turbo-ext print-clang-tidy-version)"
          echo "pinned clang-tidy: $CLANG_TIDY_VERSION"
          # only the codename: /etc/os-release also defines VERSION
          CODENAME="$(. /etc/os-release && echo "$VERSION_CODENAME")"
          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc > /dev/null
          echo "deb https://apt.llvm.org/${CODENAME}/ llvm-toolchain-${CODENAME}-${CLANG_TIDY_VERSION} main" \
            | sudo tee "/etc/apt/sources.list.d/llvm-${CLANG_TIDY_VERSION}.list"
          sudo apt-get update
          sudo apt-get install -y "clang-tidy-${CLANG_TIDY_VERSION}"

      - name: "Lint the native sources"
        run: make lint-turbo

  turbo-sanitize:
    name: "Turbo Extension Sanitizers"

    runs-on: "ubuntu-latest"
    timeout-minutes: 30

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: "Install PHP"
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        with:
          coverage: "none"
          php-version: "8.5"

      # the differential tests compare the native results against the PHP
      # twins, so the PHP side has to be installed
      - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0

      - name: "Differential tests under UndefinedBehaviorSanitizer"
        run: make sanitize-turbo

  coding-standards:
    name: "Coding Standard"

    runs-on: "ubuntu-latest"
    timeout-minutes: 60

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: "Checkout build-cs"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: "phpstan/build-cs"
          path: "build-cs"
          ref: "2.x"

      - name: "Install PHP"
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        with:
          coverage: "none"
          php-version: "8.5"

      - name: "Validate Composer"
        run: "composer validate"

      - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0

      - name: "Install build-cs dependencies"
        uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
        with:
          working-directory: "build-cs"

      - name: "Lint"
        run: "make lint"

      - name: "Coding Standard"
        run: "make cs"

  dependency-analysis:
    name: "Dependency Analysis"

    runs-on: "ubuntu-latest"
    timeout-minutes: 60

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: "Install PHP"
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        with:
          coverage: "none"
          php-version: "8.5"

      - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0

      - name: "Composer Dependency Analyser"
        run: "make composer-dependency-analyser"

  name-collision:
    name: "Name Collision Detector"

    runs-on: "ubuntu-latest"
    timeout-minutes: 60

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: "Install PHP"
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        with:
          coverage: "none"
          php-version: "8.5"

      - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0

      - name: "Name Collision Detector"
        run: "make name-collision"