|
| 1 | +# Phase 3: Hardening and Release Prep |
| 2 | + |
| 3 | +Branch: `feature/phase-3-hardening` (based on `refactor-phase-2`) |
| 4 | + |
| 5 | +## Goals |
| 6 | +- Stabilize API and internal structure (no feature creep) |
| 7 | +- High-confidence release quality: tests + static analysis + style checks |
| 8 | +- Updated documentation (user + developer) |
| 9 | +- Green CI across PHP 8.0–8.3 |
| 10 | + |
| 11 | +## Success Criteria |
| 12 | +- Build: Composer autoload OK |
| 13 | +- Static analysis: PHPStan level 7 (target 8) |
| 14 | +- Style: PHPCS PSR-12 clean |
| 15 | +- Tests: PHPUnit passing; coverage ≥ 70% (stretch: 80%+) |
| 16 | +- CI: Green on PR (lint + static + tests) |
| 17 | +- Docs: Up to date (Quickstart, Config, Endpoints, Security, Caching, Observability) |
| 18 | + |
| 19 | +## Workstream Breakdown |
| 20 | + |
| 21 | +### 1) Tests |
| 22 | +- Unit tests for: |
| 23 | + - Http: Response, ErrorResponder, Middleware (CORS, RateLimit) |
| 24 | + - Auth: Authenticator (apikey/basic/jwt + DB auth path), role retrieval |
| 25 | + - Security: Rbac, RbacGuard, RateLimiter |
| 26 | + - Database: SchemaInspector (via mock PDO), Dialects (quoting) |
| 27 | + - ApiGenerator: list/count filters, sort, pagination; CRUD behaviors |
| 28 | + - Observability: RequestLogger, Monitor (metrics, alerts) |
| 29 | + - Docs: OpenApiGenerator minimal spec |
| 30 | +- Integration smoke tests for Router (list/read/create/update/delete/openapi/login) |
| 31 | + |
| 32 | +### 2) Static Analysis + Style |
| 33 | +- PHPStan config: `phpstan.neon.dist` (level 7 → iterate up) |
| 34 | +- PHPCS config: `phpcs.xml.dist` (PSR-12) |
| 35 | +- Address critical findings; schedule non-critical fixes post-freeze |
| 36 | + |
| 37 | +### 3) CI Pipeline |
| 38 | +- GitHub Actions: `.github/workflows/ci.yml` |
| 39 | + - Matrix: PHP 8.0, 8.1, 8.2, 8.3 |
| 40 | + - Steps: composer validate → install → dump-autoload → phpstan → phpcs → phpunit |
| 41 | + |
| 42 | +### 4) Docs Updates |
| 43 | +- README: Quickstart with `App\Application\Router` entrypoint |
| 44 | +- CONFIG: `config/api.php` and `config/cache.php` options aligned with `ApiConfig`/`CacheConfig` |
| 45 | +- Endpoints: Actions, filters, sorting, pagination, bulk |
| 46 | +- Security: Auth methods + RBAC usage, examples; rate limit headers |
| 47 | +- Observability: RequestLogger/Monitor paths, rotation/cleanup |
| 48 | +- Caching: CacheManager TTLs, exclusions, varyBy |
| 49 | +- Migration: v2.0.0-dev hard break (wrappers removed; canonical namespaces only) |
| 50 | + |
| 51 | +## Execution Sequence (Suggested) |
| 52 | +1) Baseline run (build/static/tests) → capture issues |
| 53 | +2) Add/fix unit tests per module → quick iterations |
| 54 | +3) Router integration smoke tests |
| 55 | +4) Raise PHPStan level and fix high-signal findings |
| 56 | +5) CI green across matrix |
| 57 | +6) Final docs refresh + examples |
| 58 | + |
| 59 | +## Risk & Mitigation |
| 60 | +- DB-dependent tests: prefer mocks for unit; add optional integration profile later |
| 61 | +- Platform differences (Windows paths): tests use sys_get_temp_dir() and portable paths |
| 62 | +- Flaky tests (timing, rate limit): use deterministic settings in test env |
| 63 | + |
| 64 | +--- |
| 65 | +Maintainer note: Keep PRs small and focused (tests per module); keep branch scoped to hardening only. |
0 commit comments