CICD.yml

name: Integrate

# Run this workflow every time a new commit pushed to your repository
on:
  push:
    branches:
      - master
    tags:
      - '*'
    paths-ignore:
      - '**/*.md'
      - 'public/dist/*.js'
      - 'public/dist/**/*.js'
  pull_request:
    paths-ignore:
      - '**/*.md'
      - 'public/dist/*.js'
      - 'public/dist/**/*.js'
  # Allow manually triggering the workflow.
  workflow_dispatch:

# Declare default permissions as read only.
permissions: read-all

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ !contains(github.ref, 'master') && !startsWith(github.ref, 'refs/tags/') }} # Only cancel previous runs on non-master/non-tag branches.

jobs:
  php_syntax_errors:
    name: 0️⃣ PHP 8.4 - Syntax errors
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Setup PHP Action
        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
        with:
          php-version: 8.4

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install dependencies
        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0

      - name: Check source code for syntax errors
        run: vendor/bin/parallel-lint --exclude .git --exclude vendor .

  check_js:
    name: 0️⃣ JS front-end
    uses: ./.github/workflows/js_check.yml

  code_style_errors:
    name: 1️⃣ PHP 8.4 - Code Style errors
    runs-on: ubuntu-latest
    needs:
      - php_syntax_errors
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Set up PHP
        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
        with:
          php-version: 8.4

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install dependencies
        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0

      - name: Check source code for code style errors
        run: vendor/bin/php-cs-fixer fix --config=.php-cs-fixer.php --verbose --diff --dry-run

  phpstan:
    name: 1️⃣ PHP 8.4 - PHPStan
    runs-on: ubuntu-latest
    needs:
      - php_syntax_errors
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup PHP
        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
        with:
          php-version: 8.4
          coverage: none

      - name: Install Composer dependencies
        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0

      - name: Run PHPStan
        run: vendor/bin/phpstan analyze

  license:
    name: 1️⃣ PHP 8.4 - License Check
    runs-on: ubuntu-latest
    needs:
      - php_syntax_errors
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup PHP
        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
        with:
          php-version: 8.4
          coverage: none

      - name: Install Composer dependencies
        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0

      # We ban GPL-2.0-or-later, we don't want that viral thing in Lychee: We want to keep our MIT license.
      - name: Run License Checker
        run: vendor/bin/composer-license-checker check -b GPL-2.0-or-later -b GPL-2.0-only -b GPL-3.0-only -b GPL-3.0-or-later -b AGPL-1.0-only -b AGPL-1.0-or-later -b AGPL-3.0-only -b AGPL-3.0-or-later -b LGPL-2.0-only -b LGPL-2.0-or-later -b LGPL-2.1-only -b LGPL-2.1-or-later -b LGPL-3.0-only -b LGPL-3.0-or-later --no-dev

  tests:
    name: 1️⃣ PHP tests
    needs:
      - php_syntax_errors
    uses: ./.github/workflows/php_tests.yml
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  dist:
    name: 2️⃣ PHP dist
    needs:
      - code_style_errors
    uses: ./.github/workflows/php_dist.yml

  docker_check:
    name: 3️⃣ Dockerfile Lint
    runs-on: ubuntu-latest
    needs:
      - phpstan
      - check_js

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0

      - name: Docker Lint
        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
        with:
          dockerfile: ./Dockerfile
          failure-threshold: warning

      - name: Build Docker image locally
        run: docker build -t lychee:local .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: lychee:local
          format: 'table'
          exit-code: 1
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'

  docker_build:
    name:  4️⃣ Build Docker Image
    runs-on: ubuntu-latest
    if: >
      (github.ref == 'refs/heads/master' && github.event_name == 'push') ||
      (startsWith(github.ref, 'refs/tags/') && github.event_name == 'push') ||
      (github.event_name == 'workflow_dispatch')
    needs:
      - docker_check
    permissions:
      contents: read
      packages: write

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      -
        name: Login to DockerHub
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract metadata (tags, labels)
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: |
            ${{ github.repository }}
            ghcr.io/${{ github.repository }}
          flavor: |
            latest=${{ startsWith(github.ref, 'refs/tags/') }}
          tags: |
            # define default branch
            type=edge,branch=master
            # branch event
            type=ref,event=branch
            # tag event
            type=ref,event=tag

      - name: Build and push Docker image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=image-frankenphp
          cache-to: type=gha,scope=image-frankenphp,mode=max
          build-args: |
            NODE_ENV=production

  docker_legacy_check:
    name: 3️⃣ Legacy Dockerfile Lint
    runs-on: ubuntu-latest
    needs:
      - phpstan
      - check_js

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0

      - name: Docker Lint
        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
        with:
          dockerfile: ./Dockerfile-legacy
          failure-threshold: warning

      - name: Build Docker image locally
        run: docker build -f Dockerfile-legacy -t lychee:local-legacy .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: lychee:local-legacy
          format: 'table'
          exit-code: 1
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'

  docker_legacy_build:
    name:  4️⃣ Build Legacy Docker Image
    runs-on: ubuntu-latest
    if: >
      (github.ref == 'refs/heads/master' && github.event_name == 'push') ||
      (startsWith(github.ref, 'refs/tags/') && github.event_name == 'push') ||
      (github.event_name == 'workflow_dispatch')
    needs:
      - docker_legacy_check
    permissions:
      contents: read
      packages: write

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      -
        name: Login to DockerHub
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract metadata (tags, labels)
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: |
            ${{ github.repository }}
            ghcr.io/${{ github.repository }}
          flavor: |
            latest=${{ startsWith(github.ref, 'refs/tags/') }}
            suffix=-legacy,onlatest=true
          tags: |
            # define default branch
            type=edge,branch=master
            # branch event
            type=ref,event=branch
            # tag event
            type=ref,event=tag

      - name: Build and push Docker image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          push: true
          file: Dockerfile-legacy
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=image-legacy
          cache-to: type=gha,scope=image-legacy,mode=max
          build-args: |
            NODE_ENV=production

  createArtifact:
    name: 3️⃣ Build Artifact
    if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/')
    needs:
      - phpstan
      - dist
      - tests
      - check_js
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      attestations: write
    env:
      extensions: bcmath, curl, dom, gd, imagick, json, libxml, mbstring, pcntl, pdo, pdo_sqlite, pdo_mysql, pdo_pgsql, pgsql, sqlite3, zip

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup PHP
        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
        with:
          php-version: 8.4
          extensions: ${{ env.extensions }}
          coverage: none

      - name: Use Node.js 20
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
            node-version: 20

      - name: Build Dist
        run: |
          make clean dist

      - name: Upload build artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: Lychee.zip
          path: Lychee.zip
          if-no-files-found: error # 'warn' or 'ignore' are also available, defaults to `warn`

      - name: Attest
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          # Path to the artifact serving as the subject of the attestation. Must
          # specify exactly one of "subject-path" or "subject-digest". May contain a
          # glob pattern or list of paths (total subject count cannot exceed 2500).
          subject-path: '${{ github.workspace }}/Lychee.zip'

          # SHA256 digest of the subject for the attestation. Must be in the form
          # "sha256:hex_digest" (e.g. "sha256:abc123..."). Must specify exactly one
          # of "subject-path" or "subject-digest".
          # subject-digest:

          # Subject name as it should appear in the attestation. Required unless
          # "subject-path" is specified, in which case it will be inferred from the
          # path.
          # subject-name: Lychee

          # Whether to push the attestation to the image registry. Requires that the
          # "subject-name" parameter specify the fully-qualified image name and that
          # the "subject-digest" parameter be specified. Defaults to false.
          # push-to-registry:

          # Whether to attach a list of generated attestations to the workflow run
          # summary page. Defaults to true.
          # show-summary:

          # The GitHub token used to make authenticated API requests. Default is
          # ${{ github.token }}
          github-token: ${{ github.token }}


  release:
    name: 4️⃣ Release
    if: startsWith(github.ref, 'refs/tags/')
    needs:
      - createArtifact
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    env:
      extensions: bcmath, curl, dom, gd, imagick, json, libxml, mbstring, pcntl, pdo, pdo_sqlite, pdo_mysql, pdo_pgsql, pgsql, sqlite3, zip

    steps:
      - name: Install Cosign
        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1

      - name: Download generated artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: Lychee.zip

      # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
      - name: Sign release with a key
        run: |
          cosign sign-blob --yes --key env://COSIGN_PRIVATE_KEY --bundle Lychee.zip.sigstore.json Lychee.zip
        env:
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}

      - name: Create release
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
        with:
          files: |
            Lychee.zip.sigstore.json
            Lychee.zip
          token: ${{ secrets.GITHUB_TOKEN }}
          generate_release_notes: true
          make_latest: true