Skip to content

Commit 4282c1a

Browse files
codedmonkeycodedmonkey
committed
Merge branch 'github-workflows'
2 parents efa82f5 + 86817ae commit 4282c1a

File tree

8 files changed

+197
-169
lines changed

8 files changed

+197
-169
lines changed

‎.github/workflows/docker-build.yaml‎

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎.github/workflows/images-build.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Build images
2+
3+
# Verifies whether the build of the images is valid. It does not publish the
4+
# image to a registry. It's triggered by new commits and a daily schedule for
5+
# the default branch. If any of the jobs fail for new commits they're not
6+
# allowed to be merged into the default branch. If it starts failing because of
7+
# changes to dependencies of the build process, it must be fixed before new
8+
# features are merged to ensure integrity.
9+
10+
on:
11+
pull_request:
12+
push:
13+
schedule:
14+
- cron: "30 4 * * *"
15+
16+
jobs:
17+
build-standalone:
18+
name: Standalone images
19+
20+
runs-on: ubuntu-latest
21+
22+
steps:
23+
- name: Set up Docker Buildx
24+
uses: docker/setup-buildx-action@v3
25+
with:
26+
driver: docker-container
27+
28+
- name: Build images
29+
uses: docker/build-push-action@v6
30+
with:
31+
platforms: linux/amd64,linux/arm64

.github/workflows/docker-publish.yaml renamed to .github/workflows/images-publish.yaml

Lines changed: 19 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,31 @@
1-
name: Publish image
1+
name: Publish images
2+
3+
# Builds and publishes the images to the GitHub registry. There are 2 triggers
4+
# for this workflow, a scheduled trigger to publish the latest development
5+
# version (the default branch) every night, and a trigger for tags formatted
6+
# as a semver version to publish releases. For any other image, it's
7+
# recommended to download the source code and build it locally as explained in
8+
# the documentation.
29

310
on:
411
push:
5-
tags:
6-
- v*
12+
tags: ["v*.*.*"]
713
schedule:
8-
-
9-
cron: "30 4 * * *"
14+
- cron: "30 4 * * *"
1015

1116
jobs:
12-
publish-image:
13-
name: Publish Docker image
17+
publish-standalone:
18+
name: Standalone images
19+
1420
runs-on: ubuntu-latest
15-
permissions:
16-
id-token: write
17-
contents: read
18-
packages: write
19-
attestations: write
21+
2022
steps:
21-
-
22-
name: Set up Docker Buildx
23+
- name: Set up Docker Buildx
2324
uses: docker/setup-buildx-action@v3
2425
with:
2526
driver: docker-container
2627

27-
-
28-
name: Extract metadata for Docker
28+
- name: Extract metadata for Docker
2929
id: meta
3030
uses: docker/metadata-action@v5
3131
with:
@@ -35,16 +35,14 @@ jobs:
3535
type=semver,pattern={{version}}
3636
type=semver,pattern={{major}}.{{minor}}
3737
38-
-
39-
name: Login to GitHub Packages
38+
- name: Login to GitHub Packages
4039
uses: docker/login-action@v3
4140
with:
4241
registry: ghcr.io
4342
username: ${{ github.actor }}
4443
password: ${{ secrets.GITHUB_TOKEN }}
4544

46-
-
47-
name: Build and push Docker image
45+
- name: Build and publish images
4846
id: push
4947
uses: docker/build-push-action@v6
5048
with:
@@ -53,8 +51,7 @@ jobs:
5351
labels: ${{ steps.meta.outputs.labels }}
5452
platforms: linux/amd64,linux/arm64
5553

56-
-
57-
name: Generate artifact attestation
54+
- name: Generate artifact attestation
5855
uses: actions/attest-build-provenance@v2
5956
with:
6057
subject-name: ghcr.io/${{ github.repository }}

‎.github/workflows/linting-dependencies.yaml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: Lint dependencies
2+
3+
# Runs tools to validate dependencies. This workflow is triggered for new
4+
# commits and every night for the default branch. If any of the jobs fail for
5+
# new commits they're not allowed to be merged into the default branch. If it
6+
# starts failing because of vulnerabilities, they must be fixed before new
7+
# features are merged and a security release must be made.
8+
9+
on:
10+
pull_request:
11+
push:
12+
schedule:
13+
- cron: "30 4 * * *"
14+
15+
jobs:
16+
composer:
17+
name: Composer
18+
19+
runs-on: ubuntu-latest
20+
21+
steps:
22+
- name: Checkout code
23+
uses: actions/checkout@v4
24+
25+
- name: Install PHP with extensions
26+
uses: shivammathur/setup-php@v2
27+
with:
28+
php-version: 8.3
29+
tools: composer:v2
30+
31+
- name: Set Composer cache directory
32+
id: composer-cache
33+
run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
34+
35+
- name: Cache Composer output
36+
uses: actions/cache@v4
37+
with:
38+
path: ${{ steps.composer-cache.outputs.dir }}
39+
key: ${{ runner.os }}-composer-${{ hashFiles('composer.lock') }}
40+
restore-keys: ${{ runner.os }}-composer-
41+
42+
- name: Install Composer dependencies
43+
id: composer-install
44+
run: composer install --ansi --no-interaction --no-progress
45+
46+
- name: Check if any Composer dependencies are compromised
47+
if: always() && steps.composer-install.outcome == 'success'
48+
run: composer audit --ansi
49+
50+
# This check always shows a success state, even when there are
51+
# outdated recipes (due to `continue-on-error`). Please check
52+
# the result when updating Composer dependencies.
53+
# todo fail when composer.lock changed and there is an outdated recipe
54+
- name: Check if any Symfony Flex recipes are outdated
55+
if: always() && steps.composer-install.outcome == 'success'
56+
continue-on-error: true
57+
run: composer recipes --outdated --ansi

.github/workflows/lint.yaml renamed to .github/workflows/linting.yaml

Lines changed: 35 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,15 @@
11
name: Lint code & configuration
22

3-
on:
4-
pull_request:
5-
push:
3+
# Runs tools to lint and validate the code and configuration. Only triggered by
4+
# creating new commits. If any of the jobs fail for new commits they're not
5+
# allowed to be merged into the default branch.
66

7-
env:
8-
fail-fast: true
9-
10-
permissions:
11-
contents: read
7+
on: [pull_request, push]
128

139
jobs:
1410
linters:
1511
name: Linters
12+
1613
runs-on: ubuntu-latest
1714

1815
steps:
@@ -22,8 +19,6 @@ jobs:
2219
- name: Install PHP with extensions
2320
uses: shivammathur/setup-php@v2
2421
with:
25-
coverage: none
26-
extensions: intl
2722
php-version: 8.3
2823
tools: composer:v2
2924

@@ -38,56 +33,48 @@ jobs:
3833
key: ${{ runner.os }}-composer-${{ hashFiles('composer.lock') }}
3934
restore-keys: ${{ runner.os }}-composer-
4035

41-
- name: Install dependencies
42-
id: install
36+
- name: Install Composer dependencies
37+
id: composer-install
4338
run: composer install --ansi --no-interaction --no-progress
4439

45-
- name: Lint YAML files
46-
if: always() && steps.install.outcome == 'success'
47-
run: bin/console lint:yaml .github config translations --parse-tags
48-
49-
- name: Lint Twig templates
50-
if: always() && steps.install.outcome == 'success'
51-
run: bin/console lint:twig templates --env=prod
52-
53-
#- name: Lint XLIFF translation files
54-
# if: always() && steps.install.outcome == 'success'
55-
# run: bin/console lint:xliff translations
40+
- name: Lint Composer configuration
41+
if: always() && steps.composer-install.outcome == 'success'
42+
run: composer validate --ansi
43+
# todo enable strict mode, currently license is invalid
44+
# run: composer validate --strict --ansi
5645

57-
#- name: Lint translation contents
58-
# if: always() && steps.install.outcome == 'success'
59-
# run: bin/console lint:translations
46+
- name: Lint Symfony service container
47+
if: always() && steps.composer-install.outcome == 'success'
48+
run: bin/console lint:container --ansi
6049

61-
- name: Lint Parameters and Services
62-
if: always() && steps.install.outcome == 'success'
63-
run: bin/console lint:container --no-debug
50+
- name: Lint translation files
51+
if: always() && steps.composer-install.outcome == 'success'
52+
run: bin/console lint:translations --ansi
6453

65-
- name: Lint Composer config
66-
if: always() && steps.install.outcome == 'success'
67-
run: composer validate
68-
# todo enable strict mode, currently license is invalid
69-
# run: composer validate --strict
54+
- name: Lint Twig templates
55+
if: always() && steps.composer-install.outcome == 'success'
56+
run: bin/console lint:twig templates --ansi
7057

71-
- name: Check if any dependencies are compromised
72-
if: always() && steps.install.outcome == 'success'
73-
run: composer audit
58+
- name: Lint YAML files
59+
if: always() && steps.composer-install.outcome == 'success'
60+
run: bin/console lint:yaml .github config translations --parse-tags --ansi
7461

75-
- name: Check if any Symfony recipes are outdated
76-
if: always() && steps.install.outcome == 'success'
77-
run: composer recipes --outdated --no-interaction
62+
#- name: Lint XLIFF translation files
63+
# if: always() && steps.composer-install.outcome == 'success'
64+
# run: bin/console lint:xliff translations --ansi
7865

7966
php-cs-fixer:
8067
name: PHP-CS-Fixer
68+
8169
runs-on: ubuntu-latest
70+
8271
steps:
8372
- name: Checkout code
8473
uses: actions/checkout@v4
8574

8675
- name: Install PHP with extensions
8776
uses: shivammathur/setup-php@v2
8877
with:
89-
coverage: none
90-
extensions: intl
9178
php-version: 8.3
9279
tools: composer:v2
9380

@@ -102,15 +89,15 @@ jobs:
10289
key: ${{ runner.os }}-composer-${{ hashFiles('composer.lock') }}
10390
restore-keys: ${{ runner.os }}-composer-
10491

105-
- name: Install dependencies
106-
id: install
92+
- name: Install Composer dependencies
10793
run: composer install --ansi --no-interaction --no-progress
10894

109-
- name: PHP-CS-Fixer
110-
run: ./vendor/bin/php-cs-fixer fix --diff --dry-run
95+
- name: Run PHP-CS-Fixer
96+
run: vendor/bin/php-cs-fixer fix --diff --dry-run --ansi --show-progress none
11197

11298
phpstan:
11399
name: PHPStan
100+
114101
runs-on: ubuntu-latest
115102

116103
steps:
@@ -120,8 +107,6 @@ jobs:
120107
- name: Install PHP with extensions
121108
uses: shivammathur/setup-php@v2
122109
with:
123-
coverage: none
124-
extensions: intl
125110
php-version: 8.3
126111
tools: composer:v2
127112

@@ -136,10 +121,8 @@ jobs:
136121
key: ${{ runner.os }}-composer-${{ hashFiles('composer.lock') }}
137122
restore-keys: ${{ runner.os }}-composer-
138123

139-
- name: Install dependencies
140-
id: install
124+
- name: Install Composer dependencies
141125
run: composer install --ansi --no-interaction --no-progress
142126

143127
- name: Run PHPStan
144-
if: always() && steps.install.outcome == 'success'
145-
run: ./vendor/bin/phpstan analyze
128+
run: vendor/bin/phpstan analyze --ansi --no-progress

0 commit comments

Comments
 (0)