Inline subactions

Author: Seldaek

.github/workflows/tests.yml

@@ -97,15 +97,23 @@ jobs:
           git add -A
           git commit -q -m head
 
-      - name: "Run analyze sub-action against scenario"
-        uses: ./analyze
+      - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
         with:
-          base-ref: HEAD~1
-          working-directory: scenario
-          paths: 'src/**/*.php'
-          source-roots: 'src'
-          show-modified: 'false'
-          show-removed: 'true'
+          coverage: 'none'
+          php-version: 8.5
+          tools: composer:v2
+
+      - run: composer install --no-interaction --no-progress --classmap-authoritative
+
+      - name: "Run analysis against scenario"
+        working-directory: scenario
+        env:
+          BASE_REF: HEAD~1
+          PATHS_GLOB: 'src/**/*.php'
+          SOURCE_ROOTS: 'src'
+          SHOW_MODIFIED: 'false'
+          SHOW_REMOVED: 'true'
+        run: bash ${{ github.workspace }}/scripts/detect.sh
 
       - name: "Assert expected output"
         run: |

README.md

@@ -29,6 +29,11 @@ A minimal job whose only purpose is to fire `workflow_run` so the main workflow
 
 ```yaml
 name: 'API Surface Check'
+
+# Minimal pull_request workflow whose only job is to fire workflow_run for the
+# api-surface-comment workflow (which has pull-requests:write even on fork PRs
+# and runs the actual analysis from trusted action code).
+
 on:
   pull_request:
     paths-ignore:
@@ -123,28 +128,6 @@ jobs:
 
 The PR number and base ref are resolved automatically from the `workflow_run` event payload — you don't pass them.
 
-## Sub-actions
-
-The main action is a thin orchestrator. The work it can do — analysis and comment posting — is also exposed as standalone sub-actions for advanced setups (custom workflows, smoke testing, or scenarios that don't fit the two-workflow `pull_request`/`workflow_run` pattern).
-
-### `composer/api-surface-check/analyze`
-
-Runs the full analysis: setup PHP, install action deps, optionally install project deps, snapshot HEAD and BASE, diff, and write `comment-body.txt`. Assumes the consumer has already checked out a git tree with HEAD and `base-ref` reachable.
-
-Inputs are the same as the main action's analysis-related inputs (`paths`, `source-roots`, `working-directory`, `install-dependencies`, etc.) plus a required `base-ref`. Outputs `has-changes` (`true`/`false`) and `output-dir`.
-
-### `composer/api-surface-check/post-comment`
-
-Posts, updates, or deletes a PR comment based on the `comment-body.txt` produced by `analyze`. Run it unconditionally once the PR is resolved — when given an empty/missing body it deletes any previously-posted bot comment, which fixes stale comments after a PR is updated to revert API additions.
-
-| Input            | Default                    | Description                                                                                                |
-| ---------------- | -------------------------- | ---------------------------------------------------------------------------------------------------------- |
-| `pr-number`      | _required_                 | PR number to post / update / delete the comment on.                                                        |
-| `output-dir`     | `api-surface-result`       | Directory containing `comment-body.txt`. An empty/missing body deletes any existing marked comment.        |
-| `comment-marker` | `<!-- api-surface-bot -->` | HTML marker that identifies previous bot comments.                                                         |
-
-Requires `GH_TOKEN` env (passed in by the consumer) with `pull-requests: write`.
-
 ## Resolving vendor parents
 
 By default the action only resolves classes that live under `source-roots`. If your code extends classes that come from Composer dependencies (e.g. `class Foo extends \Symfony\…`), better-reflection can't follow those parents and the introduction-point check is incomplete — methods defined on a vendor parent may be wrongly flagged as new on your subclass.

action.yml

@@ -111,34 +111,70 @@ runs:
         bash ${{ github.action_path }}/scripts/preflight.sh
         echo "should-run=$(cat api-surface-preflight.txt)" >> "$GITHUB_OUTPUT"
 
-    - name: Run analysis
+    - name: Setup PHP
       if: steps.pr.outputs.number && steps.preflight.outputs.should-run == 'true'
-      uses: ./analyze
+      uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
       with:
-        base-ref: origin/${{ steps.pr.outputs.base-ref }}
-        paths: ${{ inputs.paths }}
-        source-roots: ${{ inputs.source-roots }}
-        output-dir: ${{ inputs.output-dir }}
-        working-directory: ${{ inputs.working-directory }}
-        install-dependencies: ${{ inputs.install-dependencies }}
-        composer-working-directory: ${{ inputs.composer-working-directory }}
-        include-internal: ${{ inputs.include-internal }}
-        types: ${{ inputs.types }}
-        visibility: ${{ inputs.visibility }}
-        show-removed: ${{ inputs.show-removed }}
-        show-modified: ${{ inputs.show-modified }}
-        comment-marker: ${{ inputs.comment-marker }}
-        heading: ${{ inputs.heading }}
+        coverage: 'none'
+        php-version: 8.5
+        tools: composer:v2
+
+    - name: Install action dependencies
+      if: steps.pr.outputs.number && steps.preflight.outputs.should-run == 'true'
+      shell: bash
+      working-directory: ${{ github.action_path }}
+      run: composer install --no-interaction --no-progress --classmap-authoritative
+
+    - name: Install project dependencies
+      id: project-deps
+      if: steps.pr.outputs.number && steps.preflight.outputs.should-run == 'true' && inputs.install-dependencies == 'true'
+      shell: bash
+      working-directory: ${{ inputs.composer-working-directory || inputs.working-directory }}
+      run: |
+        if [[ ! -f composer.json ]]; then
+          echo "::warning::install-dependencies=true but no composer.json at $(pwd); proceeding without vendor resolution."
+          exit 0
+        fi
+        # Safety: --no-scripts blocks composer.json scripts; --no-plugins blocks
+        # installed composer-plugin code. Together they reduce composer install
+        # to "fetch tarballs and write autoload" — no PR-controlled code runs.
+        if ! composer install --no-scripts --no-plugins --no-dev --prefer-dist --no-interaction --no-progress --ignore-platform-reqs; then
+          echo "::warning::composer install failed; proceeding without vendor resolution."
+          exit 0
+        fi
+        if [[ -d vendor ]]; then
+          echo "vendor-path=$(cd vendor && pwd)" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Run analysis
+      id: detect
+      if: steps.pr.outputs.number && steps.preflight.outputs.should-run == 'true'
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      env:
+        BASE_REF: origin/${{ steps.pr.outputs.base-ref }}
+        PATHS_GLOB: ${{ inputs.paths }}
+        SOURCE_ROOTS: ${{ inputs.source-roots }}
+        VENDOR_PATH: ${{ steps.project-deps.outputs.vendor-path }}
+        OUTPUT_DIR: ${{ inputs.output-dir }}
+        INCLUDE_INTERNAL: ${{ inputs.include-internal }}
+        TYPES: ${{ inputs.types }}
+        VISIBILITY: ${{ inputs.visibility }}
+        SHOW_REMOVED: ${{ inputs.show-removed }}
+        SHOW_MODIFIED: ${{ inputs.show-modified }}
+        COMMENT_MARKER: ${{ inputs.comment-marker }}
+        HEADING: ${{ inputs.heading }}
+      run: bash ${{ github.action_path }}/scripts/detect.sh
 
     # Always run post-comment when we have a PR. With analysis skipped,
     # comment-body.txt is missing/empty and post-comment deletes any
     # previously-posted bot comment.
     - name: Post or update comment
       if: steps.pr.outputs.number
-      uses: ./post-comment
-      with:
-        pr-number: ${{ steps.pr.outputs.number }}
-        output-dir: ${{ inputs.output-dir }}
-        comment-marker: ${{ inputs.comment-marker }}
+      shell: bash
       env:
         GH_TOKEN: ${{ github.token }}
+        OUTPUT_DIR: ${{ inputs.output-dir }}
+        COMMENT_MARKER: ${{ inputs.comment-marker }}
+        PR_NUMBER: ${{ steps.pr.outputs.number }}
+      run: bash ${{ github.action_path }}/scripts/post-comment.sh