fix: bounded config fixes for the PHP CI gates#49
Merged
Conversation
Keeps the library PHP (defensive PHP-security tooling). Config-only fixes: - composer.json: add autoload.files for src/WordPress/Adapter.php so the aegis_* WordPress-adapter functions are loaded (PSR-4 only autoloads classes, never free functions). - Adapter.php: move the aegis_* helpers to the GLOBAL namespace (was PhpAegis\WordPress). They are WordPress-style globals invoked unqualified (aegis_html(...)) and rely on PHP's global-function fallback; namespaced, the ~20 functions were unresolvable from the test namespaces. 'use' imports retained so the underlying class refs still resolve. - .php-cs-fixer.dist.php: fix invalid v3 config (exit 16): drop bogus 'no_eval' (no such fixer) and rename 'no_unneeded_curly_braces' -> 'no_unneeded_braces'. - php-lint.yml Security Pattern Check: add \b word boundaries so curl_exec() no longer matches \bexec\(, and anchor the backtick check + exclude quoted-string contexts so the library's own escaped backtick char in its Turtle/URI validators is not flagged. Verified statically (no PHP runtime in env): composer.json is valid JSON; new security-pattern regexes produce zero matches on src/ while still catching a bare exec(. composer.lock and the PHPStan L9 baseline still require a PHP runtime (see PR notes). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Keeps the library PHP (defensive PHP-security tooling — we protect PHP devs). Config-only, PHP-native fixes for the failing gates:
(a) PHPUnit — undefined aegis_ functions.* Added
autoload.filesforsrc/WordPress/Adapter.php(PSR-4 only autoloads classes, never free functions). Also moved the ~20aegis_*helpers fromPhpAegis\WordPressinto the global namespace: they are WordPress-style globals invoked unqualified (aegis_html(...)) and depend on PHP's global-function fallback — while namespaced they were unresolvable from the test namespaces (PhpAegis\Tests\*).useimports retained so the underlying class refs (Sanitizer::html, etc.) still resolve.(b) composer.lock — NOT included. Cannot be generated without a Composer runtime in this environment; deliberately not fabricated. Needs
composer install/composer updateto commit.(c) PHP-CS-Fixer exit 16 (invalid v3 config). Removed bogus
no_eval(no such fixer exists) and renamedno_unneeded_curly_braces→no_unneeded_braces(renamed in php-cs-fixer 3.x).(d) Security Pattern Check false positives. Added
\bword boundaries socurl_exec()no longer matches\bexec\(, and anchored the backtick check (plus a quoted-string exclusion) so the library's own escaped backtick character inside its Turtle/URI validators isn't flagged. Verified: zero matches onsrc/now, while a bareexec(is still caught.(e) PHPStan L9 — NOT attempted here (out of scope per the request). No baseline added: generating an accurate
phpstan-baseline.neonrequires running PHPStan (no PHP runtime here), andreportUnmatchedIgnoredErrors: truewould fail on a fabricated/stale baseline. Remains for a PHP-runtime follow-up if L9 surfaces genuine strict errors.Verified statically (no PHP runtime in env):
composer.jsonis valid JSON; the new security-pattern regexes match nothing insrc/yet still flag a bareexec(.🤖 Generated with Claude Code