refactor(release): parse override list in PHP, drop shell construction

Review feedback on #717:

- Move newline-delimited override parsing from a bash step into the PHP
  CLI (--overrides flag). Reusable workflow becomes a single quoted-arg
  invocation; no GITHUB_OUTPUT round-trip, no SC2086 word-splitting, no
  shell-injection surface for caller-controlled path_overrides.
- Rename self-test workflow file (drop _ prefix; no other workflow in
  the repo uses one).
- Rename CLI locals canon/cons → canonicalPath/consumerPath; less
  shadowing of the surrounding $canonical option variable.

No behavior change for existing --override callers.

Refs #664, #717.

Assisted-by: Claude Code

Author: kojiromike

.github/workflows/check-vendored-contracts.yml

@@ -73,29 +73,9 @@ jobs:
         working-directory: _canonical-openemr-devops/tools/release
         run: composer install --no-interaction --no-progress --no-dev
 
-      - name: Build override flags
-        id: overrides
-        env:
-          PATH_OVERRIDES: ${{ inputs.path_overrides }}
-        run: |
-          flags=''
-          while IFS= read -r line; do
-              line="${line## }"
-              line="${line%% }"
-              [[ -z $line ]] && continue
-              flags+=" --override $line"
-          done <<< "$PATH_OVERRIDES"
-          {
-              echo "flags<<EOF"
-              echo "$flags"
-              echo "EOF"
-          } >> "$GITHUB_OUTPUT"
-
       - name: Check vendored contracts
         env:
           CONSUMER_PATH: ${{ github.workspace }}/${{ inputs.consumer_subpath }}
-          OVERRIDE_FLAGS: ${{ steps.overrides.outputs.flags }}
+          PATH_OVERRIDES: ${{ inputs.path_overrides }}
         working-directory: _canonical-openemr-devops/tools/release
-        run: |
-          # shellcheck disable=SC2086 # OVERRIDE_FLAGS is a flag list; word-split is intentional
-          php bin/check-vendored.php --consumer "$CONSUMER_PATH" $OVERRIDE_FLAGS
+        run: php bin/check-vendored.php --consumer "$CONSUMER_PATH" --overrides "$PATH_OVERRIDES"

…b/workflows/_test-vendored-contracts.yml …rkflows/vendored-contracts-self-test.yml.github/workflows/_test-vendored-contracts.yml renamed to .github/workflows/vendored-contracts-self-test.yml .github/workflows/_test-vendored-contracts.yml renamed to .github/workflows/vendored-contracts-self-test.yml

@@ -22,7 +22,7 @@ on:
   pull_request:
     paths:
       - '.github/workflows/check-vendored-contracts.yml'
-      - '.github/workflows/_test-vendored-contracts.yml'
+      - '.github/workflows/vendored-contracts-self-test.yml'
       - 'tools/release/bin/check-vendored.php'
       - 'tools/release/src/VendoredFileChecker.php'
       - 'tools/release/src/VendoredDriftIssue.php'

tools/release/bin/check-vendored.php

@@ -49,6 +49,14 @@
         'Map a canonical path to a different consumer-relative path '
             . '(e.g. --override src/TagVerifier.php=src/Release/TagVerifier.php). Repeatable.',
     )
+    ->addOption(
+        'overrides',
+        null,
+        InputOption::VALUE_REQUIRED,
+        'Same mapping as --override but as a single newline-delimited string '
+            . '(blank lines and surrounding whitespace ignored). Convenient for '
+            . 'CI inputs that arrive as multi-line strings. Combines with --override.',
+    )
     ->setCode(function (InputInterface $input, OutputInterface $output): int {
         $canonical = $input->getOption('canonical');
         if (!is_string($canonical) || $canonical === '') {
@@ -74,21 +82,35 @@
         if (!is_array($rawOverrides)) {
             $rawOverrides = [];
         }
+        $multiline = $input->getOption('overrides');
+        if (is_string($multiline) && $multiline !== '') {
+            $lines = preg_split('/\R/', $multiline);
+            if ($lines === false) {
+                $output->writeln('<error>--overrides could not be parsed</error>');
+                return 1;
+            }
+            foreach ($lines as $line) {
+                $trimmed = trim($line);
+                if ($trimmed !== '') {
+                    $rawOverrides[] = $trimmed;
+                }
+            }
+        }
         $overrides = [];
         foreach ($rawOverrides as $entry) {
             if (!is_string($entry) || !str_contains($entry, '=')) {
                 $output->writeln(sprintf(
-                    '<error>--override expects CANONICAL=CONSUMER, got: %s</error>',
+                    '<error>override entry expects CANONICAL=CONSUMER, got: %s</error>',
                     is_string($entry) ? $entry : gettype($entry),
                 ));
                 return 1;
             }
-            [$canon, $cons] = explode('=', $entry, 2);
-            if ($canon === '' || $cons === '') {
-                $output->writeln(sprintf('<error>--override has empty side: %s</error>', $entry));
+            [$canonicalPath, $consumerPath] = explode('=', $entry, 2);
+            if ($canonicalPath === '' || $consumerPath === '') {
+                $output->writeln(sprintf('<error>override entry has empty side: %s</error>', $entry));
                 return 1;
             }
-            $overrides[$canon] = $cons;
+            $overrides[$canonicalPath] = $consumerPath;
         }
 
         try {