issue-bot.yml

# https://help.github.com/en/categories/automating-your-workflow-with-github-actions

name: "Issue bot"

on:
  workflow_dispatch:
  pull_request:
    paths-ignore:
      - 'compiler/**'
      - 'apigen/**'
      - 'changelog-generator/**'
  push:
    branches:
      - "2.2.x"
    paths-ignore:
      - 'compiler/**'
      - 'apigen/**'
      - 'changelog-generator/**'

concurrency:
  group: run-issue-bot-${{ github.head_ref || github.run_id }} # will be canceled on subsequent pushes in pull requests but not branches
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  pr-comment-init:
    name: "Init PR comment (if exists)"
    if: github.event_name == 'pull_request'
    runs-on: "ubuntu-latest"
    permissions:
      pull-requests: write

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit

      - name: "Find existing PR comment"
        id: find-comment
        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0
        with:
          issue-number: ${{ github.event.pull_request.number }}
          body-includes: "<!-- phpstan-issue-bot -->"

      - name: "Mark comment as running"
        if: steps.find-comment.outputs.comment-id != ''
        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
        with:
          comment-id: ${{ steps.find-comment.outputs.comment-id }}
          edit-mode: replace
          body: |
            <!-- phpstan-issue-bot -->

            :hourglass_flowing_sand: A new issue bot run is in progress: [view job](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).

            This comment will be updated with the latest results when the run completes.

  download:
    name: "Download data"

    runs-on: "ubuntu-latest"

    outputs:
      matrix: ${{ steps.shards.outputs.shards }}

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: "Install PHP"
        uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
        with:
          coverage: "none"
          php-version: "8.5"

      - name: "Install issue-bot dependencies"
        uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
        with:
          working-directory: "issue-bot"

      - name: "Cache downloads"
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: ./issue-bot/tmp
          key: "issue-bot-download-v8-${{ github.run_id }}"
          restore-keys: |
            issue-bot-download-v8-

      - name: "Download data"
        working-directory: "issue-bot"
        env:
          GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
        run: ./console.php download > matrix.json

      - name: "Output shards"
        id: shards
        working-directory: "issue-bot"
        run: |
          echo "shards=$(jq -c '{include: [range(length) | {shard: .}]}' matrix.json)" >> "$GITHUB_OUTPUT"

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: playground-cache
          path: issue-bot/tmp/playgroundCache.tmp

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: issue-cache
          path: issue-bot/tmp/issueCache.tmp

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: matrix
          path: issue-bot/matrix.json

  analyse:
    name: "Analyse"
    needs: download

    runs-on: "ubuntu-latest"

    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.download.outputs.matrix) }}

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: "Install PHP"
        uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
        with:
          coverage: "none"
          php-version: "8.5"

      - uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
        with:
          composer-options: "--no-dev"

      - name: "Install issue-bot dependencies"
        uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
        with:
          working-directory: "issue-bot"

      - uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0
        with:
          action: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
          with: |
            name: playground-cache
            path: issue-bot/tmp
          attempt_limit: 5
          attempt_delay: 1000

      - uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0
        with:
          action: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
          with: |
            name: matrix
            path: issue-bot
          attempt_limit: 5
          attempt_delay: 1000

      - name: "Extract shard"
        working-directory: "issue-bot"
        id: chunk
        run: |
          echo "phpVersion=$(jq -r '.[${{ matrix.shard }}].phpVersion' matrix.json)" >> "$GITHUB_OUTPUT"
          echo "playgroundExamples=$(jq -r '.[${{ matrix.shard }}].playgroundExamples' matrix.json)" >> "$GITHUB_OUTPUT"
          echo "chunkNumber=$(jq -r '.[${{ matrix.shard }}].chunkNumber' matrix.json)" >> "$GITHUB_OUTPUT"

      - name: "Run PHPStan"
        working-directory: "issue-bot"
        timeout-minutes: 5
        run: ./console.php run ${{ steps.chunk.outputs.phpVersion }} ${{ steps.chunk.outputs.playgroundExamples }}

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: results-${{ steps.chunk.outputs.phpVersion }}-${{ steps.chunk.outputs.chunkNumber }}
          path: issue-bot/tmp/results-${{ steps.chunk.outputs.phpVersion }}-*.tmp

  evaluate:
    name: "Evaluate results"
    needs: analyse

    runs-on: "ubuntu-latest"

    outputs:
      pr-evaluate-exit-code: ${{ steps.evaluate-pr.outputs.exit_code }}

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: "Install PHP"
        uses: "shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1" # v2
        with:
          coverage: "none"
          php-version: "8.5"

      - name: "Install issue-bot dependencies"
        uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # v3
        with:
          working-directory: "issue-bot"

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: playground-cache
          path: issue-bot/tmp

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: issue-cache
          path: issue-bot/tmp

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          pattern: results-*
          merge-multiple: true
          path: issue-bot/tmp

      - name: "List tmp"
        run: "ls -lA issue-bot/tmp"

      - name: "Evaluate results - pull request"
        id: evaluate-pr
        working-directory: "issue-bot"
        if: github.event_name == 'pull_request'
        env:
          GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set +e
          ./console.php evaluate > tmp/step-summary.md
          exit_code="$?"

          cat tmp/step-summary.md >> "$GITHUB_STEP_SUMMARY"

          job_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          {
            echo "<!-- phpstan-issue-bot -->"
            echo
            if [[ "$exit_code" == "2" ]]; then
              echo "Issue bot detected changes — [view run]($job_url):"
              echo
              cat tmp/step-summary.md
            else
              echo ":white_check_mark: No changes detected by issue bot in the [latest run]($job_url)."
            fi
          } > tmp/pr-comment.md

          echo "exit_code=$exit_code" >> "$GITHUB_OUTPUT"

          if [[ "$exit_code" == "2" ]]; then
            echo "::notice file=.github/workflows/issue-bot.yml,line=3 ::Issue bot detected open issues which are affected by this pull request - see $job_url"
          fi

          # Always exit 0 for the PR pathway so the pr-comment-finalize job still receives outputs/artifacts.
          exit 0

      - name: "Upload step summary"
        if: github.event_name == 'pull_request'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: step-summary
          path: issue-bot/tmp/step-summary.md

      - name: "Upload PR comment body"
        if: github.event_name == 'pull_request'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: pr-comment
          path: issue-bot/tmp/pr-comment.md

      - name: "Evaluate results - push"
        working-directory: "issue-bot"
        if: "github.repository_owner == 'phpstan' && github.ref == 'refs/heads/2.2.x'"
        env:
          GITHUB_PAT: ${{ secrets.PHPSTAN_BOT_TOKEN }}
          PHPSTAN_SRC_COMMIT_BEFORE: ${{ github.event.before }}
          PHPSTAN_SRC_COMMIT_AFTER: ${{ github.event.after }}
        run: |
          set +e
          ./console.php evaluate --post-comments >> "$GITHUB_STEP_SUMMARY"
          exit_code="$?"

          # its fine when issue-bot found affected issues
          if [[ "$exit_code" == "2" ]]; then
            exit 0
          fi

          exit $exit_code

  pr-comment-finalize:
    name: "Post/update PR comment"
    needs: evaluate
    if: github.event_name == 'pull_request' && needs.evaluate.result == 'success'
    runs-on: "ubuntu-latest"
    permissions:
      pull-requests: write

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit

      - name: "Download PR comment body"
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: pr-comment

      - name: "Find PR comment"
        id: find-comment
        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0
        with:
          issue-number: ${{ github.event.pull_request.number }}
          body-includes: "<!-- phpstan-issue-bot -->"

      - name: "Post/update PR comment (changes)"
        if: needs.evaluate.outputs.pr-evaluate-exit-code == '2'
        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
        with:
          comment-id: ${{ steps.find-comment.outputs.comment-id }}
          issue-number: ${{ github.event.pull_request.number }}
          edit-mode: replace
          body-path: pr-comment.md

      - name: "Update PR comment (no changes, only if exists)"
        if: needs.evaluate.outputs.pr-evaluate-exit-code == '0' && steps.find-comment.outputs.comment-id != ''
        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
        with:
          comment-id: ${{ steps.find-comment.outputs.comment-id }}
          edit-mode: replace
          body-path: pr-comment.md