Harden GitHub workflows

.github/workflows/bc.yml

@@ -3,13 +3,12 @@ on:
   push:
 
 name: backwards compatibility
+
+permissions:
+  contents: read
+
 jobs:
   roave_bc_check:
-    name: Roave BC Check
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@master
-      - name: fetch tags
-        run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
-      - name: Roave BC Check
-        uses: docker://nyholm/roave-bc-check-ga
+    uses: yiisoft/actions/.github/workflows/bc.yml@master
+    with:
+      php: '["8.4"]'

.github/workflows/build.yml

@@ -21,65 +21,22 @@ on:
 
 name: build
 
+permissions:
+  contents: read
+
 jobs:
   tests:
-    name: PHP ${{ matrix.php }}-redis-${{ matrix.redis }}
-
-    env:
-      key: cache-v1
-
-    runs-on: ${{ matrix.os }}
+    name: Redis ${{ matrix.redis }}
+    uses: yiisoft/actions/.github/workflows/phpunit.yml@master
 
     strategy:
       matrix:
-        os:
-          - ubuntu-latest
-
-        php:
-          - 7.4
-          - 8.0
-          - 8.1
-
         redis:
           - 4
           - 5
           - 6
 
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Start Redis v${{ matrix.redis }}
-        uses: superchargejs/redis-github-action@1.8.1
-        with:
-          redis-version: ${{ matrix.redis }}
-
-      - name: Install PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php }}
-          extensions: ${{ env.extensions }}
-          ini-values: date.timezone='UTC'
-          coverage: pcov
-          tools: composer:v2
-
-      - name: Determine composer cache directory on Linux
-        if: matrix.os == 'ubuntu-latest'
-        run: echo "COMPOSER_CACHE_DIR=$(composer config cache-dir)" >> $GITHUB_ENV
-
-      - name: Cache dependencies installed with composer
-        uses: actions/cache@v6
-        with:
-          path: ${{ env.COMPOSER_CACHE_DIR }}
-          key: php${{ matrix.php }}-composer-${{ hashFiles('**/composer.json') }}
-          restore-keys: |
-            php${{ matrix.php }}-composer-
-
-      - name: Update composer
-        run: composer self-update
-
-      - name: Install dependencies with composer
-        run: composer update --prefer-dist --no-interaction --no-progress --optimize-autoloader --ansi
-
-      - name: Run tests with phpunit
-        run: vendor/bin/phpunit --colors=always
+    with:
+      os: '["ubuntu-latest"]'
+      php: '["7.4", "8.0", "8.1"]'
+      phpunitConfig: phpunit.redis-${{ matrix.redis }}.xml.dist

.github/workflows/mutation.yml

@@ -19,56 +19,17 @@ on:
 
 name: mutation test
 
+permissions:
+  contents: read
+
 jobs:
   mutation:
-    name: PHP ${{ matrix.php }}-${{ matrix.os }}
-
-    runs-on: ${{ matrix.os }}
-
-    strategy:
-      matrix:
-        os:
-          - ubuntu-latest
-
-        php:
-          - 8.1
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Start Redis v6
-        uses: superchargejs/redis-github-action@1.8.1
-        with:
-          redis-version: 6
-
-      - name: Install PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php }}
-          ini-values: memory_limit=-1
-          coverage: pcov
-          tools: composer:v2
-
-      - name: Determine composer cache directory
-        run: echo "COMPOSER_CACHE_DIR=$(composer config cache-dir)" >> $GITHUB_ENV
-
-      - name: Cache dependencies installed with composer
-        uses: actions/cache@v6
-        with:
-          path: ${{ env.COMPOSER_CACHE_DIR }}
-          key: php${{ matrix.php }}-composer-${{ hashFiles('**/composer.json') }}
-          restore-keys: |
-            php${{ matrix.php }}-composer-
-
-      - name: Update composer
-        run: composer self-update
-
-      - name: Install dependencies with composer
-        run: composer update --prefer-dist --no-interaction --no-progress --optimize-autoloader --ansi
-
-      - name: Run infection
-        run: |
-          vendor/bin/roave-infection-static-analysis-plugin -j2 --ignore-msi-with-no-mutations --only-covered
-        env:
-          STRYKER_DASHBOARD_API_KEY: ${{ secrets.STRYKER_DASHBOARD_API_KEY }}
+    uses: yiisoft/actions/.github/workflows/roave-infection.yml@master
+    with:
+      bin-name: ../../bin/roave-infection-with-redis
+      ini-values: memory_limit=-1
+      os: '["ubuntu-latest"]'
+      php: '["8.1"]'
+      threads: '2'
+    secrets:
+      STRYKER_DASHBOARD_API_KEY: ${{ secrets.STRYKER_DASHBOARD_API_KEY }}

.github/workflows/static.yml

@@ -21,49 +21,12 @@ on:
 
 name: static analysis
 
-jobs:
-  mutation:
-    name: PHP ${{ matrix.php }}-${{ matrix.os }}
-
-    runs-on: ${{ matrix.os }}
-
-    strategy:
-      matrix:
-        os:
-          - ubuntu-latest
-
-        php:
-          - 7.4
-          - 8.0
-          - 8.1
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Install PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php }}
-          tools: composer:v2, cs2pr
-          coverage: none
+permissions:
+  contents: read
 
-      - name: Determine composer cache directory
-        run: echo "COMPOSER_CACHE_DIR=$(composer config cache-dir)" >> $GITHUB_ENV
-
-      - name: Cache dependencies installed with composer
-        uses: actions/cache@v6
-        with:
-          path: ${{ env.COMPOSER_CACHE_DIR }}
-          key: php${{ matrix.php }}-composer-${{ hashFiles('**/composer.json') }}
-          restore-keys: |
-            php${{ matrix.php }}-composer-
-
-      - name: Update composer
-        run: composer self-update
-
-      - name: Install dependencies with composer
-        run: composer update --prefer-dist --no-interaction --no-progress --optimize-autoloader --ansi
-
-      - name: Static analysis
-        run: vendor/bin/psalm --shepherd --stats --output-format=checkstyle | cs2pr --graceful-warnings --colorize
+jobs:
+  psalm:
+    uses: yiisoft/actions/.github/workflows/psalm.yml@master
+    with:
+      os: '["ubuntu-latest"]'
+      php: '["7.4", "8.0", "8.1"]'

.github/workflows/zizmor.yml

@@ -0,0 +1,22 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches:
+      - master
+      - main
+    paths:
+      - '.github/**.yml'
+      - '.github/**.yaml'
+  pull_request:
+    paths:
+      - '.github/**.yml'
+      - '.github/**.yaml'
+
+permissions:
+  actions: read # Required by zizmor when reading workflow metadata through the API.
+  contents: read # Required to read workflow files.
+
+jobs:
+  zizmor:
+    uses: yiisoft/actions/.github/workflows/zizmor.yml@master

bin/roave-infection-with-redis

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+redis_version="${REDIS_VERSION:-6}"
+
+case "${redis_version}" in
+  4|5|6) ;;
+  *)
+    echo "Unsupported Redis version: ${redis_version}" >&2
+    exit 1
+    ;;
+esac
+
+if ! timeout 1 bash -c '</dev/tcp/127.0.0.1/6379' 2>/dev/null; then
+  docker run --rm --detach --publish 6379:6379 "redis:${redis_version}" >/dev/null
+
+  for _ in {1..60}; do
+    if timeout 1 bash -c '</dev/tcp/127.0.0.1/6379' 2>/dev/null; then
+      break
+    fi
+
+    sleep 0.5
+  done
+fi
+
+if ! timeout 1 bash -c '</dev/tcp/127.0.0.1/6379' 2>/dev/null; then
+  echo 'Redis did not become available on 127.0.0.1:6379.' >&2
+  exit 1
+fi
+
+exec vendor/bin/roave-infection-static-analysis-plugin "$@" --only-covered

composer.json

@@ -36,7 +36,7 @@
         "phpunit/phpunit": "^9.5",
         "roave/infection-static-analysis-plugin": "^1.16",
         "spatie/phpunit-watcher": "^1.23",
-        "vimeo/psalm": "^5.8"
+        "vimeo/psalm": "^4.30|^5.8|^6.16"
     },
     "autoload": {
         "psr-4": {

phpunit.redis-4.xml.dist

@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<phpunit
+    bootstrap="tests/bootstrap.php"
+    colors="true"
+    verbose="true"
+    failOnRisky="true"
+    failOnWarning="true"
+    convertErrorsToExceptions="true"
+    convertNoticesToExceptions="true"
+    convertWarningsToExceptions="true"
+    stopOnFailure="false"
+    executionOrder="random"
+    resolveDependencies="true"
+>
+    <php>
+        <ini name="error_reporting" value="-1"/>
+        <env name="REDIS_VERSION" value="4"/>
+    </php>
+
+    <testsuites>
+        <testsuite name="Yii Redis Mutex tests">
+            <directory>./tests</directory>
+        </testsuite>
+    </testsuites>
+
+    <coverage>
+        <include>
+            <directory>./src</directory>
+        </include>
+    </coverage>
+</phpunit>

phpunit.redis-5.xml.dist

@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<phpunit
+    bootstrap="tests/bootstrap.php"
+    colors="true"
+    verbose="true"
+    failOnRisky="true"
+    failOnWarning="true"
+    convertErrorsToExceptions="true"
+    convertNoticesToExceptions="true"
+    convertWarningsToExceptions="true"
+    stopOnFailure="false"
+    executionOrder="random"
+    resolveDependencies="true"
+>
+    <php>
+        <ini name="error_reporting" value="-1"/>
+        <env name="REDIS_VERSION" value="5"/>
+    </php>
+
+    <testsuites>
+        <testsuite name="Yii Redis Mutex tests">
+            <directory>./tests</directory>
+        </testsuite>
+    </testsuites>
+
+    <coverage>
+        <include>
+            <directory>./src</directory>
+        </include>
+    </coverage>
+</phpunit>

phpunit.redis-6.xml.dist

@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<phpunit
+    bootstrap="tests/bootstrap.php"
+    colors="true"
+    verbose="true"
+    failOnRisky="true"
+    failOnWarning="true"
+    convertErrorsToExceptions="true"
+    convertNoticesToExceptions="true"
+    convertWarningsToExceptions="true"
+    stopOnFailure="false"
+    executionOrder="random"
+    resolveDependencies="true"
+>
+    <php>
+        <ini name="error_reporting" value="-1"/>
+        <env name="REDIS_VERSION" value="6"/>
+    </php>
+
+    <testsuites>
+        <testsuite name="Yii Redis Mutex tests">
+            <directory>./tests</directory>
+        </testsuite>
+    </testsuites>
+
+    <coverage>
+        <include>
+            <directory>./src</directory>
+        </include>
+    </coverage>
+</phpunit>

phpunit.xml.dist

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <phpunit
-    bootstrap="vendor/autoload.php"
+    bootstrap="tests/bootstrap.php"
     colors="true"
     verbose="true"
     failOnRisky="true"
@@ -14,6 +14,7 @@
 >
     <php>
         <ini name="error_reporting" value="-1"/>
+        <env name="REDIS_VERSION" value="6"/>
     </php>
 
     <testsuites>