format-and-build.yml

name: format-and-build

on:
  push:
    branches:
      - 4.x

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  format-and-build:
    if: "${{ !startsWith(github.event.head_commit.message, 'chore: format and build') }}"
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout code
        # Uses a maintainer PAT so the auto-commit push can bypass branch protection;
        # the default GITHUB_TOKEN pushes as `github-actions[bot]` and gets rejected.
        # zizmor: ignore[artipacked]
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          token: ${{ secrets.GH_ACCESS_TOKEN || github.token }}
      - name: Cache Composer package downloads
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.composer/cache/files
          key: composer-files-${{ hashFiles('composer.json') }}
          restore-keys: |
            composer-files-
      - name: Cache vendor
        id: vendor-cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: vendor
          key: vendor-${{ runner.os }}-${{ hashFiles('composer.lock') }}
      - name: Cache node_modules
        id: node-modules-cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: node_modules
          key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
      - name: Cache Pint cache
        # SHA in primary key always saves a fresh cache. Restore-keys fall back only
        # within the same composer.lock hash so a composer update invalidates the cache.
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .pint.cache
          key: pint-${{ github.ref_name }}-${{ hashFiles('composer.lock') }}-${{ github.sha }}
          restore-keys: |
            pint-${{ github.ref_name }}-${{ hashFiles('composer.lock') }}-
      - name: Cache Prettier cache
        # Same pattern, keyed on package-lock.json so an npm install invalidates the cache.
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .prettiercache
          key: prettier-${{ github.ref_name }}-${{ hashFiles('package-lock.json') }}-${{ github.sha }}
          restore-keys: |
            prettier-${{ github.ref_name }}-${{ hashFiles('package-lock.json') }}-
      - name: Cache Rector cache
        # Same pattern as Pint; rector.php sets cacheDirectory to .rector.cache.
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .rector.cache
          key: rector-${{ github.ref_name }}-${{ hashFiles('composer.lock') }}-${{ github.sha }}
          restore-keys: |
            rector-${{ github.ref_name }}-${{ hashFiles('composer.lock') }}-
      - name: Set up PHP
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
        with:
          php-version: 8.5
      - name: Set up Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: lts/*
          cache: npm
      - name: Install Composer dependencies
        if: steps.vendor-cache.outputs.cache-hit != 'true'
        run: composer install --no-interaction --no-scripts
      - name: Install npm dependencies
        if: steps.node-modules-cache.outputs.cache-hit != 'true'
        run: npm ci --ignore-scripts
      - name: Run code style fixes
        run: composer cs
      - name: Build assets
        run: npm run build
      - name: Pull changes
        run: git pull --rebase --autostash
      - name: Commit changes
        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
        with:
          commit_message: 'chore: format and build'