chore(deps): update phpstan/phpstan requirement from ^1.10 to ^1.10 || ^2.0

.gitea/workflows/ci.yml

@@ -0,0 +1,48 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      # Stage 1 — PHP syntax check
+      # Uses kanboard/kanboard image with entrypoint override (default entrypoint
+      # starts Apache and runs forever; we override to /bin/sh for one-shot use).
+      - name: Lint — PHP syntax check
+        run: bash scripts/docker-lint.sh
+
+      # Stage 2 — Install Composer dependencies
+      # vendor/ is not committed (.gitignore); install it here so the remaining
+      # stages can find vendor/bin/phpcs, vendor/bin/phpstan, vendor/bin/phpunit.
+      - name: Install Composer dependencies
+        run: |
+          docker run --rm \
+            -v "$PWD":/app \
+            composer:2 \
+            install --no-interaction --prefer-dist --no-progress
+
+      # Stage 3 — PSR-12 code style check
+      - name: PHPCS — PSR-12 style check
+        run: bash scripts/docker-phpcs.sh
+
+      # Stage 4 — Static analysis (PHPStan level 5)
+      # Uses php:8.4-cli — kanboard/kanboard lacks the tokenizer extension
+      # required by PHPStan.
+      - name: PHPStan — static analysis
+        run: bash scripts/docker-phpstan.sh
+
+      # Stage 5 — Unit tests
+      # Uses php:8.4-cli for the same reason as PHPStan above.
+      - name: PHPUnit — unit tests
+        run: bash scripts/docker-test.sh

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+
+updates:
+  # Keep GitHub Actions pinned SHAs up to date.
+  # Dependabot will open PRs to bump the SHA comments and the hash itself
+  # whenever a new release of a used action is published.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "chore(ci)"
+
+  # Keep Composer dev dependencies (phpunit, phpstan) up to date.
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "chore(deps)"

.github/workflows/ci.yml

@@ -0,0 +1,48 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+
+      # Stage 1 — PHP syntax check
+      # Uses kanboard/kanboard image with entrypoint override (default entrypoint
+      # starts Apache and runs forever; we override to /bin/sh for one-shot use).
+      - name: Lint — PHP syntax check
+        run: bash scripts/docker-lint.sh
+
+      # Stage 2 — Install Composer dependencies
+      # vendor/ is not committed (.gitignore); install it here so the remaining
+      # stages can find vendor/bin/phpcs, vendor/bin/phpstan, vendor/bin/phpunit.
+      - name: Install Composer dependencies
+        run: |
+          docker run --rm \
+            -v "$PWD":/app \
+            composer:2 \
+            install --no-interaction --prefer-dist --no-progress
+
+      # Stage 3 — PSR-12 code style check
+      - name: PHPCS — PSR-12 style check
+        run: bash scripts/docker-phpcs.sh
+
+      # Stage 4 — Static analysis (PHPStan level 5)
+      # Uses php:8.4-cli — kanboard/kanboard lacks the tokenizer extension
+      # required by PHPStan.
+      - name: PHPStan — static analysis
+        run: bash scripts/docker-phpstan.sh
+
+      # Stage 5 — Unit tests
+      # Uses php:8.4-cli for the same reason as PHPStan above.
+      - name: PHPUnit — unit tests
+        run: bash scripts/docker-test.sh

.github/workflows/codeql.yml

@@ -0,0 +1,37 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    # Weekly scan every Monday at 03:00 UTC, independent of push activity.
+    - cron: '0 3 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze (PHP)
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5c8a8a642e79153f5d047b10ec1cba1d1cc65699  # v3.35.1
+        with:
+          languages: php
+          # Use the security-extended suite for broader PHP vulnerability coverage
+          # (SQL injection, path traversal, XSS, SSRF, etc.)
+          queries: security-extended
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@5c8a8a642e79153f5d047b10ec1cba1d1cc65699  # v3.35.1
+        with:
+          category: "/language:php"

.github/workflows/release.yml

@@ -0,0 +1,65 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+-*'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+
+      - name: Extract version from tag
+        id: version
+        run: |
+          VERSION=${GITHUB_REF_NAME#v}
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          # Mark as prerelease if version contains a hyphen (e.g. 0.3.0-rc.1)
+          if [[ "$VERSION" == *-* ]]; then
+            echo "prerelease=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "prerelease=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Build a distributable plugin ZIP.
+      # Kanboard's plugin installer expects a ZIP containing a single root
+      # directory named exactly after the plugin class: AssignColorsByDayOfWeek.
+      # This plugin has no production Composer dependencies (require-dev only),
+      # so vendor/ is intentionally excluded from the archive.
+      - name: Build plugin archive
+        run: |
+          ARCHIVE="AssignColorsByDayOfWeek-${{ steps.version.outputs.version }}.zip"
+          PLUGIN_DIR="AssignColorsByDayOfWeek"
+
+          mkdir -p "dist/$PLUGIN_DIR"
+          cp -r Action "dist/$PLUGIN_DIR/"
+          cp Plugin.php LICENSE README.md CHANGELOG.md composer.json "dist/$PLUGIN_DIR/"
+
+          cd dist
+          zip -r "../$ARCHIVE" "$PLUGIN_DIR/"
+          cd ..
+
+          echo "ARCHIVE=$ARCHIVE" >> "$GITHUB_ENV"
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          PRERELEASE_FLAG=""
+          if [ "${{ steps.version.outputs.prerelease }}" = "true" ]; then
+            PRERELEASE_FLAG="--prerelease"
+          fi
+
+          gh release create "${{ github.ref_name }}" \
+            --title "${{ github.ref_name }}" \
+            --generate-notes \
+            $PRERELEASE_FLAG \
+            "$ARCHIVE"

.gitignore

@@ -0,0 +1,15 @@
+# Composer dependencies — install with: docker run --rm -v "$PWD:/app" composer:2 install
+/vendor/
+
+# Composer lock file — intentionally not committed for a library/plugin
+# (consumers pin their own dependency versions)
+/composer.lock
+
+# PHPStan result cache
+/.phpstan.result.cache
+/.phpstan-cache/
+
+# PHPUnit result cache and coverage reports
+/.phpunit.result.cache
+/.phpunit.cache/
+/coverage/

.ralphi/.last-branch

@@ -0,0 +1 @@
+ralph/gap-analysis-remediation

.ralphi/config.yaml

@@ -0,0 +1,42 @@
+# ralphi configuration
+# Auto-generated — edit as needed
+
+project:
+  name: "plugin-auto-action-assign-colors-by-day-of-week"
+  description: "A Kanboard plugin that automatically assigns task card colors based on the day of the week of the task's due date, triggered at task creation."
+  language: "PHP"
+  framework: "Kanboard Plugin"
+
+commands:
+  lint:    "bash scripts/docker-lint.sh"
+  test:    "bash scripts/docker-test.sh"
+  phpcs:   "bash scripts/docker-phpcs.sh"
+  phpstan: "bash scripts/docker-phpstan.sh"
+  # build: n/a — PHP plugin loaded directly by Kanboard
+  # typecheck: n/a — covered by phpstan
+
+rules:
+  # ── Docker ────────────────────────────────────────────────────────────────
+  - "WHEN running any command in the kanboard/kanboard Docker image you MUST override the entrypoint — the default entrypoint starts Apache and runs forever. Always use: docker run --rm --entrypoint /bin/sh kanboard/kanboard -c \"<cmd>\""
+
+  # ── Kanboard plugin API ───────────────────────────────────────────────────
+  - "use $this->getParam('Monday') (and other day names) to read action parameters — NEVER query action_has_params directly; ActionManager already populates $this->params for each action instance before execute() is called"
+  - "use $this->getProjectId() to retrieve the action's configured project — do not pass project_id through helper methods"
+  - "all database queries must use PicoDb query builder or PDO prepared statements — no raw SQL string interpolation"
+  - "all user-visible strings wrapped in t('...') for localization"
+  - "follow PSR-12 coding standard — 4-space indentation for PHP, no mixed tabs and spaces"
+
+  # ── Action lifecycle ──────────────────────────────────────────────────────
+  - "hasRequiredCondition() must guard ALL failure paths before doAction() is called — doAction() should be unconditional given a passing condition"
+  - "parameter keys in getActionRequiredParameters() and parameter lookups in doAction()/helpers must use the same key strategy (either fixed English strings OR t() applied consistently to both sides)"
+
+  # ── Known gaps (see docs/tasks/001-gap-analysis.md) ──────────────────────
+  - "BEFORE ANY CODING WORK each iteration: read docs/tasks/001-gap-analysis.md — it contains the prioritized gap list and maps each gap to concrete tasks"
+
+boundaries:
+  never_touch:
+    - "*.lock"
+    - ".env*"
+
+engine: "pi"
+max_retries: 3