feat: Optional 2FA #17669
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # To upgrade pinned actions: Use https://github.com/mheap/pin-github-action | |
| name: CI - Backend | |
| env: | |
| OS: &os ubuntu-24.04 | |
| TIMEOUT: &timeout 5 | |
| COVERAGE_PHP: "8.4" | |
| SHOULD_RUN: &should-run >- | |
| github.event_name == 'workflow_dispatch' || | |
| github.event_name == 'workflow_call' || | |
| github.repository == 'getkirby/kirby' || | |
| github.repository_owner != 'getkirby' | |
| on: | |
| # only the long-lived base branches run on push, so that their caches | |
| # are seeded for the pull requests targeting them; feature/fix branches | |
| # are covered by the pull_request event instead, which can restore caches | |
| # from its base branch and keeps the same commit from running twice | |
| push: | |
| branches: | |
| - "main" | |
| - "develop-patch" | |
| - "develop-minor" | |
| - "v*/develop" | |
| paths: &backend-paths | |
| - "**" | |
| - "!.github/**" | |
| - ".github/actions/setup-php/**" | |
| - ".github/workflows/backend.yml" | |
| - "!.tx/**" | |
| - "!.vscode/**" | |
| - "!assets/**" | |
| - "!panel/**" | |
| - "!scripts/**" | |
| pull_request: | |
| paths: *backend-paths | |
| workflow_call: | |
| workflow_dispatch: | |
| concurrency: | |
| group: backend-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # ======================== Unit Tests ======================== | |
| tests: | |
| name: "Unit Tests - PHP ${{ matrix.php }}" | |
| if: *should-run | |
| runs-on: *os | |
| timeout-minutes: *timeout | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| php: ["8.3", "8.4", "8.5"] | |
| services: | |
| redis: | |
| image: redis:7 | |
| ports: | |
| - 6379:6379 | |
| memcached: | |
| image: memcached:latest | |
| ports: | |
| - 11211:11211 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| fetch-depth: 2 | |
| - name: Install system locales and imagemagick | |
| uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3 | |
| with: | |
| packages: locales-all imagemagick | |
| version: 1 | |
| execute_install_scripts: true | |
| - name: Ensure ImageMagick aliases exist | |
| run: | | |
| if ! command -v convert > /dev/null; then | |
| sudo ln -sf /usr/bin/convert-im6.q16 /usr/bin/convert | |
| sudo ln -sf /usr/bin/identify-im6.q16 /usr/bin/identify | |
| fi | |
| convert -version | head -1 | |
| - name: Setup PHP environment | |
| uses: ./.github/actions/setup-php | |
| with: | |
| php: ${{ matrix.php }} | |
| ini: 'apc.enabled=1, apc.enable_cli=1, pcov.directory=., pcov.exclude="~(vendor|tests)~"' | |
| coverage: ${{ matrix.php == env.COVERAGE_PHP && 'pcov' || 'none' }} | |
| - name: Check Composer platform requirements | |
| run: composer check-platform-reqs | |
| - name: Cache PHPUnit results | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 | |
| with: | |
| path: ./.phpunit.cache | |
| key: phpunit-${{ matrix.php }}-${{ hashFiles('composer.lock') }} | |
| restore-keys: | | |
| phpunit-${{ matrix.php }}- | |
| phpunit- | |
| - name: Run PHPUnit tests | |
| if: matrix.php != env.COVERAGE_PHP | |
| run: composer run test -- --configuration phpunit.ci.xml --processes 4 | |
| - name: Run PHPUnit tests with coverage | |
| if: matrix.php == env.COVERAGE_PHP | |
| run: composer run test -- --configuration phpunit.ci.xml --processes 4 --coverage-clover ${{ github.workspace }}/clover.xml --exclude-source-from-xml-coverage | |
| - name: Upload coverage results to Codecov | |
| if: matrix.php == env.COVERAGE_PHP | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7 | |
| with: | |
| # for better reliability if the GitHub API is down | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| fail_ci_if_error: true | |
| files: ${{ github.workspace }}/clover.xml | |
| disable_search: true | |
| flags: backend | |
| env_vars: PHP | |
| env: | |
| PHP: ${{ matrix.php }} | |
| # ======================== Code Quality ======================== | |
| analysis: | |
| name: "Code Quality" | |
| if: *should-run | |
| runs-on: *os | |
| timeout-minutes: *timeout | |
| env: | |
| php: 8.3 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - name: Preparations | |
| run: mkdir -p sarif | |
| - name: Setup PHP environment | |
| uses: ./.github/actions/setup-php | |
| with: | |
| php: ${{ env.php }} | |
| tools: composer-normalize:2.52.0 | |
| - name: Setup problem matchers | |
| run: | | |
| echo "::add-matcher::${{ runner.tool_cache }}/php.json" | |
| echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json" | |
| - name: Cache Psalm analysis data | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 | |
| with: | |
| path: ~/.cache/psalm | |
| key: psalm-${{ env.php }}-${{ hashFiles('composer.lock') }} | |
| restore-keys: | | |
| psalm-${{ env.php }}- | |
| psalm- | |
| - name: Validate composer.json/composer.lock | |
| run: composer run analyze:composer | |
| - name: Ensure that composer.json is normalized | |
| env: | |
| GITHUB_TOKEN: "" | |
| run: composer-normalize --dry-run | |
| - name: Check for unused Composer dependencies | |
| run: composer run analyze:composer:unused | |
| - name: Statically analyze using Psalm | |
| id: psalm | |
| run: composer run analyze:psalm -- --output-format=github --php-version=${{ env.php }} --report=sarif/psalm.sarif --report-show-info=false --force-jit | |
| - name: Upload code scanning results to GitHub | |
| if: github.repository == 'getkirby/kirby' && steps.psalm.outcome == 'success' | |
| uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 | |
| with: | |
| sarif_file: sarif | |
| - name: Cache PHP-CS-Fixer data | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 | |
| with: | |
| path: ./.php-cs-fixer.cache | |
| key: php-cs-fixer-${{ hashFiles('.php-cs-fixer.dist.php') }} | |
| restore-keys: | | |
| php-cs-fixer- | |
| - name: Run PHP-CS-Fixer to catch PHP coding style violations | |
| run: composer run fix -- --diff --dry-run |