backend.yml

# To upgrade pinned actions: Use https://github.com/mheap/pin-github-action

name: CI - Backend

env:
  OS: &os ubuntu-24.04
  TIMEOUT: &timeout 5
  COVERAGE_PHP: "8.4"

  SHOULD_RUN: &should-run >-
    github.event_name == 'workflow_dispatch' ||
    github.event_name == 'workflow_call' ||
    github.repository == 'getkirby/kirby' ||
    github.repository_owner != 'getkirby'

on:
  # only the long-lived base branches run on push, so that their caches
  # are seeded for the pull requests targeting them; feature/fix branches
  # are covered by the pull_request event instead, which can restore caches
  # from its base branch and keeps the same commit from running twice
  push:
    branches:
      - "main"
      - "develop-patch"
      - "develop-minor"
      - "v*/develop"
    paths: &backend-paths
      - "**"
      - "!.github/**"
      - ".github/actions/setup-php/**"
      - ".github/workflows/backend.yml"
      - "!.tx/**"
      - "!.vscode/**"
      - "!assets/**"
      - "!panel/**"
      - "!scripts/**"
  pull_request:
    paths: *backend-paths
  workflow_call:
  workflow_dispatch:

concurrency:
  group: backend-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ======================== Unit Tests ========================
  tests:
    name: "Unit Tests - PHP ${{ matrix.php }}"
    if: *should-run
    runs-on: *os
    timeout-minutes: *timeout
    strategy:
      fail-fast: true
      matrix:
        php: ["8.3", "8.4", "8.5"]

    services:
      redis:
        image: redis:7
        ports:
          - 6379:6379
      memcached:
        image: memcached:latest
        ports:
          - 11211:11211

    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          fetch-depth: 2

      - name: Install system locales and imagemagick
        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
        with:
          packages: locales-all imagemagick
          version: 1
          execute_install_scripts: true

      - name: Ensure ImageMagick aliases exist
        run: |
          if ! command -v convert > /dev/null; then
            sudo ln -sf /usr/bin/convert-im6.q16 /usr/bin/convert
            sudo ln -sf /usr/bin/identify-im6.q16 /usr/bin/identify
          fi
          convert -version | head -1

      - name: Setup PHP environment
        uses: ./.github/actions/setup-php
        with:
          php: ${{ matrix.php }}
          ini: 'apc.enabled=1, apc.enable_cli=1, pcov.directory=., pcov.exclude="~(vendor|tests)~"'
          coverage: ${{ matrix.php == env.COVERAGE_PHP && 'pcov' || 'none' }}

      - name: Check Composer platform requirements
        run: composer check-platform-reqs

      - name: Cache PHPUnit results
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ./.phpunit.cache
          key: phpunit-${{ matrix.php }}-${{ hashFiles('composer.lock') }}
          restore-keys: |
            phpunit-${{ matrix.php }}-
            phpunit-

      - name: Run PHPUnit tests
        if: matrix.php != env.COVERAGE_PHP
        run: composer run test -- --configuration phpunit.ci.xml --processes 4

      - name: Run PHPUnit tests with coverage
        if: matrix.php == env.COVERAGE_PHP
        run: composer run test -- --configuration phpunit.ci.xml --processes 4 --coverage-clover ${{ github.workspace }}/clover.xml --exclude-source-from-xml-coverage

      - name: Upload coverage results to Codecov
        if: matrix.php == env.COVERAGE_PHP
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
        with:
          # for better reliability if the GitHub API is down
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: true
          files: ${{ github.workspace }}/clover.xml
          disable_search: true
          flags: backend
          env_vars: PHP
        env:
          PHP: ${{ matrix.php }}

  # ======================== Code Quality ========================
  analysis:
    name: "Code Quality"
    if: *should-run
    runs-on: *os
    timeout-minutes: *timeout
    env:
      php: 8.3

    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Preparations
        run: mkdir -p sarif

      - name: Setup PHP environment
        uses: ./.github/actions/setup-php
        with:
          php: ${{ env.php }}
          tools: composer-normalize:2.52.0

      - name: Setup problem matchers
        run: |
          echo "::add-matcher::${{ runner.tool_cache }}/php.json"
          echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"

      - name: Cache Psalm analysis data
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ~/.cache/psalm
          key: psalm-${{ env.php }}-${{ hashFiles('composer.lock') }}
          restore-keys: |
            psalm-${{ env.php }}-
            psalm-

      - name: Validate composer.json/composer.lock
        run: composer run analyze:composer

      - name: Ensure that composer.json is normalized
        env:
          GITHUB_TOKEN: ""
        run: composer-normalize --dry-run

      - name: Check for unused Composer dependencies
        run: composer run analyze:composer:unused

      - name: Statically analyze using Psalm
        id: psalm
        run: composer run analyze:psalm -- --output-format=github --php-version=${{ env.php }} --report=sarif/psalm.sarif --report-show-info=false --force-jit

      - name: Upload code scanning results to GitHub
        if: github.repository == 'getkirby/kirby' && steps.psalm.outcome == 'success'
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
        with:
          sarif_file: sarif

      - name: Cache PHP-CS-Fixer data
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ./.php-cs-fixer.cache
          key: php-cs-fixer-${{ hashFiles('.php-cs-fixer.dist.php') }}
          restore-keys: |
            php-cs-fixer-

      - name: Run PHP-CS-Fixer to catch PHP coding style violations
        run: composer run fix -- --diff --dry-run