This repository was archived by the owner on Aug 21, 2026. It is now read-only.
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughDie PR migriert mehrere GitHub Actions zu wiederverwendbaren Workflows, erweitert Workflow-Berechtigungen und Status-Job-Logik, passt Dependabot-Ignore-Regeln an, erweitert Composer-Constraints und Dev-Tools sowie ergänzt einen PHPStan SARIF-Error-Formatter. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Dependency ReviewThe following issues were found:
Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. License Issuescomposer.json
OpenSSF Scorecard
Scanned Files
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
.github/workflows/continuous-integration.yml (1)
23-26: Alle wiederverwendbaren Workflows auf feste Commit-SHAs pinnen statt auf Tags.Alle
@8.3-Referenzen sind bewegliche Tags. Damit ist die CI nicht vollständig reproduzierbar, und Änderungen im Fremd-Repository wirken sofort in diesen Pflichtpfad hinein. GitHub empfiehlt füruses:das Pinnen auf einen vollständigen Commit‑SHA – das ist die sicherste und unveränderliche Referenz.Betroffen: Zeilen 26, 34, 52, 73, 90
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/continuous-integration.yml around lines 23 - 26, The workflow references reusable workflows with movable tags (e.g., uses: "mimmi20/ci/.github/workflows/validate-all.yml@8.3"); replace each tagged reference with the corresponding full commit SHA for that repository (e.g., uses: "mimmi20/ci/.github/workflows/validate-all.yml@<full-commit-sha>") for all occurrences (the shown uses: entries and the other uses: lines called out in the comment) so the CI is pinned to immutable commits; locate and update the uses: strings in the workflow file to the exact commit SHAs.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/continuous-integration.yml:
- Around line 34-43: The CI workflow currently sets skip-validate-composer: true
which disables the validate-composer job in validate-php.yml and silences
composer validate; change the setting skip-validate-composer to false so the
validate-composer job runs (ensure the entry under the uses:
"mimmi20/ci/.github/workflows/validate-php.yml@8.3" block is updated), and
verify there are no other flags (e.g., skip-check-composer) unintentionally
preventing composer validate from executing alongside validate-all.yml@8.3.
In @.github/workflows/labels.yml:
- Around line 22-25: The reusable workflow is pinned to a movable tag
("mimmi20/ci/.github/workflows/sync-labels.yml@8.3"); replace the tag with the
exact full commit SHA to make the reference immutable. Update the uses entry
that currently reads uses: "mimmi20/ci/.github/workflows/sync-labels.yml@8.3" to
use the repository’s full commit SHA (found via the upstream repo’s commits page
or git ls-remote) so it becomes uses:
"mimmi20/ci/.github/workflows/sync-labels.yml@<full-commit-sha>" and commit that
change.
In @.github/workflows/release-drafter.yml:
- Line 34: Die externe reusable-Workflow-Referenz uses:
"mimmi20/ci/.github/workflows/draft-release.yml@8.3" verwendet ein bewegliches
Tag; ersetze das Tag (`@8.3`) durch die vollständige Commit-SHA des entsprechenden
commit im mimmi20/ci-Repo (z. B. uses:
"mimmi20/ci/.github/workflows/draft-release.yml@<full-commit-sha>") und
wiederhole diese Änderung konsistent für alle ähnlichen Einträge (z. B. in
continuous-integration.yml, reactions.yml, lint-workflow-files.yml), sodass jede
uses-Zeile auf ein unveränderliches Commit-SHA zeigt.
In `@composer.json`:
- Line 36: Add the new dev dependency jbelien/phpstan-sarif-formatter to the
analyzer ignore list by updating the composer-dependency-analyser.php
configuration: call the existing ignoreErrorsOnPackage helper for
'jbelien/phpstan-sarif-formatter' with ErrorType::UNUSED_DEPENDENCY (matching
how other tool deps like phpstan/extension-installer are added) so the
composer-dependency-analyser no longer flags it as unused. Ensure you use the
same method signature and placement as the other tool-dependencies in
composer-dependency-analyser.php.
---
Nitpick comments:
In @.github/workflows/continuous-integration.yml:
- Around line 23-26: The workflow references reusable workflows with movable
tags (e.g., uses: "mimmi20/ci/.github/workflows/validate-all.yml@8.3"); replace
each tagged reference with the corresponding full commit SHA for that repository
(e.g., uses: "mimmi20/ci/.github/workflows/validate-all.yml@<full-commit-sha>")
for all occurrences (the shown uses: entries and the other uses: lines called
out in the comment) so the CI is pinned to immutable commits; locate and update
the uses: strings in the workflow file to the exact commit SHAs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 623f6907-03aa-4ee1-bc49-3470e1aa9a45
📒 Files selected for processing (11)
.github/dependabot.yml.github/workflows/cleanup-caches.yml.github/workflows/continuous-integration.yml.github/workflows/dependency-review.yml.github/workflows/labels.yml.github/workflows/lint-workflow-files.yml.github/workflows/lock-closed-issues.yml.github/workflows/reactions.yml.github/workflows/release-drafter.ymlcomposer.jsonphpstan.neon
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #306 +/- ##
===========================================
Coverage 100.00% 100.00%
Complexity 23 23
===========================================
Files 4 4
Lines 81 81
===========================================
Hits 81 81
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@composer.json`:
- Line 23: Die QA-Konfigurationen sind noch auf PHP 8.3 begrenzt: in
phpstan.neon die Einstellung phpVersion ist auf 80300 gesetzt und in rector.php
wird LevelSetList::UP_TO_PHP_83 verwendet; ändere phpstan.neon’s phpVersion auf
80600 (oder höher) und aktualisiere rector.php, sodass statt
LevelSetList::UP_TO_PHP_83 die passende Konstanten-Version
LevelSetList::UP_TO_PHP_86 (oder entsprechendes LevelSet für 8.6) verwendet
wird, damit PHPStan und Rector die neu hinzugefügte "~8.6.0" Constraint richtig
prüfen und modernisieren.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 0aa2b966-4773-49b1-97ef-024fb9dcb42f
📒 Files selected for processing (2)
composer-dependency-analyser.phpcomposer.json
✅ Files skipped from review due to trivial changes (1)
- composer-dependency-analyser.php
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Improvements
Chores