ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  merge_group:
  workflow_dispatch:
  schedule:
    - cron: '0 6 * * 1'

permissions:
  contents: read

# Supersede stale PR runs. Never cancel merge_group (a queue entry must finish
# validating or the queue stalls) or push-to-main.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

# Per-extension test matrix (intentional-drift). Security/quality jobs are in checks.yml.
jobs:
  ci:
    uses: netresearch/typo3-ci-workflows/.github/workflows/ci.yml@main
    permissions:
      contents: read
    with:
      # Full PHP matrix on pull_request (and the nightly schedule) for complete
      # coverage; the merge queue re-validates the merged result on a single PHP
      # (8.4) against BOTH TYPO3 majors — the queue's job is to catch two
      # independently-green PRs that break when combined, and such integration
      # breaks are a TYPO3-major axis (TCA/DI/schema), essentially never a PHP
      # patch axis, which the PR already proved across all four versions. This
      # cuts the queue's slowest matrix (functional, 8-11min/cell) from 8 cells
      # to 4. The required-status-checks ruleset is reduced to match (only the
      # 8.4 cells stay required); the other cells remain visible on the PR.
      #
      # Rector must judge every event by the same rule set. Rector 2.6's
      # PHPUnit rules resolve against the phpunit version composer installs —
      # 8.2 resolves phpunit ^11, 8.4 resolves ^13, and the 13-only migrations
      # (e.g. expectExceptionMessageIsOrContains) would break the 8.2 unit legs
      # if applied. A queue that evaluated Rector on 8.4 while the PR evaluated
      # it on 8.2 dequeued every entry with findings the PR run could not see
      # (observed on #573, 2026-08-03).
      #
      # rector-php-version states the version outright instead of leaving it to
      # fromJSON(php-versions)[0], so reordering either array below cannot move
      # it again. The remaining single-version tool jobs (lint, cgl, fractor)
      # still take [0].
      rector-php-version: '8.2'
      # The CHANGELOG and workflow checks run in the shared workflow's
      # repo-checks job rather than a job of our own — see AGENTS.md.
      run-repo-checks: true
      php-versions: ${{ github.event_name == 'merge_group' && '["8.2","8.4"]' || '["8.2","8.3","8.4","8.5"]' }}
      typo3-versions: '["^13.4","^14.3"]'
      # Keeps the unit job's Codecov upload on every PR — that job is ~1min, so
      # its Xdebug tax is negligible and patch coverage stays useful. The
      # expensive functional matrix opts out via functional-test-command below.
      upload-coverage: true
      # Run PHPUnit functional tests (default is false in the reusable workflow).
      # composer ci:test:php:functional invokes the full Build/FunctionalTests.xml,
      # which covers BOTH the `functional` and `e2e-backend` testsuites — without
      # this the whole functional job was skipped and both suites rotted (#272).
      run-functional-tests: true
      # Functional tests are the entire CI critical path: 8 matrix cells at
      # 8-11min each while every other job finishes in ~1min, and 95% of a cell
      # is one serial PHPUnit process.
      #
      # Two things are traded here, per event:
      #
      #   PR / merge_group -> speed. Build/Scripts/ciFunctionalParallel.sh runs
      #     one PHPUnit process per test class with Xdebug forced off; see that
      #     script for why the sharding is safe and why opcache is absent.
      #
      #   schedule / workflow_dispatch -> coverage. Serial, with Xdebug, so
      #     Codecov gets a real functional report (parallel would need per-process
      #     clover merging for no benefit when nobody is waiting on the run).
      #     NOTE: this deliberately does not key off `push`, because preflight
      #     skips push-to-main runs already validated by merge_group -- gating
      #     coverage on push would mean it never runs.
      functional-test-command: |
        if [ "${{ github.event_name }}" = "schedule" ] || [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
          composer ci:test:php:functional -- --coverage-clover=coverage-functional.xml
          # A suite that skipped itself out still writes a well-formed clover
          # claiming zero covered statements — which would upload as a coverage
          # COLLAPSE and stay green, the same silent-green shape as the outage
          # this split exists to end. The last <metrics> before </project> is the
          # clover project total.
          covered=$(grep -oE 'coveredstatements="[0-9]+"' coverage-functional.xml | tail -1 | tr -dc '0-9')
          if [ "${covered:-0}" -eq 0 ]; then
            echo "::error::functional coverage reports 0 covered statements — the suite proved nothing; refusing to upload a false collapse to Codecov."
            exit 1
          fi
          echo "functional coverage: ${covered} covered statements"
        else
          Build/Scripts/ciFunctionalParallel.sh
        fi
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
  # MariaDB functional leg (one cell): keeps the MySQL-only branches —
  # ke_search MATCH...AGAINST retrieval — permanently exercised in CI.
  # mariadb:11.8 — one of the two current LTS series (11.8, 12.3); the e2e
  # leg runs the other, so CI covers both. This sat on 10.11 because images
  # >= 11 ship only mariadb-admin while the reusable workflow health-checked
  # with a hardcoded mysqladmin, so the service never turned healthy
  # (netresearch/typo3-ci-workflows#128, fixed there in #174).
  # The full matrix above stays on SQLite; this narrow second call exists ONLY
  # for the MariaDB functional leg.
  ci-functional-mariadb:
    uses: netresearch/typo3-ci-workflows/.github/workflows/ci.yml@main # NOSONAR — own-org reusable workflow deliberately tracks main, like the sibling job above
    permissions:
      contents: read
    with:
      php-versions: '["8.4"]'
      typo3-versions: '["^14.3"]'
      run-functional-tests: true
      functional-test-db: mariadb
      db-image: 'mariadb:11.8'
      # Shard by test class here too. With the SQLite cells down to ~2.5min this
      # leg became the single longest job in CI at 6min, i.e. the whole
      # critical-path term of the wall clock.
      #
      # Safe on a SHARED MariaDB server for the same reason it is safe on
      # SQLite: the framework derives the database name from the same per-class
      # identifier — $originalDatabaseName . '_ft' . substr(sha1(static::class), 0, 7)
      # (FunctionalTestCase.php:361) — so each process creates its OWN database
      # (typo3_test_ft<hash>). No CREATE race, no shared state, and 4 processes
      # are nowhere near mariadb:11.8's default max_connections of 151.
      #
      # No event split: this leg never uploaded coverage (upload-coverage is
      # unset here, so the reusable resolves coverage: none). It exists purely to
      # keep the MySQL-only branches exercised.
      functional-test-command: 'Build/Scripts/ciFunctionalParallel.sh'
      # This call previously also ran Lint/Code Style/PHPStan/Rector/Unit — all
      # byte-for-byte repeats of the sibling call above, none of them required
      # checks, none of them engine-dependent. They cost ~5 job-min per run and
      # proved nothing the SQLite call had not already proven.
      run-lint: false
      run-cgl: false
      run-phpstan: false
      run-rector: false
      run-unit-tests: false

  # Property-based (fuzzy) + mutation testing. Enabled here rather than in the
  # template-governed checks.yml because turning these on is a per-extension
  # choice and this file is intentional-drift. Fuzzy runs on every event
  # (~seconds); mutation runs only on the weekly schedule (~13 min, 10k+
  # mutants) and is report-only for now — the reusable's Infection step is
  # continue-on-error and covered MSI is still climbing toward the 70/74 target
  # shown here, so the run surfaces the gap without blocking.
  fuzz-mutation:
    uses: netresearch/typo3-ci-workflows/.github/workflows/fuzz.yml@main
    permissions:
      contents: read
    with:
      run-fuzz-tests: true
      fuzz-testsuite: fuzzy
      run-mutation-tests: ${{ github.event_name == 'schedule' }}
      mutation-min-msi: 70
      mutation-min-covered-msi: 74