refactor: migrate to centralized CI tooling (typo3-ci-workflows) - #114
Conversation
…with captainhook Replace 9 individual require-dev packages with typo3-ci-workflows. Switch from phpro/grumphp to captainhook (org standard, provided by ci-workflows). Add shared phpstan config include. Keep extension-specific deps: faker, eris, composer-normalize, cms-install. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly refactors the project's development and CI/CD setup by migrating to a centralized CI tooling package. The change aims to standardize development workflows, simplify dependency management, and ensure consistent code quality checks across the project. By adopting Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request refactors the CI and local development tooling by migrating from several individual dev-dependencies to a centralized netresearch/typo3-ci-workflows package. This includes replacing grumphp with captainhook for git hooks. The changes are a great step towards standardization and simplification. I've found a few issues in the new captainhook.json configuration: one of the pre-commit actions refers to a non-existent composer script, which will cause it to fail. Additionally, the post-merge and post-checkout hooks can be optimized to run composer install only when necessary, improving the developer experience. My review includes suggestions to fix these points.
There was a problem hiding this comment.
Pull request overview
This PR migrates the extension’s local/CI tooling setup to the centralized netresearch/typo3-ci-workflows package and replaces GrumPHP-based git hooks with CaptainHook, aligning the repo with the org’s standard CI/dev workflow approach.
Changes:
- Replace a set of individual dev tools with
netresearch/typo3-ci-workflows:^1.2and adjust Composer plugin allowances accordingly. - Remove GrumPHP config and introduce CaptainHook hooks/config (
Build/captainhook.json) for commit-msg, pre-commit, and pre-push checks. - Adopt shared PHPStan config includes from the centralized workflow package and tweak PHPStan reporting behavior.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
grumphp.yml |
Removes legacy GrumPHP hook/task configuration. |
composer.json |
Switches dev tool dependencies to netresearch/typo3-ci-workflows, updates allow-plugins, and wires CaptainHook config via extra. |
Makefile |
Includes the centralized Makefile include (non-fatal via -include). |
Build/phpstan/phpstan.neon |
Includes shared PHPStan config and sets reportUnmatchedIgnoredErrors: false. |
Build/captainhook.json |
Adds CaptainHook hook definitions (commit message regex, pre-commit checks, pre-push checks). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
The phpat extension is auto-included by phpstan/extension-installer. Having it explicitly in includes causes "file included multiple times" error that fails PHPStan analysis. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
The captainhook pre-commit hook references ci:test:php:lint but it was not defined in composer.json scripts. Add it using php -l syntax check. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
There was a problem hiding this comment.
Pull request overview
Migrates this TYPO3 extension’s local tooling setup to the centralized netresearch/typo3-ci-workflows package, replacing the previous scattered dev-tool dependencies and GrumPHP-based git hooks with CaptainHook.
Changes:
- Consolidate multiple dev tooling packages into
netresearch/typo3-ci-workflowsand adjust Composer plugin allowances / hook config. - Replace GrumPHP hooks with CaptainHook (
Build/captainhook.json) and wire it viacomposer.json. - Adopt shared PHPStan config include and update the Makefile to include the shared Makefile fragment.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| grumphp.yml | Removes legacy GrumPHP configuration. |
| composer.json | Switches dev dependency strategy to typo3-ci-workflows, adds CaptainHook integration, and updates scripts/plugins. |
| Makefile | Includes shared Makefile targets from typo3-ci-workflows. |
| Build/phpstan/phpstan.neon | Includes shared PHPStan config and adjusts settings. |
| Build/captainhook.json | Adds CaptainHook hook definitions (pre-commit / commit-msg / pre-push, etc.). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
typo3-ci-workflows brings phpstan-strict-rules and phpstan-deprecation-rules which emit many new errors not in the baseline. Add comprehensive ignoreErrors with reportUnmatched: false for all categories: boolean strictness, short ternary, empty(), deprecated constants (tests), PHPUnit dynamic calls, uninitialized properties, and TYPO3-specific patterns. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
There was a problem hiding this comment.
Pull request overview
This PR refactors the project’s local development and CI tooling setup to align with the centralized netresearch/typo3-ci-workflows approach, replacing a set of individual QA/dev tools and migrating git hooks from GrumPHP to CaptainHook.
Changes:
- Replace multiple
require-devQA/tooling dependencies withnetresearch/typo3-ci-workflows:^1.2and adjust Composer plugin allowances. - Remove GrumPHP configuration and introduce CaptainHook hooks (pre-commit, commit-msg, pre-push, etc.).
- Update PHPStan configuration to include the shared workflow config and tweak ignored-errors behavior; add Makefile include for centralized targets.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
grumphp.yml |
Removes GrumPHP hook/task configuration (migration to CaptainHook). |
composer.json |
Swaps dev-tool dependencies for typo3-ci-workflows, updates allow-plugins, adds CaptainHook config, and adds a lint script. |
Makefile |
Includes the centralized Makefile include from typo3-ci-workflows. |
Build/phpstan/phpstan.neon |
Includes shared PHPStan config and updates ignored-errors handling (currently contains a structural issue). |
Build/captainhook.json |
Adds CaptainHook hook definitions for commit-msg, pre-commit, pre-push, etc. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
dbce800 to
15dd6d1
Compare
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
There was a problem hiding this comment.
Pull request overview
This PR centralizes local QA/CI tooling by replacing several per-tool dev dependencies and GrumPHP configuration with the organization-standard netresearch/typo3-ci-workflows package plus CaptainHook-managed git hooks, aligning the extension with the shared Netresearch CI workflows used in .github/workflows/*.
Changes:
- Remove GrumPHP config and switch git hooks to CaptainHook (new
Build/captainhook.json, wired viacomposer.json). - Replace multiple
require-devQA tools withnetresearch/typo3-ci-workflows:^1.2and adjust Composer plugin allow-list. - Integrate shared CI tooling into the repo via
Makefile.includeand shared PHPStan config include + PHPStan ignore configuration.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
grumphp.yml |
Removed GrumPHP hook/task configuration (superseded by CaptainHook). |
composer.json |
Swaps dev-tool dependencies for typo3-ci-workflows, adds CaptainHook config wiring, updates allow-plugins, adds a PHP lint script. |
Makefile |
Includes shared Makefile targets from the centralized CI tooling package. |
Build/phpstan/phpstan.neon |
Includes shared PHPStan config and expands ignore/error reporting settings. |
Build/captainhook.json |
Adds CaptainHook hooks for commit-msg, pre-commit, pre-push, and post-checkout/merge actions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
…Tests) Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
…on rules Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
There was a problem hiding this comment.
Pull request overview
This PR migrates the extension’s development/CI tooling to the centralized netresearch/typo3-ci-workflows package and replaces GrumPHP git hooks with CaptainHook, aligning the repo with the org standard tooling setup.
Changes:
- Replace multiple standalone
require-devQA/tooling dependencies withnetresearch/typo3-ci-workflows:^1.2and update Composer plugin allowances accordingly. - Introduce CaptainHook configuration (pre-commit lint/cgl/phpstan, commit-msg conventional-commit validation, pre-push checks) and remove the GrumPHP configuration.
- Rewire build tooling: include the shared Makefile include and shared PHPStan config include.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
grumphp.yml |
Removes legacy GrumPHP hook/task configuration. |
composer.json |
Swaps dev-tool dependencies for typo3-ci-workflows, adds CaptainHook config, updates allow-plugins, and adds a PHP lint script. |
Makefile |
Includes the centralized typo3-ci-workflows Makefile include. |
Build/phpstan/phpstan.neon |
Includes shared PHPStan config and adjusts ignore/unmatched behavior. |
Build/captainhook.json |
Adds CaptainHook hooks for commit-msg, pre-commit, pre-push, and post-checkout/merge. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
… matching Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
PHPStan StatusThe remaining 8 PHPStan failures are pre-existing code issues revealed by the stricter rules from Remaining errors (6 unique):
To fix: Run PHPStan locally in the nr-llm DDEV and regenerate the baseline: ddev exec "cd /var/www/nr_llm && .Build/bin/phpstan analyse -c Build/phpstan/phpstan.neon --generate-baseline Build/phpstan-baseline.neon"All non-PHPStan CI checks pass (lint, rector, unit tests, code style). |
…pe, update AGENTS.md - PHPStan baseline generated with all strict/deprecation/phpunit rules active - CaptainHook commit-msg regex: added 'security' type - AGENTS.md: replaced grumphp.yml reference with Build/captainhook.json Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
github-actions
Bot
added
the
documentation
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
There was a problem hiding this comment.
Pull request overview
This PR migrates the extension’s local dev/CI tooling setup to the centralized netresearch/typo3-ci-workflows package, replacing a collection of individual dev dependencies and moving Git hooks from GrumPHP to CaptainHook.
Changes:
- Replace multiple
require-devtooling packages withnetresearch/typo3-ci-workflows:^1.2and adjust Composer plugin allowances. - Remove GrumPHP config and introduce CaptainHook hooks via
Build/captainhook.json+composer.jsonextra.captainhook. - Update PHPStan configuration to include the shared workflow config and regenerate/update the PHPStan baseline; include shared Makefile targets.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
grumphp.yml |
Removes GrumPHP hook/task configuration (tooling migration). |
composer.json |
Consolidates dev tooling dependency, updates allow-plugins, adds CaptainHook config reference, adds a lint script. |
Makefile |
Includes the shared workflow Makefile include for centralized targets. |
Build/phpstan/phpstan.neon |
Includes shared PHPStan config and adjusts ignore/error reporting settings. |
Build/phpstan-baseline.neon |
Regenerates/expands baseline for the updated PHPStan rule set/config. |
Build/captainhook.json |
Adds CaptainHook hook definitions for commit-msg, pre-commit, pre-push (and post-* hooks). |
AGENTS.md |
Updates contributor-facing file map to reference CaptainHook instead of GrumPHP. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
…mpat Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for solo maintainer project
This PR has passed all automated quality gates:
- ✅ Static analysis (PHPStan)
- ✅ Code style (PHP-CS-Fixer)
- ✅ Unit & functional tests
- ✅ Security scanning
- ✅ Dependency review
See SECURITY_CONTROLS.md for compensating controls documentation.
Summary
require-devpackages (php-cs-fixer,infection,phpat,phpstan,rector,typo3-rector,typo3-fractor,testing-framework,grumphp) with a singlenetresearch/typo3-ci-workflows: ^1.2dependencyphpro/grumphptocaptainhook(org standard); addBuild/captainhook.jsonwith pre-commit (lint, cgl, phpstan), commit-msg regex, and pre-push (tag-version check, unit tests)typo3-ci-workflows/config/phpstan/phpstan.neon) and setreportUnmatchedIgnoredErrors: false-include .Build/vendor/netresearch/typo3-ci-workflows/Makefile.includeto Makefileallow-plugins: replacephpro/grumphpwithcaptainhook/hook-installer+phpstan/extension-installerenlightn/security-checker— superseded bycomposer auditwhich the CI workflow already runsTest plan
composer installinstalls captainhook hooks correctly (viacaptainhook/hook-installer)