feat(admins): soft-retire, durable issuer names, and bulk actions (#1509) #611
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PHPStan | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - 'web/**' | |
| - '.github/workflows/phpstan.yml' | |
| pull_request: | |
| paths: | |
| - 'web/**' | |
| - '.github/workflows/phpstan.yml' | |
| jobs: | |
| phpstan: | |
| name: Static analysis | |
| runs-on: ubuntu-24.04 | |
| defaults: | |
| run: | |
| working-directory: web | |
| # Schema-only MariaDB so phpstan-dba (#1100) can introspect column types. | |
| # Mirrors test.yml's service block deliberately — same image, same creds — | |
| # so a contributor's mental model of "MariaDB lives at 127.0.0.1:3306" works | |
| # for both jobs. | |
| services: | |
| mariadb: | |
| image: mariadb:10.11 | |
| ports: | |
| - 3306:3306 | |
| env: | |
| MARIADB_ROOT_PASSWORD: root | |
| MARIADB_DATABASE: sourcebans | |
| MARIADB_USER: sourcebans | |
| MARIADB_PASSWORD: sourcebans | |
| options: >- | |
| --health-cmd="healthcheck.sh --connect --innodb_initialized" | |
| --health-interval=5s | |
| --health-timeout=5s | |
| --health-retries=10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup PHP | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: '8.5' | |
| extensions: pdo, pdo_mysql, openssl, mbstring, sodium | |
| coverage: none | |
| tools: composer:v2 | |
| - name: Get composer cache directory | |
| id: composer-cache | |
| run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT" | |
| - name: Cache composer dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: ${{ steps.composer-cache.outputs.dir }} | |
| key: ${{ runner.os }}-composer-${{ hashFiles('web/composer.lock') }} | |
| restore-keys: ${{ runner.os }}-composer- | |
| - name: Install dependencies | |
| run: composer install --no-progress --prefer-dist --no-interaction | |
| - name: Wait for MariaDB | |
| run: | | |
| for i in {1..30}; do | |
| if mysqladmin ping -h 127.0.0.1 -P 3306 -u root -proot --silent; then | |
| echo "ready"; exit 0 | |
| fi | |
| sleep 2 | |
| done | |
| echo "MariaDB never came up" >&2; exit 1 | |
| # phpstan-dba doesn't execute queries, but it does call | |
| # information_schema for column metadata, so the schema needs to be | |
| # loaded against the same DB the bootstrap connects to. Render the | |
| # `{prefix}` / `{charset}` placeholders the same way docker/db-init | |
| # does locally so we can't drift. | |
| - name: Render and load schema for phpstan-dba | |
| run: | | |
| tmp=$(mktemp) | |
| sed -e 's/{prefix}/sb/g' -e 's/{charset}/utf8mb4/g' \ | |
| install/includes/sql/struc.sql > "$tmp" | |
| mysql -h 127.0.0.1 -u root -proot sourcebans < "$tmp" | |
| # Sanity check: a known table should now exist. | |
| mysql -h 127.0.0.1 -u root -proot sourcebans -e 'SHOW TABLES LIKE "sb_admins"' \ | |
| | grep -q sb_admins | |
| - name: Run PHPStan | |
| env: | |
| DBA_HOST: 127.0.0.1 | |
| DBA_PORT: 3306 | |
| DBA_NAME: sourcebans | |
| DBA_USER: sourcebans | |
| DBA_PASS: sourcebans | |
| DBA_PREFIX: sb | |
| DBA_CHARSET: utf8mb4 | |
| # The whole point of the new MariaDB service is to gate schema drift. | |
| # Refuse to run if the bootstrap can't connect — otherwise a creds | |
| # mismatch would silently disable phpstan-dba and CI would stay green. | |
| DBA_REQUIRE: '1' | |
| run: includes/vendor/bin/phpstan analyse --configuration=phpstan.neon --no-progress --error-format=github --memory-limit=1G |