ci_static-checks.yaml

name: Static Analysis

on:
    workflow_dispatch: ~
    workflow_call:
        inputs:
            branch:
                description: "Branch"
                required: false
                type: string
                default: ""
            type:
                description: "Type of the build"
                required: true
                type: string

permissions:
    contents: read

jobs:
    get-matrix:
        runs-on: ubuntu-latest
        name: "Get matrix"
        outputs:
            matrix: ${{ steps.matrix.outputs.prop }}
        steps:
            -   name: "Checkout (With Branch)"
                if: "${{ inputs.branch != '' }}"
                uses: actions/checkout@v4
                with:
                    ref: ${{ inputs.branch }}

            -   name: "Checkout"
                if: "${{ inputs.branch == '' }}"
                uses: actions/checkout@v4

            -
                name: "Get matrix"
                id: matrix
                uses: notiz-dev/github-action-json-property@release
                with:
                    path: '.github/workflows/matrix.json'
                    prop_path: '${{ inputs.type }}.static-checks'

    static-checks:
        needs: get-matrix
        runs-on: ubuntu-latest
        name: "PHP ${{ matrix.php }}, Symfony ${{ matrix.symfony }}"
        strategy:
            fail-fast: false
            matrix: ${{ fromJson(needs.get-matrix.outputs.matrix) }}
        env:
            APP_ENV: test_cached
            DATABASE_URL: "mysql://root:root@127.0.0.1/sylius?charset=utf8mb4&serverVersion=8.0"
        steps:
            -   name: "Checkout (With Branch)"
                if: "${{ inputs.branch != '' }}"
                uses: actions/checkout@v4
                with:
                    ref: ${{ inputs.branch }}

            -   name: "Checkout"
                if: "${{ inputs.branch == '' }}"
                uses: actions/checkout@v4

            -   name: "Setup PHP"
                uses: shivammathur/setup-php@v2
                with:
                    php-version: "${{ matrix.php }}"
                    ini-values: date.timezone=Europe/Warsaw, opcache.enable=1, opcache.enable_cli=0, opcache.memory_consumption=512, opcache.max_accelerated_files=65407, opcache.interned_strings_buffer=8, opcache.validate_timestamps=0, opcache.save_comments=1, opcache.fast_shutdown=0
                    extensions: intl, gd, opcache, mysql, pdo_mysql
                    tools: symfony, composer-require-checker
                    coverage: none

            -   name: "Restrict packages' versions"
                run: |
                    composer global config --no-plugins allow-plugins.symfony/flex true
                    composer global require --no-progress --no-scripts --no-plugins "symfony/flex:^2.4"
                    composer config extra.symfony.require "${{ matrix.symfony }}"

            -   name: Get Composer cache directory
                id: composer-cache
                run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT

            -   name: "Setup cache"
                uses: actions/cache@v4
                with:
                    path: |
                        ${{ steps.composer-cache.outputs.dir }}
                    key: ${{ github.run_id }}-${{ runner.os }}-${{ hashFiles('composer.json') }}-symfony-${{ matrix.symfony }}

            -   name: "Require ext-random"
                if: matrix.php == '8.2'
                run: composer require ext-random --no-update --no-scripts --no-interaction

            -   name: "Install dependencies"
                run: composer update --no-interaction --no-scripts

            -   name: "Validate composer.json"
                run: composer validate --strict --no-check-version

            -   name: "Check for security vulnerabilities"
                run: symfony security:check
                continue-on-error: true

            -   name: "Validate Twig templates"
                run: bin/console lint:twig src

            -   name: "Validate Container"
                run: bin/console lint:container

            -   name: Validate Yaml files
                run: bin/console lint:yaml src

            -   name: Run PHPStan
                run: vendor/bin/phpstan analyse