ci(auth): stage reviewed overlay in bounded chunks #29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, v2] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| statuses: write | |
| jobs: | |
| quality: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| php: ['8.4', '8.5'] | |
| di: ['2.*', '3.*'] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: ${{ matrix.php }} | |
| extensions: mbstring, pdo_sqlite | |
| coverage: none | |
| tools: composer:v2 | |
| - name: Resolve DI matrix dependencies | |
| run: composer update --with "componenta/di:${{ matrix.di }}" --prefer-dist --no-interaction --no-progress | |
| - name: Verify package | |
| id: verify | |
| continue-on-error: true | |
| run: bash tools/verify.sh | |
| - name: Export exact source checkout for remediation | |
| if: always() && matrix.php == '8.4' && matrix.di == '2.*' | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: auth-v2-source-${{ github.sha }} | |
| path: | | |
| . | |
| !.git/** | |
| !vendor/** | |
| !composer.lock | |
| include-hidden-files: true | |
| retention-days: 1 | |
| - name: Export resolved DI 2 dependencies for remediation | |
| if: always() && matrix.php == '8.4' && matrix.di == '2.*' | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: auth-v2-vendor-${{ github.sha }} | |
| path: | | |
| vendor | |
| composer.lock | |
| retention-days: 1 | |
| - name: Publish explicit commit status | |
| if: always() && github.event_name == 'push' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| SHA: ${{ github.sha }} | |
| CONTEXT: auth-ci/php-${{ matrix.php }}-di-${{ matrix.di }} | |
| STATE: ${{ steps.verify.outcome == 'success' && 'success' || 'failure' }} | |
| run: | | |
| set -euo pipefail | |
| payload="$(php -r 'echo json_encode([ | |
| "state" => getenv("STATE"), | |
| "context" => getenv("CONTEXT"), | |
| "description" => getenv("STATE") === "success" | |
| ? "Auth v2 verification passed" | |
| : "Auth v2 verification failed", | |
| "target_url" => sprintf( | |
| "https://github.com/%s/actions/runs/%s", | |
| getenv("GITHUB_REPOSITORY"), | |
| getenv("GITHUB_RUN_ID"), | |
| ), | |
| ], JSON_THROW_ON_ERROR);')" | |
| curl --fail --silent --show-error \ | |
| --request POST \ | |
| --header "Authorization: Bearer ${GH_TOKEN}" \ | |
| --header 'Accept: application/vnd.github+json' \ | |
| --header 'X-GitHub-Api-Version: 2022-11-28' \ | |
| --data "${payload}" \ | |
| "https://api.github.com/repos/${GITHUB_REPOSITORY}/statuses/${SHA}" \ | |
| >/dev/null | |
| - name: Preserve verification failure | |
| if: steps.verify.outcome != 'success' | |
| run: exit 1 |