Skip to content

👷 Add GitHub Actions CI #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rickyheijnen merged 1 commit into from
Jul 10, 2026
Merged

👷 Add GitHub Actions CI #4

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
97 changes: 97 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,97 @@
name: CI

on:
Comment on lines +1 to +3

@coderabbitai coderabbitai Bot Jul 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

sed -n '1,220p' .github/workflows/ci.yml | cat -n

Repository: brixion/ulu-php

Length of output: 3200

Restrict workflow token permissions
.github/workflows/ci.yml:1-3
Add permissions: contents: read at the workflow level so the CI jobs don't inherit broader repository write access they don't need.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 1-98: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 1 - 3, Add workflow-level read-only
token permissions by placing a permissions block with contents: read alongside
the top-level name and on declarations in the CI workflow, ensuring all jobs
inherit the restricted scope.

Source: Linters/SAST tools

push:
branches:
- main
pull_request:

concurrency:
group: ci-${{ github.workflow }}-${{ github.head_ref || github.ref }}
cancel-in-progress: true

jobs:
test:
name: PHPUnit (PHP ${{ matrix.php }})
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
php: ['8.2', '8.3', '8.4', '8.5']
steps:
- uses: actions/checkout@v4

@coderabbitai coderabbitai Bot Jul 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

git ls-files .github/workflows/ci.yml
echo '---'
cat -n .github/workflows/ci.yml | sed -n '1,220p'

Repository: brixion/ulu-php

Length of output: 3229

🏁 Script executed:

#!/bin/bash
set -euo pipefail

git ls-files composer.json
echo '---'
cat -n composer.json | sed -n '1,220p'

Repository: brixion/ulu-php

Length of output: 1999

Disable checkout credential persistence. Set persist-credentials: false on each actions/checkout@v4 step; the Composer install and test commands run repository-controlled code that can read the persisted Git token from local config.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 22-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 22, Disable Git credential persistence for
every actions/checkout@v4 step in the workflow by adding persist-credentials:
false to each checkout action configuration, including the checkout step shown
in the diff.

Source: Linters/SAST tools


- name: Setup PHP
uses: shivammathur/setup-php@v2
with:
php-version: ${{ matrix.php }}
coverage: none
tools: composer

- name: Cache Composer dependencies
uses: actions/cache@v4
with:
path: vendor
key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('composer.json') }}
restore-keys: |
composer-${{ runner.os }}-${{ matrix.php }}-

- name: Install dependencies
run: composer install --prefer-dist --no-progress

- name: Run tests
run: composer test

static-analysis:
name: PHPStan
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

- name: Setup PHP
uses: shivammathur/setup-php@v2
with:
php-version: '8.2'
coverage: none
tools: composer

- name: Cache Composer dependencies
uses: actions/cache@v4
with:
path: vendor
key: composer-${{ runner.os }}-8.2-${{ hashFiles('composer.json') }}
restore-keys: |
composer-${{ runner.os }}-8.2-

- name: Install dependencies
run: composer install --prefer-dist --no-progress

- name: Run PHPStan
run: composer analyse

code-style:
name: PHP CS Fixer
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

- name: Setup PHP
uses: shivammathur/setup-php@v2
with:
php-version: '8.2'
coverage: none
tools: composer

- name: Cache Composer dependencies
uses: actions/cache@v4
with:
path: vendor
key: composer-${{ runner.os }}-8.2-${{ hashFiles('composer.json') }}
restore-keys: |
composer-${{ runner.os }}-8.2-

- name: Install dependencies
run: composer install --prefer-dist --no-progress

- name: Check code style
run: composer cs:check
Loading