fix: cast string returns to int in MY_Migration

basename() returns string and database column values are strings, but get_latest_migration() and get_current_version() declare int return types. PHP 8.0+ enforces strict return types and no longer silently coerces strings to int, causing a TypeError on fresh installs. Fixes #4559
fix(ci): include hidden files in Docker build context (#4543 )
2026-05-25 08:44:42 -04:00 · 2026-05-22 14:53:55 +02:00 · 2026-05-13 07:06:23 +02:00
6 changed files with 6 additions and 428 deletions
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -123,6 +123,7 @@ jobs:
            .
            !.git
            !node_modules
+          include-hidden-files: true
          retention-days: 1

  docker:
--- a/.github/workflows/deploy-pr.yml
+++ b/.github/workflows/deploy-pr.yml
@@ -1,204 +0,0 @@
-name: PR Deploy
-
-on:
-  pull_request_review:
-    types: [submitted]
-
-concurrency:
-  group: staging-deploy
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-  deployments: write
-  pull-requests: write
-
-jobs:
-  deploy-staging:
-    name: Deploy to staging
-    runs-on: ubuntu-latest
-    if: >
-      github.event.review.state == 'approved' &&
-      github.event.pull_request.head.repo.full_name == github.repository
-    
-    environment:
-      name: staging
-      url: ${{ vars.DEPLOY_URL || 'https://dev.opensourcepos.org' }}
-      deployment: false
-    
-    steps:
-      - name: Checkout PR
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-      
-      - name: Get image tag
-        id: image
-        env:
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          PR_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          IMAGE_TAG="pr-${PR_NUMBER}-${PR_SHA:0:7}"
-          echo "tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT"
-      
-      - name: Create GitHub Deployment
-        id: deployment
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          REF_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          set -euo pipefail
-          
-          DEPLOYMENT_ID=$(gh api "repos/${GITHUB_REPOSITORY}/deployments" \
-            -X POST \
-            -f ref="${REF_SHA}" \
-            -f environment="staging" \
-            -f description="Deploy PR #${PR_NUMBER} to staging" \
-            -F auto_merge=false \
-            -F required_contexts[] \
-            --jq '.id')
-          
-          if [ -z "$DEPLOYMENT_ID" ]; then
-            echo "::error::Failed to create deployment"
-            exit 1
-          fi
-          
-          echo "deployment_id=$DEPLOYMENT_ID" >> "$GITHUB_OUTPUT"
-          echo "Created deployment: $DEPLOYMENT_ID"
-      
-      - name: Set deployment status to in_progress
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          set -euo pipefail
-          
-          gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
-            -X POST \
-            -f state="in_progress" \
-            -f description="Deploying PR #${PR_NUMBER}..." \
-            -f log_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-      
-      - name: Trigger deployment webhook
-        id: webhook
-        env:
-          DEPLOY_WEBHOOK_URL: ${{ secrets.DEPLOY_WEBHOOK_URL }}
-          DEPLOY_WEBHOOK_SECRET: ${{ secrets.DEPLOY_WEBHOOK_SECRET }}
-          DOCKER_REPO_NAME: ${{ secrets.DOCKER_REPO_NAME }}
-          IMAGE_TAG: ${{ steps.image.outputs.tag }}
-          REF_SHA: ${{ github.event.pull_request.head.sha }}
-          DEPLOYMENT_ID: ${{ steps.deployment.outputs.deployment_id }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          set -euo pipefail
-          
-          if [ -z "$DEPLOY_WEBHOOK_URL" ]; then
-            echo "::error::DEPLOY_WEBHOOK_URL secret is not configured"
-            echo "status=failure" >> "$GITHUB_OUTPUT"
-            exit 1
-          fi
-          
-          REPO_NAME="${DOCKER_REPO_NAME:-opensourcepos/opensourcepos}"
-          REPO_NAMESPACE="${REPO_NAME%%/*}"
-          REPO_SHORT_NAME="${REPO_NAME#*/}"
-          PUSHED_AT=$(date +%s)
-          
-          PAYLOAD=$(jq -n \
-            --arg callback_url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
-            --argjson pushed_at "$PUSHED_AT" \
-            --arg pusher "$GITHUB_ACTOR" \
-            --arg tag "$IMAGE_TAG" \
-            --arg repo_name "$REPO_NAME" \
-            --arg name "$REPO_SHORT_NAME" \
-            --arg namespace "$REPO_NAMESPACE" \
-            --arg repo_url "https://hub.docker.com/r/${REPO_NAME}/" \
-            --arg deployment_id "$DEPLOYMENT_ID" \
-            --arg repository "$GITHUB_REPOSITORY" \
-            --arg sha "$REF_SHA" \
-            --arg run_id "$GITHUB_RUN_ID" \
-            --arg actor "$GITHUB_ACTOR" \
-            --argjson pr_number "$PR_NUMBER" \
-            '{
-              callback_url: $callback_url,
-              push_data: {pushed_at: $pushed_at, pusher: $pusher, tag: $tag},
-              repository: {repo_name: $repo_name, name: $name, namespace: $namespace, repo_url: $repo_url, status: "Active"},
-              github_deployment: {id: $deployment_id, environment: "staging", repository: $repository, sha: $sha, run_id: $run_id, actor: $actor, pull_request: $pr_number}
-            }')
-          
-          echo "Sending webhook..."
-          echo "Image: ${IMAGE_TAG}"
-          echo "PR: #${PR_NUMBER}"
-          
-          HEADERS=(-H "Content-Type: application/json")
-          
-          if [ -n "$DEPLOY_WEBHOOK_SECRET" ]; then
-            SIGNATURE=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "$DEPLOY_WEBHOOK_SECRET" | sed 's/.*= //')
-            HEADERS+=(-H "X-Hub-Signature-256: sha256=$SIGNATURE")
-          fi
-          
-          HTTP_CODE=$(curl -sS --connect-timeout 10 --max-time 120 \
-            -o response.txt -w "%{http_code}" \
-            -X POST \
-            "${HEADERS[@]}" \
-            -d "$PAYLOAD" \
-            "$DEPLOY_WEBHOOK_URL") || HTTP_CODE="000"
-          
-          echo "Response code: $HTTP_CODE"
-          if [ -s response.txt ]; then
-            cat response.txt
-          fi
-          
-          if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
-            echo "status=success" >> "$GITHUB_OUTPUT"
-          else
-            echo "status=failure" >> "$GITHUB_OUTPUT"
-          fi
-      
-      - name: Set deployment status
-        if: always()
-        env:
-          GH_TOKEN: ${{ github.token }}
-          IMAGE_TAG: ${{ steps.image.outputs.tag }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          set -euo pipefail
-          
-          STATE="${{ steps.webhook.outputs.status }}"
-          
-          if [ "$STATE" = "success" ]; then
-            DESCRIPTION=$(jq -nr --arg tag "$IMAGE_TAG" --arg pr "$PR_NUMBER" \
-              '"Deployed PR #\($pr) (\($tag)) to staging"')
-            
-            gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
-              -X POST \
-              -f state="success" \
-              -f description="$DESCRIPTION"
-          else
-            gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
-              -X POST \
-              -f state="failure" \
-              -f description="Staging deployment failed"
-            exit 1
-          fi
-      
-      - name: Comment deployment status
-        if: always()
-        env:
-          GH_TOKEN: ${{ github.token }}
-          IMAGE_TAG: ${{ steps.image.outputs.tag }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          REF_SHA: ${{ github.event.pull_request.head.sha }}
-          STATUS: ${{ steps.webhook.outputs.status }}
-        run: |
-          if [ "$STATUS" = "success" ]; then
-            BODY=$(jq -nr --arg tag "$IMAGE_TAG" --arg sha "$REF_SHA" --arg url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
-              '"✅ **Staging deployment completed**\n\n🔗 **URL**: https://dev.opensourcepos.org\n📦 **Image Tag**: `\($tag)`\n🔨 **Commit**: \($sha)\n\nView logs: \($url)"')
-          else
-            BODY=$(jq -nr --arg url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
-              '"❌ **Staging deployment failed**\n\nCheck the [workflow logs](\($url)) for details."')
-          fi
-          
-          gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
-            -X POST \
-            -f body="$BODY"
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,214 +0,0 @@
-name: Deploy
-
-on:
-  workflow_dispatch:
-    inputs:
-      image_tag:
-        description: 'Docker image tag to deploy (e.g., v3.4.0, latest)'
-        required: true
-        default: 'latest'
-      environment:
-        description: 'Target environment'
-        required: true
-        type: choice
-        options:
-          - production
-          - staging
-        default: 'production'
-  workflow_call:
-    inputs:
-      image_tag:
-        description: 'Docker image tag to deploy'
-        type: string
-        default: 'latest'
-      environment:
-        description: 'Target environment'
-        type: string
-        default: 'staging'
-      sha:
-        description: 'Git commit SHA to deploy'
-        required: true
-        type: string
-
-concurrency:
-  group: deploy-${{ inputs.environment }}
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-  deployments: write
-
-jobs:
-  validate-inputs:
-    name: Validate deployment inputs
-    runs-on: ubuntu-latest
-    steps:
-      - name: Validate environment
-        env:
-          TARGET_ENV: ${{ inputs.environment }}
-        run: |
-          set -euo pipefail
-          case "$TARGET_ENV" in
-            production|staging) ;;
-            *)
-              echo "::error::Invalid environment '$TARGET_ENV'. Expected 'production' or 'staging'."
-              exit 1
-              ;;
-          esac
-
-  deploy:
-    name: Deploy to ${{ inputs.environment }}
-    needs: validate-inputs
-    runs-on: ubuntu-latest
-    
-    environment:
-      name: ${{ inputs.environment }}
-      url: ${{ vars.DEPLOY_URL || (inputs.environment == 'production' && 'https://demo.opensourcepos.org' || 'https://dev.opensourcepos.org') }}
-      deployment: false
-    
-    steps:
-      - name: Create GitHub Deployment
-        id: deployment
-        env:
-          GH_TOKEN: ${{ github.token }}
-          IMAGE_TAG: ${{ inputs.image_tag }}
-          TARGET_ENV: ${{ inputs.environment }}
-          REF_SHA: ${{ inputs.sha || github.sha }}
-        run: |
-          set -euo pipefail
-          
-          DEPLOYMENT_ID=$(gh api "repos/${GITHUB_REPOSITORY}/deployments" \
-            -X POST \
-            -f ref="${REF_SHA}" \
-            -f environment="${TARGET_ENV}" \
-            -f description="Deploy image ${IMAGE_TAG}" \
-            -F auto_merge=false \
-            -F required_contexts[] \
-            --jq '.id')
-          
-          if [ -z "$DEPLOYMENT_ID" ]; then
-            echo "::error::Failed to create deployment"
-            exit 1
-          fi
-          
-          echo "deployment_id=$DEPLOYMENT_ID" >> "$GITHUB_OUTPUT"
-          echo "Created deployment: $DEPLOYMENT_ID"
-      
-      - name: Set deployment status to in_progress
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          
-          gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
-            -X POST \
-            -f state="in_progress" \
-            -f description="Deployment in progress..." \
-            -f log_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-      
-      - name: Trigger deployment webhook
-        id: webhook
-        env:
-          DEPLOY_WEBHOOK_URL: ${{ secrets.DEPLOY_WEBHOOK_URL }}
-          DEPLOY_WEBHOOK_SECRET: ${{ secrets.DEPLOY_WEBHOOK_SECRET }}
-          DOCKER_REPO_NAME: ${{ secrets.DOCKER_REPO_NAME }}
-          IMAGE_TAG: ${{ inputs.image_tag }}
-          TARGET_ENV: ${{ inputs.environment }}
-          REF_SHA: ${{ inputs.sha || github.sha }}
-          DEPLOYMENT_ID: ${{ steps.deployment.outputs.deployment_id }}
-        run: |
-          set -euo pipefail
-          
-          if [ -z "$DEPLOY_WEBHOOK_URL" ]; then
-            echo "::error::DEPLOY_WEBHOOK_URL secret is not configured"
-            echo "Please add the DEPLOY_WEBHOOK_URL secret in your repository settings"
-            echo "status=failure" >> "$GITHUB_OUTPUT"
-            exit 1
-          fi
-          
-          REPO_NAME="${DOCKER_REPO_NAME:-opensourcepos/opensourcepos}"
-          REPO_NAMESPACE="${REPO_NAME%%/*}"
-          REPO_SHORT_NAME="${REPO_NAME#*/}"
-          PUSHED_AT=$(date +%s)
-          
-          PAYLOAD=$(jq -n \
-            --arg callback_url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
-            --argjson pushed_at "$PUSHED_AT" \
-            --arg pusher "$GITHUB_ACTOR" \
-            --arg tag "$IMAGE_TAG" \
-            --arg repo_name "$REPO_NAME" \
-            --arg name "$REPO_SHORT_NAME" \
-            --arg namespace "$REPO_NAMESPACE" \
-            --arg repo_url "https://hub.docker.com/r/${REPO_NAME}/" \
-            --arg deployment_id "$DEPLOYMENT_ID" \
-            --arg environment "$TARGET_ENV" \
-            --arg repository "$GITHUB_REPOSITORY" \
-            --arg sha "$REF_SHA" \
-            --arg run_id "$GITHUB_RUN_ID" \
-            --arg actor "$GITHUB_ACTOR" \
-            '{
-              callback_url: $callback_url,
-              push_data: {pushed_at: $pushed_at, pusher: $pusher, tag: $tag},
-              repository: {repo_name: $repo_name, name: $name, namespace: $namespace, repo_url: $repo_url, status: "Active"},
-              github_deployment: {id: $deployment_id, environment: $environment, repository: $repository, sha: $sha, run_id: $run_id, actor: $actor}
-            }')
-          
-          echo "Sending webhook..."
-          echo "Image: ${IMAGE_TAG}"
-          echo "Environment: ${TARGET_ENV}"
-          
-          HEADERS=(-H "Content-Type: application/json")
-          
-          if [ -n "$DEPLOY_WEBHOOK_SECRET" ]; then
-            SIGNATURE=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "$DEPLOY_WEBHOOK_SECRET" | sed 's/.*= //')
-            HEADERS+=(-H "X-Hub-Signature-256: sha256=$SIGNATURE")
-            echo "Using HMAC-SHA256 signature verification"
-          else
-            echo "::warning::DEPLOY_WEBHOOK_SECRET not set - webhook calls will not be signed"
-            echo "For security, configure DEPLOY_WEBHOOK_SECRET in your repository settings"
-          fi
-          
-          HTTP_CODE=$(curl -sS --connect-timeout 10 --max-time 120 \
-            -o response.txt -w "%{http_code}" \
-            -X POST \
-            "${HEADERS[@]}" \
-            -d "$PAYLOAD" \
-            "$DEPLOY_WEBHOOK_URL") || HTTP_CODE="000"
-          
-          echo "Response code: $HTTP_CODE"
-          if [ -s response.txt ]; then
-            cat response.txt
-          fi
-          
-          if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
-            echo "status=success" >> "$GITHUB_OUTPUT"
-          else
-            echo "status=failure" >> "$GITHUB_OUTPUT"
-          fi
-      
-      - name: Set deployment status
-        if: always()
-        env:
-          GH_TOKEN: ${{ github.token }}
-          IMAGE_TAG: ${{ inputs.image_tag }}
-          TARGET_ENV: ${{ inputs.environment }}
-        run: |
-          set -euo pipefail
-          
-          STATE="${{ steps.webhook.outputs.status }}"
-          
-          if [ "$STATE" = "success" ]; then
-            DESCRIPTION=$(jq -nr --arg tag "$IMAGE_TAG" --arg env "$TARGET_ENV" \
-              '"Deployed image \($tag) to \($env)"')
-            
-            gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
-              -X POST \
-              -f state="success" \
-              -f description="$DESCRIPTION"
-          else
-            gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
-              -X POST \
-              -f state="failure" \
-              -f description="Deployment failed"
-            exit 1
-          fi
--- a/6
+++ b/6
@@ -7,17 +7,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
    && docker-php-ext-install mysqli bcmath intl gd \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* \
-    && a2enmod rewrite \
-    && sed -i 's/AllowOverride None/AllowOverride All/' /etc/apache2/apache2.conf
+    && a2enmod rewrite

 RUN echo "date.timezone = \"\${PHP_TIMEZONE}\"" > /usr/local/etc/php/conf.d/timezone.ini

 WORKDIR /app
 COPY --chown=www-data:www-data . /app
 RUN chmod 770 /app/writable/uploads /app/writable/logs /app/writable/cache \
-    && mkdir -p /app/public/uploads/item_pics \
-    && chown www-data:www-data /app/public/uploads/item_pics \
-    && chmod 640 /app/.env \
    && ln -s /app/*[^public] /var/www \
    && rm -rf /var/www/html \
    && ln -nsf /app/public /var/www/html
--- a/app/Config/App.php
+++ b/app/Config/App.php
@@ -327,9 +327,8 @@ class App extends BaseConfig
            $errorMessage =
                'Security: allowedHostnames is not configured. ' .
                'Host header injection protection is disabled. ' .
-                'Either set app.allowedHostnames in your .env file ' .
-                '(e.g., app.allowedHostnames = "example.com,www.example.com") ' .
-                'or configure $allowedHostnames in app/Config/App.php. ' .
+                'Set app.allowedHostnames in your .env file. ' .
+                'Example: app.allowedHostnames = "example.com,www.example.com" ' .
                'Received Host: ' . $httpHost;

            // Production: Fail explicitly to prevent silent security vulnerabilities
--- a/app/Libraries/MY_Migration.php
+++ b/app/Libraries/MY_Migration.php
@@ -25,7 +25,7 @@ class MY_Migration extends MigrationRunner
    public function get_latest_migration(): int
    {
        $migrations = $this->findMigrations();
-        return basename(end($migrations)->version);
+        return (int) basename(end($migrations)->version);
    }

    /**
@@ -41,7 +41,7 @@ class MY_Migration extends MigrationRunner
                $builder = $db->table('migrations');
                $builder->select('version')->orderBy('version', 'DESC')->limit(1);
                $result = $builder->get()->getRow();
-                return $result ? $result->version : 0;
+                return $result ? (int) $result->version : 0;
            }
        } catch (\Exception $e) {
            // Database not available yet (e.g. fresh install before schema).