mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-11-08 23:43:32 -05:00
BudsieBuds
72a75152ad
- Dockerfile: use rolling php:8.2-apache with expose_php = Off. - Dockerfile: validate runtime against composer.lock at build boundary via BuildKit composer check-platform-reqs. - Dockerfile: enforce least-privilege permissions (root:www-data 0640 files, 0750 dirs), restricting write access to writable/ and public/uploads. - dockerignore: include composer.json and composer.lock in build context for platform validation. - CI: remove redundant bash version checks across workflows; enforce fresh upstream base via pull: true in build-release.yml. - Docs & Changelog: remove security advisory identifiers while preserving minimum patch levels.
64 lines
1.6 KiB
YAML
64 lines
1.6 KiB
YAML
name: Coding Standards
|
|
|
|
on:
|
|
push:
|
|
paths:
|
|
- '**.php'
|
|
- 'spark'
|
|
- '.github/workflows/test-coding-standards.yml'
|
|
pull_request:
|
|
paths:
|
|
- '**.php'
|
|
- 'spark'
|
|
- '.github/workflows/test-coding-standards.yml'
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
lint:
|
|
name: PHP ${{ matrix.php-version }} Lint with PHP CS Fixer
|
|
runs-on: ubuntu-22.04
|
|
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
php-version:
|
|
- '8.2'
|
|
- '8.3'
|
|
- '8.4'
|
|
- '8.5'
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup PHP
|
|
uses: shivammathur/setup-php@v2
|
|
with:
|
|
php-version: ${{ matrix.php-version }}
|
|
extensions: tokenizer
|
|
coverage: none
|
|
|
|
- name: Get composer cache directory
|
|
run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_ENV
|
|
|
|
- name: Cache dependencies
|
|
uses: actions/cache@v3
|
|
with:
|
|
path: ${{ env.COMPOSER_CACHE_FILES_DIR }}
|
|
key: ${{ runner.os }}-${{ matrix.php-version }}-${{ hashFiles('**/composer.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-${{ matrix.php-version }}-
|
|
${{ runner.os }}-
|
|
|
|
- name: Install dependencies
|
|
run: composer update --ansi --no-interaction
|
|
|
|
- name: Run lint on `app/`, `public/`
|
|
run: vendor/bin/php-cs-fixer fix --verbose --ansi --dry-run --config=.php-cs-fixer.no-header.php --using-cache=no --diff
|