chore: continuous integration for the PHP toolchain - #4
Conversation
Runs the same gates CI will enforce on every pull request, so "it passed locally" stops being the only evidence. Jobs: - php: PHPCS, PHPStan, HPOS sniff self-test and PHPUnit, on a 8.2/8.3 matrix - secrets: gitleaks over full history - verify: aggregates the above into one check Matrix rationale. 8.2 is the supported floor and what Composer resolves against; 8.3 is what local development and the production host run. A break on either is a real break, so fail-fast is off — knowing both results is worth more than finishing thirty seconds sooner. The verify job exists so branch protection has a single stable check to require. Requiring matrix legs by name means protection silently stops covering any leg added later, which is the kind of gap nobody notices until it matters. gitleaks checks out full history rather than the tip. On a public repository a secret removed in a later commit is still public, so scanning only the tip would miss exactly the case that matters. Dependabot covers Composer and GitHub Actions weekly. The npm ecosystem is deliberately absent: there is no JavaScript toolchain yet, because registry.npmjs.org is unreachable from the development environment. Adding the ecosystem before the manifest exists would produce noise, not updates. Refs #4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe pull request adds a GitHub Actions CI workflow, full-history gitleaks scanning, aggregate verification, weekly Composer and GitHub Actions Dependabot updates, and related changelog entries. ChangesCI and dependency automation
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant PHPMatrix
participant Gitleaks
participant Verify
GitHubActions->>PHPMatrix: Run PHP 8.2 and 8.3 checks
GitHubActions->>Gitleaks: Scan full repository history
PHPMatrix-->>Verify: Report PHP job result
Gitleaks-->>Verify: Report secret-scan result
Verify-->>GitHubActions: Fail unless both jobs succeed
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Acceptance criteria verifiedBoth halves now confirmed with real Actions runs. Positive — CI green on a clean PR (run 31023640492):
Negative — CI red on a violation (run 31023761248, throwaway branch, now deleted): A file calling Failed on both PHP legs, and the aggregate The custom sniff works in a clean CI environment, not just locally. Throwaway branch and PR #5 are closed and deleted. Remaining: "merge is blocked" still needs branch protection (#5). CI currently reports but cannot block. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 32-35: Update the GitHub Actions versions in the CI workflow:
replace actions/checkout@v4 with actions/checkout@v6 and
gitleaks/gitleaks-action@v2 with gitleaks/gitleaks-action@v3, leaving the
surrounding workflow configuration unchanged.
In `@CHANGELOG.md`:
- Line 91: Update the changelog entry for Issues `#05` and `#06` to state that
branch protection is deferred or will be configured, rather than claiming it is
already configured; keep the deploy-workflow status accurate.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 3f35333b-41da-422e-ae60-66833f99bcd5
📒 Files selected for processing (3)
.github/dependabot.yml.github/workflows/ci.ymlCHANGELOG.md
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up PHP ${{ matrix.php }} | ||
| uses: shivammathur/setup-php@v2 |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
for action in actions/checkout gitleaks/gitleaks-action; do
ref=$([ "$action" = "actions/checkout" ] && printf 'v4' || printf 'v2')
curl -fsSL "https://raw.githubusercontent.com/${action}/${ref}/action.yml" |
grep -E '^[[:space:]]*using:[[:space:]]*["'\'']?node'
doneRepository: YonatanVol/ElectricChic
Length of output: 196
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/ci.yml
printf '%s\n' '--- action metadata ---'
for spec in \
actions/checkout:v4 actions/checkout:v5 actions/checkout:v6 \
gitleaks/gitleaks-action:v2 gitleaks/gitleaks-action:v3; do
repo=${spec%:*}
ref=${spec#*:}
printf '\n[%s@%s]\n' "$repo" "$ref"
if curl -fsSL "https://raw.githubusercontent.com/$repo/$ref/action.yml" |
grep -E '^[[:space:]]*using:[[:space:]]*["'\'']?node|^[[:space:]]*name:|^[[:space:]]*runs:'; then
:
else
printf 'metadata unavailable\n'
fi
done
printf '%s\n' '--- tag refs ---'
for repo in actions/checkout gitleaks/gitleaks-action; do
printf '\n[%s]\n' "$repo"
curl -fsSL "https://api.github.com/repos/$repo/git/refs/tags" |
jq -r '.[].ref' | grep -E '/v[0-9]+(\.[0-9]+){0,2}$' | tail -20
doneRepository: YonatanVol/ElectricChic
Length of output: 3814
🌐 Web query:
GitHub Actions Node 20 deprecation September 16 2026 Node 24 actions deadline
💡 Result:
As of August 5, 2026, GitHub is actively managing the transition from Node.js 20 to Node.js 24 for GitHub Actions runners [1]. The key dates and status of this migration are as follows: - Node.js 20 Default Transition: GitHub successfully updated the runner default to Node.js 24 on June 16, 2026 [1][2]. - Node.js 20 Removal: Node.js 20 is scheduled to be fully removed from GitHub Actions runners in the fall of 2026 [1]. While some community discussions and pull requests have referenced mid-September dates [3], the official timeline maintains a "fall of 2026" goal for the complete removal of Node.js 20 [1]. Migrating to Node.js 24: Actions maintainers are advised to update their actions to support Node.js 24 [1]. Users can check if their workflows are using deprecated Node.js 20 actions through warning annotations provided at the end of job execution [4]. Temporary Opt-Out: For workflows that still require Node.js 20, users can temporarily opt out of the Node.js 24 default by setting the environment variable ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true [1][5]. This is an interim measure and will cease to function once Node.js 20 is completely removed from the runners later this fall [1].
Citations:
- 1: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
- 2: Update Node 24 default date to June 16th, 2026 actions/runner#4462
- 3: Support Node.js 24 for GitHub Actions (Node 20 deprecation) googleapis/code-suggester#550
- 4: Add Node.js 20 deprecation warning annotation (Phase 1) actions/runner#4242
- 5: Node 20 -> Node 24 migration feature flagging, opt-in and opt-out environment variables actions/runner#3948
🌐 Web query:
actions/checkout v6 release Node 24 gitleaks/gitleaks-action v3 release
💡 Result:
Both actions/checkout v6 and gitleaks/gitleaks-action v3 were released to support the transition to Node 24 in GitHub Actions [1][2][3]. actions/checkout v6 Released on November 20, 2025 [1][4], actions/checkout v6 includes updates to support the Node 24 runtime [1]. Using this version ensures compatibility with the GitHub Actions environment as Node 20 is deprecated [3]. It requires a minimum Actions Runner version of v2.329.0 for specific features, such as persisting credentials in Docker container scenarios [5]. Note that as of August 2026, newer versions (e.g., v7) are available [6][7]. gitleaks/gitleaks-action v3 Released on May 30, 2026 [2][8], gitleaks/gitleaks-action v3 migrates the runtime from Node 20 to Node 24 [2][3]. This version is a direct replacement for v2, with no changes to inputs, outputs, or behavior [2][9]. Upgrading is necessary because GitHub is deprecating Node 20; Node 20 support on GitHub-hosted runners is scheduled to be removed entirely on September 16, 2026 [3][10]. v3 requires GitHub Actions runner v2.327.1 or later [3][9].
Citations:
- 1: https://github.com/actions/checkout/releases/tag/v6.0.0
- 2: https://github.com/gitleaks/gitleaks-action/releases/tag/v3.0.0
- 3: https://github.com/gitleaks/gitleaks-action
- 4: actions/checkout@v5.0.0...v6.0.0
- 5: https://github.com/actions/checkout/tree/v6.0.0
- 6: https://github.com/actions/checkout/releases
- 7: https://github.com/actions/checkout
- 8: https://github.com/gitleaks/gitleaks-action/releases
- 9: https://github.com/marketplace/actions/gitleaks
- 10: gitleaks-action v2 deprecation — migrate to v3 before September 2026 gitleaks/gitleaks-action#218
Update the Node 20 actions before CI runs.
actions/checkout@v4 and gitleaks/gitleaks-action@v2 use Node 20. Replace them with actions/checkout@v6 and gitleaks/gitleaks-action@v3, which use Node 24, before GitHub removes Node 20 support in fall 2026.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 32 - 35, Update the GitHub Actions
versions in the CI workflow: replace actions/checkout@v4 with
actions/checkout@v6 and gitleaks/gitleaks-action@v2 with
gitleaks/gitleaks-action@v3, leaving the surrounding workflow configuration
unchanged.
| floor rather than the local runtime. | ||
| - No application code yet. No WordPress, no WooCommerce, no plugin or theme. | ||
| - Repository visibility, CI, and branch protection are configured in Issues #04–#06. | ||
| - Branch protection and deploy workflows are configured in Issues #05 and #06. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Mark branch protection as deferred.
This PR does not configure branch protection. Change “are configured” to “are deferred” or “will be configured” for Issue #05. The PR objective explicitly defers branch-protection enforcement.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CHANGELOG.md` at line 91, Update the changelog entry for Issues `#05` and `#06`
to state that branch protection is deferred or will be configured, rather than
claiming it is already configured; keep the deploy-workflow status accurate.
1 participant
Issue #4 — CI. This PR verifies itself: the workflow runs against this very branch, so the Actions result below is the acceptance evidence.
What changed
.github/workflows/ci.yml— three jobs:php(matrix),secrets,verify.github/dependabot.yml— weekly Composer + GitHub Actions updatesJobs
phpsecretsverifyDesign decisions worth reviewing
Matrix is 8.2 + 8.3,
fail-fast: false. 8.2 is the supported floor and what Composer resolves against; 8.3 is local and production. A break on either is a real break, so knowing both results beats finishing thirty seconds sooner.The
verifyjob exists for branch protection. Requiring matrix legs by name means protection silently stops covering any leg added later — a gap nobody notices until it matters. One aggregating check avoids that. Issue #5 will requireverifyand nothing else.gitleaks uses
fetch-depth: 0. On a public repo, a secret removed in a later commit is still public. Scanning only the tip would miss precisely the case that matters.No npm job, and no npm in Dependabot. There is no JavaScript toolchain yet —
registry.npmjs.orgis unreachable from the dev environment (see PR #3). Adding the ecosystem before a manifest exists produces noise, not updates. Both get added when the toolchain lands.Acceptance criteria (master plan §20, Issue #4)
The second half needs branch protection (#5) to observe "merge blocked". I can demonstrate the red half here on request by pushing a deliberate violation, or fold it into #5 where the blocking behaviour is actually testable.
Notes / limitations
ramsey/composer-install@v3caches dependencies between runs.permissions: contents: readat workflow level; gitleaks gets only the default token.Rollback
git revert <merge-commit>. Removes CI; no runtime impact.Summary by CodeRabbit
Chores
Documentation