Skip to content

Fix unsafe PHPCS pull request workflow #2945

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
RabbiIslamRony wants to merge 1 commit into
base: development
Choose a base branch
from
Open

Fix unsafe PHPCS pull request workflow #2945

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 31 additions & 10 deletions .github/workflows/phpcs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,13 @@
name: PHPCS Check

on:
pull_request_target:
pull_request:
paths:
- '**/*.php' # Run only when PHP files change
- '**/*.php' # Run when PHP files change
- '.github/workflows/phpcs.yml'

permissions:
contents: read

# Concurrency: Ensure only one instance of this workflow runs per pull request or commit.
# If a new workflow for the same pull request/commit is triggered, the previous one will be canceled.
Expand All @@ -16,13 +20,12 @@ jobs:
name: PHPCS Check
runs-on: ubuntu-latest
steps:
# Step 1: Checkout the code from the pull request base branch to ensure we're analyzing the correct changes.
# Step 1: Checkout the unprivileged pull request merge commit.
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@v4
with:
# checkout the PR branch, not the base
ref: ${{ github.event.pull_request.head.sha }}
fetch-depth: 0 # ensures full history
fetch-depth: 0
persist-credentials: false

# Step 2: Set up PHP 7.4 with necessary configurations. Also, install the "cs2pr" tool for converting PHPCS output into annotations.
- name: Setup PHP
Expand All @@ -35,8 +38,26 @@ jobs:

# Step 3: Install all required Composer dependencies for the project.
- name: Install Composer dependencies
run: composer install
run: composer install --no-interaction --prefer-dist --no-progress

# Step 4: Collect changed PHP files without losing special characters in filenames.
- name: Detect changed PHP files
id: changed-php
shell: bash
run: |
git diff --name-only -z --diff-filter=ACMRT \
"${{ github.event.pull_request.base.sha }}...HEAD" -- '*.php' \
> "$RUNNER_TEMP/php-files"

if [[ -s "$RUNNER_TEMP/php-files" ]]; then
echo "has_files=true" >> "$GITHUB_OUTPUT"
else
echo "has_files=false" >> "$GITHUB_OUTPUT"
fi

# Step 4: Run the PHPCS check using the "composer phpcs" command to detect coding standard violations.
# Step 5: Run PHPCS only against PHP files changed by this pull request.
- name: Run PHPCS checks
run: composer phpcs
if: steps.changed-php.outputs.has_files == 'true'
shell: bash
run: |
xargs -0 composer phpcs -- --warning-severity=0 -- < "$RUNNER_TEMP/php-files"
Loading