basic-qa.yml

name: Basic QA checks

on:
  push:
  pull_request:
  # Allow manually triggering the workflow.
  workflow_dispatch:

# Cancels all previous workflow runs for the same branch that have not yet completed.
concurrency:
  # The concurrency group contains the workflow name and the branch name.
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Permissions should be configured at the job level.
permissions: {}

env:
  PHPCS_DEV: '3.x-dev'
  UTILS_DEV: 'dev-develop'
  EXTRA_DEV: 'dev-develop'

jobs:
  # Check code style of sniffs, rulesets and XML documentation.
  # Check that all sniffs are feature complete.
  sniffs:
    permissions:
      contents: read # To clone the repo.

    name: Run code sniffs
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup PHP
        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
        with:
          php-version: 'latest'
          coverage: none
          tools: cs2pr

      # @link https://getcomposer.org/doc/03-cli.md#validate
      - name: Validate the composer.json file
        run: composer validate --no-check-all --strict

      # Using dev versions of the dependencies as an early detection system for bugs upstream.
      - name: "Composer: set PHPCS dependencies (dev)"
        run: >
          composer require --no-update --no-scripts --no-interaction
          squizlabs/php_codesniffer:"${{ env.PHPCS_DEV }}"
          phpcsstandards/phpcsutils:"${{ env.UTILS_DEV }}"
          phpcsstandards/phpcsextra:"${{ env.EXTRA_DEV }}"

      - name: Install Composer dependencies
        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
        with:
          # Bust the cache at least once a month - output format: YYYY-MM.
          custom-cache-suffix: $(date -u "+%Y-%m")

      - name: Check the code style of the PHP files
        id: phpcs
        run: vendor/bin/phpcs --report-full --report-checkstyle=./phpcs-report.xml

      - name: Show PHPCS results in PR
        if: ${{ always() && steps.phpcs.outcome == 'failure' }}
        run: cs2pr ./phpcs-report.xml

      # Validate the Ruleset XML files.
      # @link http://xmlsoft.org/xmllint.html
      - name: Validate the WordPress rulesets
        uses: phpcsstandards/xmllint-validate@5189514594c8d5f4cf21b7e5af50f54d697973d7 # v2.0.0
        with:
          pattern: "./*/ruleset.xml"
          xsd-file: "vendor/squizlabs/php_codesniffer/phpcs.xsd"

      - name: Validate the sample ruleset
        uses: phpcsstandards/xmllint-validate@5189514594c8d5f4cf21b7e5af50f54d697973d7 # v2.0.0
        with:
          pattern: "phpcs.xml.dist.sample"
          xsd-file: "vendor/squizlabs/php_codesniffer/phpcs.xsd"

      # Validate the Documentation XML files.
      - name: Validate documentation against schema
        uses: phpcsstandards/xmllint-validate@5189514594c8d5f4cf21b7e5af50f54d697973d7 # v2.0.0
        with:
          pattern: "./WordPress/Docs/*/*Standard.xml"
          xsd-file: "vendor/phpcsstandards/phpcsdevtools/DocsXsd/phpcsdocs.xsd"

      - name: Validate Project PHPCS ruleset against schema
        uses: phpcsstandards/xmllint-validate@5189514594c8d5f4cf21b7e5af50f54d697973d7 # v2.0.0
        with:
          pattern: ".phpcs.xml.dist"
          xsd-file: "vendor/squizlabs/php_codesniffer/phpcs.xsd"

      - name: "Validate PHPUnit config for use with PHPUnit 8"
        uses: phpcsstandards/xmllint-validate@5189514594c8d5f4cf21b7e5af50f54d697973d7 # v2.0.0
        with:
          pattern: "phpunit.xml.dist"
          xsd-file: "vendor/phpunit/phpunit/schema/8.5.xsd"

      - name: "Validate PHPUnit config for use with PHPUnit 9"
        uses: phpcsstandards/xmllint-validate@5189514594c8d5f4cf21b7e5af50f54d697973d7 # v2.0.0
        with:
          pattern: "phpunit.xml.dist"
          xsd-file: "vendor/phpunit/phpunit/schema/9.2.xsd"

      # Check that the sniffs available are feature complete.
      # For now, just check that all sniffs have unit tests.
      # At a later stage the documentation check can be activated.
      - name: Check sniff feature completeness
        run: composer check-complete

  xml-cs:
    permissions:
      contents: read # To clone the repo.

    name: 'XML Code style'
    runs-on: ubuntu-latest

    env:
      XMLLINT_INDENT: '	'

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # Updating the lists can fail intermittently, typically after Microsoft has released a new package.
      # This should not be blocking for this job, so ignore any errors from this step.
      # Ref: https://github.com/dotnet/core/issues/4167
      - name: Update the available packages list
        continue-on-error: true
        run: sudo apt-get update

      - name: Install xmllint
        run: sudo apt-get install --no-install-recommends -y libxml2-utils

      # Show XML violations inline in the file diff.
      - name: Enable showing XML issues inline
        uses: korelstar/xmllint-problem-matcher@dd2ad21bd8a2de0187cb621419537f345e7e509c # v1.3.0

      - name: Check the code-style consistency of the xml files
        run: |
          diff -B --tabsize=4 ./WordPress/ruleset.xml <(xmllint --format "./WordPress/ruleset.xml")
          diff -B --tabsize=4 ./WordPress-Core/ruleset.xml <(xmllint --format "./WordPress-Core/ruleset.xml")
          diff -B --tabsize=4 ./WordPress-Docs/ruleset.xml <(xmllint --format "./WordPress-Docs/ruleset.xml")
          diff -B --tabsize=4 ./WordPress-Extra/ruleset.xml <(xmllint --format "./WordPress-Extra/ruleset.xml")
          diff -B --tabsize=4 ./phpcs.xml.dist.sample <(xmllint --format "./phpcs.xml.dist.sample")

  # Makes sure the rulesets don't throw unexpected errors or warnings.
  # This workflow needs to be run against a high PHP version to prevent triggering the syntax error check.
  # It also needs to be run against all dependency versions WPCS is tested against.
  ruleset-tests:
    permissions:
      contents: read # To clone the repo.

    strategy:
      matrix:
        php: ['latest']
        dependencies: ['lowest', 'stable', 'dev']

    name: "Ruleset test: PHP ${{ matrix.php }} on PHPCS ${{ matrix.dependencies }}"
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up PHP
        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
        with:
          php-version: ${{ matrix.php }}
          # Allow for PHP deprecation notices.
          ini-values: error_reporting = E_ALL & ~E_DEPRECATED
          coverage: none
        env:
          fail-fast: true

      - name: "Composer: set PHPCS dependencies for tests (dev)"
        if: ${{ matrix.dependencies == 'dev' }}
        run: >
          composer require --no-update --no-scripts --no-interaction
          squizlabs/php_codesniffer:"${{ env.PHPCS_DEV }}"
          phpcsstandards/phpcsutils:"${{ env.UTILS_DEV }}"
          phpcsstandards/phpcsextra:"${{ env.EXTRA_DEV }}"

      - name: Enable creation of `composer.lock` file
        if: ${{ matrix.dependencies == 'lowest' }}
        run: composer config --unset lock

      - name: Install Composer dependencies
        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
        with:
          composer-options: --no-dev
          # Bust the cache at least once a month - output format: YYYY-MM.
          custom-cache-suffix: $(date -u "+%Y-%m")

      - name: "Composer: downgrade PHPCS dependencies for tests (lowest)"
        if: ${{ matrix.dependencies == 'lowest' }}
        run: >
          composer update --prefer-lowest --no-scripts --no-interaction
          squizlabs/php_codesniffer
          phpcsstandards/phpcsutils
          phpcsstandards/phpcsextra

      - name: Test the WordPress-Core ruleset
        run: vendor/bin/phpcs -ps ./Tests/RulesetCheck/class-ruleset-test.inc --standard=WordPress-Core

      - name: Test the WordPress-Docs ruleset
        run: vendor/bin/phpcs -ps ./Tests/RulesetCheck/class-ruleset-test.inc --standard=WordPress-Docs

      - name: Test the WordPress-Extra ruleset
        run: vendor/bin/phpcs -ps ./Tests/RulesetCheck/class-ruleset-test.inc --standard=WordPress-Extra

      - name: Test the WordPress ruleset
        run: vendor/bin/phpcs -ps ./Tests/RulesetCheck/class-ruleset-test.inc --standard=WordPress

      - name: Rename the example ruleset to one which can be used for a ruleset
        run:  cp phpcs.xml.dist.sample sample.xml

      - name: Test the example ruleset
        run: vendor/bin/phpcs -ps ./Tests/RulesetCheck/example-ruleset-test.inc --standard=./sample.xml

      # Test for fixer conflicts by running the auto-fixers of the complete WPCS over the test case files.
      # This is not an exhaustive test, but should give an early indication for typical fixer conflicts.
      # If only fixable errors are found, the exit code will be 1, which can be interpreted as success.
      # This check is only run against "dev" as conflicts can not be fixed for already released versions.
      - name: Test for fixer conflicts (fixes expected)
        if: ${{ matrix.dependencies == 'dev' }}
        id: phpcbf
        continue-on-error: true
        # yamllint disable rule:line-length
        run: |
          set +e
          vendor/bin/phpcbf -pq ./WordPress/Tests/ --standard=WordPress --extensions=inc --exclude=Generic.PHP.Syntax --report=summary --ignore=/WordPress/Tests/WP/GlobalVariablesOverrideUnitTest.7.inc
          exitcode="$?"
          echo "EXITCODE=$exitcode" >> "$GITHUB_OUTPUT"
          exit "$exitcode"

        # yamllint enable rule:line-length

      - name: Fail the build on fixer conflicts and other errors
        if: ${{ steps.phpcbf.outputs.EXITCODE != 0 && steps.phpcbf.outputs.EXITCODE != 1 }}
        run: |
          # shellcheck disable=SC2242 # Exit code will result in either 0 or 1, this is fine.
          exit "${{ steps.phpcbf.outputs.EXITCODE }}"

  phpstan:
    permissions:
      contents: read # To clone the repo.

    name: "PHPStan"
    runs-on: "ubuntu-latest"

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install PHP
        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
        with:
          php-version: 'latest'
          coverage: none
          tools: phpstan:1.x
        env:
          fail-fast: true

      # Install dependencies and handle caching in one go.
      # Dependencies need to be installed to make sure the PHPCS and PHPUnit classes are recognized.
      # @link https://github.com/marketplace/actions/install-php-dependencies-with-composer
      - name: Install Composer dependencies
        uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # 4.0.0
        with:
          # Bust the cache at least once a month - output format: YYYY-MM.
          custom-cache-suffix: $(date -u "+%Y-%m")

      - name: Run PHPStan
        run: phpstan analyse

  typos-check:
    permissions:
      contents: read # To clone the repo.

    name: "Find typos"
    runs-on: "ubuntu-latest"

    steps:
      - name: "Checkout"
        uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
        with:
          persist-credentials: false

      - name: "Search for misspellings"
        uses: "crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b" # v1.51.1

  pinact:
    permissions:
      contents: read # To clone the repo.

    name: 'Run Pinact'
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # See: https://github.com/suzuki-shunsuke/pinact/blob/main/README.md
      # See: https://github.com/suzuki-shunsuke/pinact/blob/main/docs/codes/001.md
      - name: Verify action runners are pinned
        uses: suzuki-shunsuke/pinact-action@896d595f299e71d65b9d28349d6956abe144390a # v3.0.0
        with:
          github_token: ${{secrets.GITHUB_TOKEN}}
          skip_push: "true"
          update: "true"
          fix: "true"
          verify: "true" # = verify trailing version comments
          verify_min_age: "true" # verify base on cooldown period
          review: ${{ github.event_name == 'pull_request' }}
          reviewdog_level: "error"

  yamllint:
    permissions:
      contents: read # To clone the repo.

    name: 'Lint Yaml'
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # Ref: https://yamllint.readthedocs.io/en/stable/
      - name: Run Yamllint on all yaml files in repo
        run: yamllint . --format colored --strict

      - name: Pipe Yamllint results on to GH for inline display
        if: ${{ failure() }}
        run: yamllint . --format github --strict

  actionlint:
    permissions:
      contents: read # To clone the repo.

    name: 'Check GHA workflows'
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Add problem matcher
        if: ${{ github.event_name == 'pull_request' }}
        shell: bash
        run: |
          curl -o actionlint-matcher.json https://raw.githubusercontent.com/rhysd/actionlint/main/.github/actionlint-matcher.json
          echo "::add-matcher::actionlint-matcher.json"

      - name: Check workflow files
        uses: docker://rhysd/actionlint:latest
        with:
          args: -color