## # Reusable CI workflow — peptiderepo estate # # Usage (in any repo's .github/workflows/ci.yml): # # jobs: # ci: # uses: peptiderepo/peptide-e2e/.github/workflows/ci.yml@main # with: # tests: stubs # or wp-framework | brain-monkey | none # has_js: false # secrets: inherit # # Inputs: # php_versions (string) JSON array of PHP versions to matrix over. # Default: '["8.1","8.2","8.3"]' # tests (string) PHPUnit environment. One of: # stubs — WP stubs only; no DB/service; fast. # brain-monkey — Brain Monkey mocking; no DB/service. # wp-framework — Full WordPress test framework with MySQL. # none — Skip phpunit entirely (temporary; remove # at rollout when the repo gains a suite). # Default: stubs # enforce_300 (boolean) Fail if any tracked *.php under line_limit_paths exceeds # 300 lines (the estate hard rule). Default: true # line_limit_paths (string) Space-separated directory/path(s) the 300-line rule # applies to. Default: 'includes' # has_js (boolean) Whether to run JS linting. Default: false # phpcs_autofix (boolean) On pull_request events: run phpcbf and commit any fixes # back to the branch before strict phpcs. On push events: # skip the commit (no loop) but still run strict phpcs. # Default: true # # Job names (fixed — callers and deploy-app.yml gate on these): # lint-php PHP syntax check across php_versions matrix. # phpcs WordPress Coding Standards; phpcbf auto-commit on PRs. # file-size 300-line rule enforcement (skipped when enforce_300: false). # phpunit PHPUnit across php_versions matrix (skipped when tests: none). # lint-js JS linting (skipped when has_js: false). # # Design notes: # - phpcbf auto-commit pattern is the prautoblogger gold standard (see # prautoblogger/.github/workflows/ci.yml). The GITHUB_TOKEN commit does # NOT trigger a new CI run per GitHub's loop-prevention rules. # - WP test framework path replicates peptide-starter-theme's three gotchas: # (1) install svn — ubuntu-latest no longer ships it; # (2) MySQL service pre-creates the DB via MYSQL_DATABASE, so pass # skip-db-create=true as the 6th arg to install-wp-tests.sh; # (3) WP_CORE_DIR must have a trailing slash (bootstrapped into ABSPATH # and concatenated verbatim — missing slash produces wrong path). # - Every repo calls `composer test` regardless of the `tests` input; the # input only controls environment provisioning, not the command. # - permissions: the phpcs job declares `contents: write` at job level for # phpcbf commit-back. GitHub requires the CALLING WORKFLOW to also declare # `permissions: contents: write` at the caller's workflow level — GH enforces # that callers cannot be escalated beyond their declared scope, even by job-level # overrides in the reusable workflow. All caller repos must include this. ## name: CI — Reusable on: workflow_call: inputs: php_versions: description: >- JSON array of PHP versions to matrix over. Example: '["8.1","8.2","8.3"]' required: false default: '["8.1","8.2","8.3"]' type: string tests: description: >- PHPUnit environment. One of: stubs | wp-framework | brain-monkey | none. All environments run `composer test`; this input controls setup only. required: false default: stubs type: string enforce_300: description: >- Fail if any tracked *.php under line_limit_paths exceeds 300 lines. required: false default: true type: boolean line_limit_paths: description: >- Space-separated directory/path(s) to which the 300-line rule applies. required: false default: includes type: string has_js: description: >- Whether to run JS linting (node --check / npm run lint). required: false default: false type: boolean phpcs_autofix: description: >- On pull_request: run phpcbf and commit fixes back to the branch before strict phpcs. On push: skip the commit but still run strict phpcs. required: false default: true type: boolean jobs: # --------------------------------------------------------------------------- # lint-php: PHP syntax check — matrix over php_versions # --------------------------------------------------------------------------- lint-php: name: PHP Lint (${{ matrix.php }}) runs-on: ubuntu-latest strategy: fail-fast: false matrix: php: ${{ fromJson(inputs.php_versions) }} steps: - uses: actions/checkout@v4 - name: Setup PHP ${{ matrix.php }} uses: shivammathur/setup-php@v2 with: php-version: ${{ matrix.php }} coverage: none - name: Syntax check all PHP files # Exclude vendor/, node_modules/, .git/, .github/ (mu-plugins may use # version-specific syntax). -P4 parallelises across 4 cores. run: | set -e find . -name '*.php' \ -not -path './vendor/*' \ -not -path './node_modules/*' \ -not -path './.git/*' \ -not -path './.github/*' \ -print0 | xargs -0 -n1 -P4 php -l > /dev/null # --------------------------------------------------------------------------- # phpcs: WordPress Coding Standards + phpcbf auto-fix on PRs # --------------------------------------------------------------------------- phpcs: name: PHPCS (WordPress standards) runs-on: ubuntu-latest permissions: contents: write # allows phpcbf auto-fix commits back to the PR branch steps: - uses: actions/checkout@v4 with: # Check out the actual PR branch head so phpcbf can push fixes back. # On push events github.head_ref is empty; fall back to github.ref_name. ref: ${{ github.head_ref || github.ref_name }} token: ${{ secrets.GITHUB_TOKEN }} - name: Setup PHP uses: shivammathur/setup-php@v2 with: php-version: '8.1' coverage: none tools: composer:v2, phpcs - name: Install WordPress Coding Standards run: | composer global config --no-plugins \ allow-plugins.dealerdirect/phpcodesniffer-composer-installer true composer global require --no-interaction \ "dealerdirect/phpcodesniffer-composer-installer:^1.0" \ "wp-coding-standards/wpcs:^3.0" \ "phpcsstandards/phpcsutils:^1.0" \ "phpcsstandards/phpcsextra:^1.0" - name: Auto-fix with phpcbf (PR only — commit back to branch if changed) # Only runs on pull_request events AND when phpcs_autofix is enabled. # phpcbf exits 1 when it makes fixes and 0 when nothing to fix; both are # treated as success here (|| true). Commits via GITHUB_TOKEN do NOT # trigger a new CI run — GitHub prevents loops on bot commits. if: ${{ github.event_name == 'pull_request' && inputs.phpcs_autofix }} run: | phpcbf --standard=phpcs.xml \ --extensions=php \ --ignore=vendor/*,tests/*,node_modules/* \ . || true if ! git diff --quiet; then git config user.name "peptiderepo" git config user.email "peptiderepo@users.noreply.github.com" git add -A git commit -m "style: auto-fix PHPCS violations via phpcbf" git push fi - name: Run PHPCS strict (fail on remaining violations) # Runs on all events (push AND pull_request). After phpcbf has committed # any auto-fixable issues on PRs, only non-auto-fixable violations land # here. On push events phpcbf is skipped but phpcs is still strict. run: | phpcs --standard=phpcs.xml \ --extensions=php \ --ignore=vendor/*,tests/*,node_modules/* \ --warning-severity=0 \ --report=full \ . # --------------------------------------------------------------------------- # file-size: 300-line rule enforcement # --------------------------------------------------------------------------- file-size: name: 300-line rule (${{ inputs.line_limit_paths }}) runs-on: ubuntu-latest if: ${{ inputs.enforce_300 }} steps: - uses: actions/checkout@v4 - name: Check for PHP files over 300 lines # Scans only tracked *.php files under line_limit_paths (not vendor etc.). # Prints every offender with its line count, then fails the job so the # engineer has a clear list to split. run: | set -e PATHS="${{ inputs.line_limit_paths }}" OFFENDERS="" for DIR in $PATHS; do if [ ! -e "$DIR" ]; then echo "Warning: path '$DIR' does not exist in this repo — skipping." continue fi while IFS= read -r FILE; do if [ -z "$FILE" ]; then continue; fi LINES=$(wc -l < "$FILE") if [ "$LINES" -gt 300 ]; then OFFENDERS="${OFFENDERS}${LINES} lines: ${FILE}\n" fi done < <(git ls-files -- "$DIR" | grep '\.php$') done if [ -n "$OFFENDERS" ]; then echo "::error::Files exceeding 300-line limit (estate hard rule):" printf "%b" "$OFFENDERS" exit 1 fi echo "All tracked PHP files under '$PATHS' are within the 300-line limit." # --------------------------------------------------------------------------- # phpunit: PHPUnit — matrix over php_versions # Skipped entirely when tests == 'none'. # --------------------------------------------------------------------------- phpunit: name: PHPUnit — ${{ inputs.tests }} (PHP ${{ matrix.php }}) runs-on: ubuntu-latest if: ${{ inputs.tests != 'none' }} strategy: fail-fast: false matrix: php: ${{ fromJson(inputs.php_versions) }} # MySQL service is declared for all variants but only connected when # tests == 'wp-framework'. On stubs/brain-monkey the service starts but is # never touched — marginal overhead, keeps the YAML unconditional. services: mysql: image: mysql:8.0 env: MYSQL_ROOT_PASSWORD: root # The WP test bootstrap expects this DB to exist. Passing # skip-db-create=true (6th arg) to install-wp-tests.sh relies on # MySQL having created it already via this env var. MYSQL_DATABASE: wp_tests ports: - 3306:3306 options: >- --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=5 steps: - uses: actions/checkout@v4 - name: Install subversion (wp-framework only) # ubuntu-latest no longer ships svn. The WP test-suite bootstrap script # checks out develop.svn.wordpress.org via svn. # Gotcha #1 of the three known WP PHPUnit CI gotchas. if: ${{ inputs.tests == 'wp-framework' }} run: sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends subversion - name: Setup PHP ${{ matrix.php }} uses: shivammathur/setup-php@v2 with: php-version: ${{ matrix.php }} coverage: none tools: composer:v2 extensions: ${{ inputs.tests == 'wp-framework' && 'mysqli' || '' }} - name: Install Composer dependencies run: composer install --no-progress --no-interaction --prefer-dist - name: Wait for MySQL (wp-framework only) if: ${{ inputs.tests == 'wp-framework' }} run: | for i in {1..30}; do if mysqladmin ping -h 127.0.0.1 -P 3306 -u root -proot --silent; then echo "MySQL is up"; break fi echo "Waiting for MySQL... ($i/30)"; sleep 2 done - name: Install WordPress test suite (wp-framework only) # Gotcha #2: pass skip-db-create=true (6th arg) — the MySQL service # already created wp_tests via MYSQL_DATABASE; re-creating it fails. # Gotcha #3: WP_CORE_DIR must end with a trailing slash. The bootstrap # concatenates this verbatim as ABSPATH + 'wp-settings.php'. Without # the slash: '/tmp/wordpresswp-settings.php' -> fatal bootstrap error. if: ${{ inputs.tests == 'wp-framework' }} env: WP_TESTS_DIR: /tmp/wordpress-tests-lib WP_CORE_DIR: /tmp/wordpress/ run: | chmod +x bin/install-wp-tests.sh bin/install-wp-tests.sh wp_tests root root 127.0.0.1:3306 latest true - name: Run PHPUnit # Every repo calls `composer test` regardless of environment. # The repo's composer.json `test` script points to vendor/bin/phpunit # with the appropriate phpunit.xml config for that repo. env: WP_TESTS_DIR: /tmp/wordpress-tests-lib run: composer test # --------------------------------------------------------------------------- # lint-js: JavaScript linting (only when has_js == true) # --------------------------------------------------------------------------- lint-js: name: JS Lint runs-on: ubuntu-latest if: ${{ inputs.has_js }} steps: - uses: actions/checkout@v4 - name: Setup Node uses: actions/setup-node@v4 with: node-version: '20' cache: 'npm' - name: Install npm dependencies run: npm ci - name: Lint JavaScript # Prefer `npm run lint` if the repo defines it (catches ESLint etc.). # Fall back to `node --check` syntax-only scan on all *.js files. run: | if npm run lint --if-present 2>/dev/null; then echo "npm run lint executed." else echo "No 'lint' npm script — falling back to node --check syntax scan." find . -name '*.js' \ -not -path './vendor/*' \ -not -path './node_modules/*' \ -not -path './.git/*' \ -print0 | xargs -0 -I{} node --check {} fi