static-analysis.yml

name: Static Analysis

# Builds a full Magento install ONCE (build-magento) and shares it via an
# artifact, so multiple static-analysis tools (PHPStan, Mago analyze) run
# against the same Magento codebase instead of each rebuilding it. The analysis
# jobs need no live database — they only read code — so they run in parallel
# without service containers.

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  # Heavy shared Magento build — cancel superseded PR runs to save CI minutes;
  # let push/main runs finish so main is always validated directly.
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  build-magento:
    name: Build Magento (shared)
    runs-on: ubuntu-latest

    services:
      mariadb:
        image: mariadb:11.4
        env:
          MYSQL_ROOT_PASSWORD: magento
          MYSQL_DATABASE: magento
        ports:
          - 3306:3306
        options: --health-cmd="healthcheck.sh --connect --innodb_initialized" --health-interval=10s --health-timeout=5s --health-retries=3

      opensearch:
        image: opensearchproject/opensearch:3
        ports:
          - 9200:9200
        env:
          discovery.type: single-node
          DISABLE_SECURITY_PLUGIN: true
          OPENSEARCH_JAVA_OPTS: -Xms512m -Xmx512m
        options: --health-cmd="curl http://localhost:9200/_cluster/health" --health-interval=10s --health-timeout=5s --health-retries=10

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          path: mageforge

      - name: Set up Magento
        uses: ./mageforge/.github/actions/setup-magento
        with:
          php-version: "8.4"
          magento-version: 2.4.8
          magento-source: mage-os
          composer-auth: ${{ secrets.COMPOSER_AUTH }}

      - name: Install MageForge module and PHPStan tooling
        working-directory: magento2
        run: |
          # Add the module from the current checkout as a copied (non-symlinked)
          # path repository so its source ends up inside the shared artifact.
          composer config repositories.mageforge-local '{"type": "path", "url": "../mageforge", "options": {"symlink": false}}'
          composer require --no-update openforgeproject/mageforge:@dev

          # Allow the PHPStan extension installer plugin
          composer config --no-plugins allow-plugins.phpstan/extension-installer true

          # PHPStan + Magento extension (consumed by the phpstan job). Pinned to
          # exact versions: phpstan.neon opts into bleedingEdge, whose rules
          # change between releases, so an unpinned `^2.0` lets a new PHPStan
          # release fail unrelated PRs. Bump these deliberately (keep in sync
          # with the locally installed PHPStan) instead of floating.
          composer require --dev --no-update "bitexpert/phpstan-magento:0.43.0" "phpstan/phpstan:2.2.2" phpstan/extension-installer

          composer update --with-dependencies
          bin/magento setup:upgrade

          # phpstan.neon and tests/ are export-ignored, so the copied path
          # repository omits them; place them next to the analysed source so the
          # phpstan job can analyse both `src` and `tests` (per phpstan.neon).
          cp ../mageforge/phpstan.neon vendor/openforgeproject/mageforge/phpstan.neon
          cp -r ../mageforge/tests vendor/openforgeproject/mageforge/tests

      - name: Pack Magento install
        run: |
          # Exclude runtime-only/disposable dirs to keep the artifact small;
          # static analysis only needs vendor/, app/, generated/ and app/etc/.
          tar czf magento.tar.gz \
            --exclude='magento2/var' \
            --exclude='magento2/pub/static' \
            --exclude='magento2/pub/media' \
            --exclude='magento2/.git' \
            --exclude='magento2/dev/tests' \
            magento2

      - name: Upload Magento artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: magento-build
          path: magento.tar.gz
          retention-days: 1
          compression-level: 0 # already gzipped

  phpstan:
    name: PHPStan Analysis
    runs-on: ubuntu-latest
    needs: build-magento

    steps:
      - name: Setup PHP
        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
        with:
          php-version: "8.4"
          extensions: mbstring, intl, gd, xml, soap, zip, bcmath, pdo_mysql, curl, sockets
          tools: composer:v2

      - name: Download Magento artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: magento-build

      - name: Unpack Magento install
        run: tar xzf magento.tar.gz

      - name: Run PHPStan
        working-directory: magento2
        run: |
          vendor/bin/phpstan analyse -c vendor/openforgeproject/mageforge/phpstan.neon

  mago-analyze:
    name: Mago Analyze
    runs-on: ubuntu-latest
    needs: build-magento

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          path: mageforge

      - name: Setup PHP
        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
        with:
          php-version: "8.4"
          tools: composer:v2

      - name: Cache Composer packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.composer/cache/files
          key: ${{ runner.os }}-composer-mago-${{ hashFiles('mageforge/composer.json') }}
          restore-keys: ${{ runner.os }}-composer-mago

      - name: Install module dev dependencies (Mago binary)
        working-directory: mageforge
        run: composer install --no-interaction --no-progress

      - name: Download Magento artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: magento-build

      - name: Unpack Magento install
        run: tar xzf magento.tar.gz

      # Run Mago from inside the built Magento (workspace = magento2), so the
      # `includes = ["vendor"]` from mago.toml resolves the full Magento class
      # graph. Only the module source is analyzed; phtml templates and the
      # Magento-idiomatic `mixed-*` codes are filtered via mago.toml. The Mago
      # binary and config come from the separate module checkout (its
      # require-dev isn't part of the artifact). mago.toml sets
      # `minimum-fail-level = "note"`, so any finding (including warnings and
      # help messages) fails this job — green means a completely clean report.
      - name: Mago analyze
        working-directory: magento2
        env:
          # `paths = ["src"]` from mago.toml has no match under this workspace
          # (module source is analyzed via the vendor copy), which logs a
          # harmless "Failed to walk" warning. Log only real errors — findings
          # and the exit code are unaffected. Raise to `warn` when debugging
          # incomplete-analysis problems (e.g. vendor files that fail to parse).
          MAGO_LOG: error
        run: |
          ../mageforge/vendor/bin/mago \
            --config ../mageforge/mago.toml \
            analyze vendor/openforgeproject/mageforge/src \
            --reporting-format=github