reusable-php-static-analysis.yml

##
# A reusable workflow that runs PHP Static Analysis tests.
##
name: PHP Static Analysis

on:
  workflow_call:
    inputs:
      php-version:
        description: 'The PHP version to use.'
        required: false
        type: 'string'
        default: 'latest'

# Disable permissions for all available scopes by default.
# Any needed permissions should be configured at the job level.
permissions: {}

jobs:
  # Runs PHP static analysis tests.
  #
  # Violations are reported inline with annotations.
  #
  # Performs the following steps:
  # - Checks out the repository.
  # - Sets up PHP.
  # - Logs debug information.
  # - Installs Composer dependencies.
  # - Configures caching for PHP static analysis scans.
  # - Make Composer packages available globally.
  # - Runs PHPStan static analysis (with Pull Request annotations).
  # - Saves the PHPStan result cache.
  # - Ensures version-controlled files are not modified or deleted.
  phpstan:
    name: Run PHP static analysis
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    timeout-minutes: 20

    steps:
      - name: Checkout repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version-file: '.nvmrc'
          cache: npm

      - name: Set up PHP
        uses: shivammathur/setup-php@20529878ed81ef8e78ddf08b480401e6101a850f # v2.35.3
        with:
          php-version: ${{ inputs.php-version }}
          coverage: none
          tools: cs2pr

      # This date is used to ensure that the Composer cache is cleared at least once every week.
      # http://man7.org/linux/man-pages/man1/date.1.html
      - name: "Get last Monday's date"
        id: get-date
        run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"

      - name: General debug information
        run: |
          npm --version
          node --version
          composer --version

      # Since Composer dependencies are installed using `composer update` and no lock file is in version control,
      # passing a custom cache suffix ensures that the cache is flushed at least once per week.
      - name: Install Composer dependencies
        uses: ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520 # v3.1.1
        with:
          custom-cache-suffix: ${{ steps.get-date.outputs.date }}

      - name: Make Composer packages available globally
        run: echo "${PWD}/vendor/bin" >> "$GITHUB_PATH"

      - name: Install npm dependencies
        run: npm ci

      - name: Build WordPress
        run: npm run build:dev

      - name: Cache PHP Static Analysis scan cache
        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: .cache # This is defined in the base.neon file.
          key: "phpstan-result-cache-${{ github.run_id }}"
          restore-keys: |
            phpstan-result-cache-

      - name: Run PHP static analysis tests
        id: phpstan
        run: phpstan analyse -vvv --error-format=checkstyle | cs2pr

      - name: "Save result cache"
        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
        if: ${{ !cancelled() }}
        with:
          path: .cache
          key: "phpstan-result-cache-${{ github.run_id }}"

      - name: Ensure version-controlled files are not modified or deleted
        run: git diff --exit-code