ci: add a working CI gate - #698
Open
alexisLefebvre wants to merge 12 commits into
Open
Conversation
Triggers without requiring a label, unlike the deployment workflow, so bot-opened dependency bumps are gated too. The install is frozen, so a lockfile out of sync with the manifest fails instead of being silently resolved. The package manager version is activated globally rather than left to the manifest, the dependency cache being resolved from the repository root where nothing pins it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The shared config this project extends reports everything as a warning, by design, so the linter always exited zero and the check it feeds could never fail. Rules covering code that cannot work as written, rather than matters of style, are now errors, which leaves formatting and unused symbols as warnings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The framework and profiler bundles dropped their XML routing resources in favour of PHP ones, but the imports were never updated, so every console command run in the dev environment aborted while loading the router. Installing dependencies failed with it, its post-install scripts warming the dev cache. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Runs the config, template and container linters, which catch a bundle upgrade that breaks service wiring or removes a resource an import still points at. Validation of the manifest also fails when the lock file has drifted out of sync with it. The test environment is forced, so the job never loads the development toolbar and profiler, which are irrelevant to a gate and pull in more surface than they are worth. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Actions are pinned to full commit SHAs, which the repository settings can require and which a mutable tag cannot guarantee. The token feeding the front-end build falls back to the run token, absent a personal one on forks, the contributors fetch being rate-limited without either. Helm was pulled in as part of the cloud SDK, whose own constraint forced an old interpreter alongside it. Nothing in the job talks to that cloud, so it is installed on its own instead. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
Author
|
Oops, after opening this PR I saw that a previous PR already restored the CI job: I cherry-picked the changes here. |
The schema was created when sequences were the default generation strategy on this platform. The mapping layer since defaults to identity columns, and expects a column default the migrations never created, so every insert sent a null primary key and the database refused it. The preference is now declared rather than inherited, which the mapping layer also asks for by deprecation. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The test runner defaults to failing on any deprecation, legacy ones aside, which the current dependency versions emit from inside their own internals, on a passing suite. Nothing in this repository can silence those, so the threshold now applies to the group attributed to our own code and leaves the rest reported but harmless. It is passed to the container rather than declared in the test configuration: the handler freezes its settings on the first deprecation, which is emitted while classes are still being autoloaded, before that configuration is read. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
It was the last step of the container job, so any earlier failure skipped it and a malformed chart stayed hidden behind an unrelated one. Nothing it reads comes from that job, the chart being linted straight off the checkout, so it now runs on its own and in parallel. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
alexisLefebvre
force-pushed
the
ci/gate
branch
from
August 11, 2026 12:39
de31109 to
15506ec
Compare
The compose file now reads it from the environment, so the instructions to write it into a file left contributors with an unauthenticated, and therefore rate-limited, fetch of the contributors list. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Rewrites
ci.ymlinto four jobs running onpull_request.PWA: frozen pnpm install, then ESLint. API: Composer manifest and lock validation, then the config, template and container linters. Tests: the Docker stack, its reachability probes, PHPUnit and the schema validator. Helm: chart lint.
The Tests job comes from #661 by @Maxcastel, cherry-picked with its authorship. On top of it: actions pinned to commit SHAs, a token fallback so the front-end build is not rate-limited on forks, Helm installed on its own rather than through the cloud SDK and its old interpreter, and the chart lint moved out into its own job so it no longer hides behind a test failure.
Four fixes were needed to get every job green, each in its own commit:
Out of scope: a static analyser, and the TypeScript check, the latter needing the gitignored
php-web.mjsbuilt by thephpwasmstage.🤖 Generated with Claude Code