WordPress-Coding-Standards/.github/workflows/basic-qa.yml

name: Basic QA checks

on:
  push:
  pull_request:
  # Allow manually triggering the workflow.
  workflow_dispatch:

# Cancels all previous workflow runs for the same branch that have not yet completed.
concurrency:
  # The concurrency group contains the workflow name and the branch name.
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  PHPCS_DEV: '3.x-dev'
  UTILS_DEV: 'dev-develop'
  EXTRA_DEV: 'dev-develop'

jobs:
  # Check code style of sniffs, rulesets and XML documentation.
  # Check that all sniffs are feature complete.
  sniffs:
    name: Run code sniffs
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false

      - name: Setup PHP
        uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5
        with:
          php-version: 'latest'
          coverage: none
          tools: cs2pr

      # @link https://getcomposer.org/doc/03-cli.md#validate
      - name: Validate the composer.json file
        run: composer validate --no-check-all --strict

      # Using dev versions of the dependencies as an early detection system for bugs upstream.
      - name: "Composer: set PHPCS dependencies (dev)"
        run: >
          composer require --no-update --no-scripts --no-interaction
          squizlabs/php_codesniffer:"${{ env.PHPCS_DEV }}"
          phpcsstandards/phpcsutils:"${{ env.UTILS_DEV }}"
          phpcsstandards/phpcsextra:"${{ env.EXTRA_DEV }}"

      - name: Install Composer dependencies
        uses: ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520 # 3.1.1
        with:
          # Bust the cache at least once a month - output format: YYYY-MM.
          custom-cache-suffix: $(date -u "+%Y-%m")

      - name: Check the code style of the PHP files
        id: phpcs
        run: vendor/bin/phpcs --report-full --report-checkstyle=./phpcs-report.xml

      - name: Show PHPCS results in PR
        if: ${{ always() && steps.phpcs.outcome == 'failure' }}
        run: cs2pr ./phpcs-report.xml

      # Validate the Ruleset XML files.
      # @link http://xmlsoft.org/xmllint.html
      - name: Validate the WordPress rulesets
        uses: phpcsstandards/xmllint-validate@0fd9c4a9046055f621fca4bbdccb8eab1fd59fdc # v1.0.1
        with:
          pattern: "./*/ruleset.xml"
          xsd-file: "vendor/squizlabs/php_codesniffer/phpcs.xsd"

      - name: Validate the sample ruleset
        uses: phpcsstandards/xmllint-validate@0fd9c4a9046055f621fca4bbdccb8eab1fd59fdc # v1.0.1
        with:
          pattern: "phpcs.xml.dist.sample"
          xsd-file: "vendor/squizlabs/php_codesniffer/phpcs.xsd"

      # Validate the Documentation XML files.
      - name: Validate documentation against schema
        uses: phpcsstandards/xmllint-validate@0fd9c4a9046055f621fca4bbdccb8eab1fd59fdc # v1.0.1
        with:
          pattern: "./WordPress/Docs/*/*Standard.xml"
          xsd-file: "vendor/phpcsstandards/phpcsdevtools/DocsXsd/phpcsdocs.xsd"

      - name: Validate Project PHPCS ruleset against schema
        uses: phpcsstandards/xmllint-validate@0fd9c4a9046055f621fca4bbdccb8eab1fd59fdc # v1.0.1
        with:
          pattern: ".phpcs.xml.dist"
          xsd-file: "vendor/squizlabs/php_codesniffer/phpcs.xsd"

      - name: "Validate PHPUnit config for use with PHPUnit 8"
        uses: phpcsstandards/xmllint-validate@0fd9c4a9046055f621fca4bbdccb8eab1fd59fdc # v1.0.1
        with:
          pattern: "phpunit.xml.dist"
          xsd-file: "vendor/phpunit/phpunit/schema/8.5.xsd"

      - name: "Validate PHPUnit config for use with PHPUnit 9"
        uses: phpcsstandards/xmllint-validate@0fd9c4a9046055f621fca4bbdccb8eab1fd59fdc # v1.0.1
        with:
          pattern: "phpunit.xml.dist"
          xsd-file: "vendor/phpunit/phpunit/schema/9.2.xsd"

      # Check that the sniffs available are feature complete.
      # For now, just check that all sniffs have unit tests.
      # At a later stage the documentation check can be activated.
      - name: Check sniff feature completeness
        run: composer check-complete

  xml-cs:
    name: 'XML Code style'
    runs-on: ubuntu-latest

    env:
      XMLLINT_INDENT: '	'

    steps:
      - name: Checkout code
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false

      # Updating the lists can fail intermittently, typically after Microsoft has released a new package.
      # This should not be blocking for this job, so ignore any errors from this step.
      # Ref: https://github.com/dotnet/core/issues/4167
      - name: Update the available packages list
        continue-on-error: true
        run: sudo apt-get update

      - name: Install xmllint
        run: sudo apt-get install --no-install-recommends -y libxml2-utils

      # Show XML violations inline in the file diff.
      - name: Enable showing XML issues inline
        uses: korelstar/xmllint-problem-matcher@1bd292d642ddf3d369d02aaa8b262834d61198c0 # v1.2.0

      - name: Check the code-style consistency of the xml files
        run: |
          diff -B --tabsize=4 ./WordPress/ruleset.xml <(xmllint --format "./WordPress/ruleset.xml")
          diff -B --tabsize=4 ./WordPress-Core/ruleset.xml <(xmllint --format "./WordPress-Core/ruleset.xml")
          diff -B --tabsize=4 ./WordPress-Docs/ruleset.xml <(xmllint --format "./WordPress-Docs/ruleset.xml")
          diff -B --tabsize=4 ./WordPress-Extra/ruleset.xml <(xmllint --format "./WordPress-Extra/ruleset.xml")
          diff -B --tabsize=4 ./phpcs.xml.dist.sample <(xmllint --format "./phpcs.xml.dist.sample")

  # Makes sure the rulesets don't throw unexpected errors or warnings.
  # This workflow needs to be run against a high PHP version to prevent triggering the syntax error check.
  # It also needs to be run against all dependency versions WPCS is tested against.
  ruleset-tests:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        php: [ 'latest' ]
        dependencies: [ 'lowest', 'stable', 'dev' ]

    name: "Ruleset test: PHP ${{ matrix.php }} on PHPCS ${{ matrix.dependencies }}"

    steps:
      - name: Checkout repository
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false

      - name: Set up PHP
        uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5
        with:
          php-version: ${{ matrix.php }}
          # Allow for PHP deprecation notices.
          ini-values: error_reporting = E_ALL & ~E_DEPRECATED
          coverage: none

      - name: "Composer: set PHPCS dependencies for tests (dev)"
        if: ${{ matrix.dependencies == 'dev' }}
        run: >
          composer require --no-update --no-scripts --no-interaction
          squizlabs/php_codesniffer:"${{ env.PHPCS_DEV }}"
          phpcsstandards/phpcsutils:"${{ env.UTILS_DEV }}"
          phpcsstandards/phpcsextra:"${{ env.EXTRA_DEV }}"

      - name: Enable creation of `composer.lock` file
        if: ${{ matrix.dependencies == 'lowest' }}
        run: composer config --unset lock

      - name: Install Composer dependencies
        uses: ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520 # 3.1.1
        with:
          composer-options: --no-dev
          # Bust the cache at least once a month - output format: YYYY-MM.
          custom-cache-suffix: $(date -u "+%Y-%m")

      - name: "Composer: downgrade PHPCS dependencies for tests (lowest)"
        if: ${{ matrix.dependencies == 'lowest' }}
        run: >
          composer update --prefer-lowest --no-scripts --no-interaction
          squizlabs/php_codesniffer
          phpcsstandards/phpcsutils
          phpcsstandards/phpcsextra

      - name: Test the WordPress-Core ruleset
        run: $(pwd)/vendor/bin/phpcs -ps ./Tests/RulesetCheck/class-ruleset-test.inc --standard=WordPress-Core

      - name: Test the WordPress-Docs ruleset
        run: $(pwd)/vendor/bin/phpcs -ps ./Tests/RulesetCheck/class-ruleset-test.inc --standard=WordPress-Docs

      - name: Test the WordPress-Extra ruleset
        run: $(pwd)/vendor/bin/phpcs -ps ./Tests/RulesetCheck/class-ruleset-test.inc --standard=WordPress-Extra

      - name: Test the WordPress ruleset
        run: $(pwd)/vendor/bin/phpcs -ps ./Tests/RulesetCheck/class-ruleset-test.inc --standard=WordPress

      - name: Rename the example ruleset to one which can be used for a ruleset
        run:  cp phpcs.xml.dist.sample sample.xml

      - name: Test the example ruleset
        run: $(pwd)/vendor/bin/phpcs -ps ./Tests/RulesetCheck/example-ruleset-test.inc --standard=./sample.xml

      # Test for fixer conflicts by running the auto-fixers of the complete WPCS over the test case files.
      # This is not an exhaustive test, but should give an early indication for typical fixer conflicts.
      # If only fixable errors are found, the exit code will be 1, which can be interpreted as success.
      # This check is only run against "dev" as conflicts can not be fixed for already released versions.
      - name: Test for fixer conflicts (fixes expected)
        if: ${{ matrix.dependencies == 'dev' }}
        id: phpcbf
        continue-on-error: true
        run: |
          set +e
          $(pwd)/vendor/bin/phpcbf -pq ./WordPress/Tests/ --standard=WordPress --extensions=inc --exclude=Generic.PHP.Syntax --report=summary --ignore=/WordPress/Tests/WP/GlobalVariablesOverrideUnitTest.7.inc
          exitcode="$?"
          echo "EXITCODE=$exitcode" >> "$GITHUB_OUTPUT"
          exit "$exitcode"

      - name: Fail the build on fixer conflicts and other errors
        if: ${{ steps.phpcbf.outputs.EXITCODE != 0 && steps.phpcbf.outputs.EXITCODE != 1 }}
        run: exit ${{ steps.phpcbf.outputs.EXITCODE }}

  phpstan:
    name: "PHPStan"

    runs-on: "ubuntu-latest"

    steps:
      - name: Checkout code
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false

      - name: Install PHP
        uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5
        with:
          php-version: 'latest'
          coverage: none
          tools: phpstan:1.x

      # Install dependencies and handle caching in one go.
      # Dependencies need to be installed to make sure the PHPCS and PHPUnit classes are recognized.
      # @link https://github.com/marketplace/actions/install-php-dependencies-with-composer
      - name: Install Composer dependencies
        uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # 3.1.1
        with:
          # Bust the cache at least once a month - output format: YYYY-MM.
          custom-cache-suffix: $(date -u "+%Y-%m")

      - name: Run PHPStan
        run: phpstan analyse

  typos-check:
    name: "Find typos"

    runs-on: "ubuntu-latest"

    steps:
      - name: "Checkout"
        uses: "actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3" # v6.0.0
        with:
          persist-credentials: false

      - name: "Search for misspellings"
        uses: "crate-ci/typos@626c4bedb751ce0b7f03262ca97ddda9a076ae1c" # v1.39.2