quality.yml

name: Quality

on:
  pull_request:
    paths:
      - 'app/**'
      - 'public/**'
      - 'resources/**'
      - 'tests/**'
      - 'scripts/**'
      - 'writable/**'
      - 'composer.json'
      - 'composer.lock'
      - 'package.json'
      - 'package-lock.json'
      - '.node-version'
      - '.nvmrc'
      - 'Dockerfile'
      - '.dockerignore'
      - 'docker/**'
      - 'docker-compose*.yml'
      - 'nginx.conf.example'
      - 'spark'
      - 'env'
      - 'preload.php'
      - '.htaccess'
      - 'build.sh'
      - 'phpstan*'
      - 'phpunit*'
      - 'playwright.config.js'
      - '.github/workflows/**'
      - '.github/actions/**'
  push:
    branches:
      - main
    paths:
      - 'app/**'
      - 'public/**'
      - 'resources/**'
      - 'tests/**'
      - 'scripts/**'
      - 'writable/**'
      - 'composer.json'
      - 'composer.lock'
      - 'package.json'
      - 'package-lock.json'
      - '.node-version'
      - '.nvmrc'
      - 'Dockerfile'
      - '.dockerignore'
      - 'docker/**'
      - 'docker-compose*.yml'
      - 'nginx.conf.example'
      - 'spark'
      - 'env'
      - 'preload.php'
      - '.htaccess'
      - 'build.sh'
      - 'phpstan*'
      - 'phpunit*'
      - 'playwright.config.js'
      - '.github/workflows/**'
      - '.github/actions/**'
  workflow_call:
  workflow_dispatch:

concurrency:
  group: quality-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.ref == 'refs/heads/main' }}

permissions:
  contents: read

jobs:
  php:
    name: PHP ${{ matrix.php }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        php: ["8.2", "8.3", "8.4", "8.5"]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup PHP
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
        with:
          php-version: ${{ matrix.php }}
          extensions: curl, dom, gd, intl, mbstring, sqlite3, xml, zip
          tools: composer:2.10.2
          coverage: none

      - name: Cache Composer downloads
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.composer/cache/files
          key: composer-${{ runner.os }}-${{ hashFiles('composer.lock') }}
          restore-keys: composer-${{ runner.os }}-

      - name: Validate Composer configuration
        run: composer validate --strict --no-check-publish

      - name: Install dependencies
        run: composer install --no-interaction --prefer-dist

      - name: Check PHP syntax
        if: matrix.php == '8.2'
        run: find app tests -type f -name '*.php' -print0 | xargs -0 -n1 php -l

      - name: Run tests
        run: composer test

      - name: Run PHPStan baseline analysis
        if: matrix.php == '8.2'
        run: composer static:phpstan

      - name: Verify native storage backend
        if: matrix.php == '8.2'
        run: |
          native_write_path="$(mktemp -d)"
          mkdir -p "$native_write_path/file" "$native_write_path/sqlite"
          EXTPLORER_WRITE_PATH="$native_write_path/file" php spark storage:check
          EXTPLORER_WRITE_PATH="$native_write_path/sqlite" EXTPLORER_STATE_DRIVER=sqlite php spark security:migrate
          EXTPLORER_WRITE_PATH="$native_write_path/sqlite" EXTPLORER_STATE_DRIVER=sqlite php spark storage:check

  storage-mysql:
    name: Storage integration (mysql)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    services:
      mysql:
        image: mysql:8.4
        env:
          MYSQL_ROOT_PASSWORD: root
          MYSQL_DATABASE: extplorer
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping -h 127.0.0.1 -uroot -proot"
          --health-interval=5s
          --health-timeout=5s
          --health-retries=20
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Verify MySQL backend
        uses: ./.github/actions/storage-check
        with:
          backend: mysql

  storage-postgres:
    name: Storage integration (postgres)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    services:
      postgres:
        image: postgres:17-alpine
        env:
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: extplorer
        ports:
          - 5432:5432
        options: >-
          --health-cmd="pg_isready -U postgres -d extplorer"
          --health-interval=5s
          --health-timeout=5s
          --health-retries=20
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Verify PostgreSQL backend
        uses: ./.github/actions/storage-check
        with:
          backend: postgres

  storage-redis:
    name: Storage integration (redis)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    services:
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd="redis-cli ping"
          --health-interval=5s
          --health-timeout=5s
          --health-retries=20
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Verify Redis backend
        uses: ./.github/actions/storage-check
        with:
          backend: redis

  frontend:
    name: Frontend build and CSP source checks
    runs-on: ubuntu-latest
    timeout-minutes: 8
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .node-version
          cache: npm

      - name: Install frontend dependencies
        run: npm ci

      - name: Compile Vue templates
        run: npm run build:js

      - name: Build and check translations
        run: |
          node scripts/build-i18n.js
          node scripts/check-i18n.js

      - name: Verify generated translations are committed
        run: git diff --exit-code -- public/assets/i18n

      - name: Verify generated frontend assets
        run: git diff --exit-code -- public/assets/js/compiled public/assets/js/vue.runtime.global.prod.js

      - name: Reject unsafe inline CSP regressions
        run: |
          if rg -n '<script(?![^>]*(?:nonce=|csp_script_nonce\(\)))(?![^>]*src=)|<style(?![^>]*(?:nonce=|csp_style_nonce\(\)))' app/Views --pcre2; then
            echo 'Unsafe inline script or style found.' >&2
            exit 1
          fi
          if rg -n '\s(on[a-z]+|style)=' app/Views --pcre2; then
            echo 'Inline event handler or style attribute found.' >&2
            exit 1
          fi

  webserver:
    name: Web server compatibility (${{ matrix.server }})
    runs-on: ubuntu-latest
    timeout-minutes: 8
    strategy:
      fail-fast: false
      matrix:
        server: [apache, nginx]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Validate Nginx configuration
        if: matrix.server == 'nginx'
        run: |
          temporary_directory="$(mktemp -d)"
          sed -e 's/__EXTPLORER_UPLOAD_LIMIT__/100m/g' \
              -e 's/fastcgi_pass extplorer-app:9000;/fastcgi_pass 127.0.0.1:9000;/' \
              docker/nginx/default.conf > "$temporary_directory/default.conf"
          docker run --rm \
            -v "$temporary_directory/default.conf:/etc/nginx/conf.d/default.conf:ro" \
            nginx:1.31.3-alpine3.24 nginx -t

      - name: Validate Apache configuration
        if: matrix.server == 'apache'
        run: |
          temporary_directory="$(mktemp -d)"
          cat > "$temporary_directory/httpd.conf" <<'EOF'
          ServerRoot "/usr/local/apache2"
          Listen 80
          LoadModule mpm_event_module modules/mod_mpm_event.so
          LoadModule authz_core_module modules/mod_authz_core.so
          LoadModule authz_host_module modules/mod_authz_host.so
          LoadModule dir_module modules/mod_dir.so
          LoadModule mime_module modules/mod_mime.so
          LoadModule rewrite_module modules/mod_rewrite.so
          TypesConfig conf/mime.types
          DocumentRoot "/usr/local/apache2/htdocs"
          <Directory "/usr/local/apache2/htdocs">
              AllowOverride All
              Require all granted
          </Directory>
          EOF
          docker run --rm \
            -v "$temporary_directory/httpd.conf:/tmp/httpd.conf:ro" \
            -v "$PWD/public:/usr/local/apache2/htdocs:ro" \
            httpd:2.4-alpine httpd -t -f /tmp/httpd.conf

  docker:
    name: Docker + Chromium E2E
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      COMPOSE_PROJECT_NAME: extplorer-e2e
      E2E_BASE_URL: http://127.0.0.1:8080
      EXTPLORER_BASE_URL: http://127.0.0.1:8080/
      E2E_USERNAME: e2e-admin
      E2E_PASSWORD: e2e-admin-password
      EXTPLORER_ADMIN_PASSWORD_HOST_FILE: ${{ github.workspace }}/.extplorer-admin-password-ci
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .node-version
          cache: npm

      - name: Ensure Ace assets
        run: bash ./scripts/ensure-ace-assets.sh

      - name: Prepare chmod-600 secret overlay fixture
        run: |
          umask 077
          printf '%s\n' "$E2E_PASSWORD" > "$EXTPLORER_ADMIN_PASSWORD_HOST_FILE"
          chmod 600 "$EXTPLORER_ADMIN_PASSWORD_HOST_FILE"

      - name: Validate Docker entrypoints
        run: |
          test -r docker/nginx/entrypoint.sh
          test -x docker/nginx/entrypoint.sh
          test "$(git ls-files -s docker/nginx/entrypoint.sh | cut -d' ' -f1)" = 100755

      - name: Build image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          push: false
          load: true
          tags: extplorer3:e2e
          build-args: APP_VERSION=ci
          cache-from: type=gha,scope=extplorer-image-amd64
          cache-to: type=gha,mode=max,scope=extplorer-image-amd64

      - name: Scan image for high and critical vulnerabilities
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: extplorer3:e2e
          format: table
          exit-code: "1"
          ignore-unfixed: true
          severity: CRITICAL,HIGH

      - name: Install E2E dependencies
        run: |
          npm ci
          npm audit --audit-level=high
          npm run e2e:install

      - name: Start E2E stack
        run: docker compose -f docker-compose.yml -f docker-compose.secrets.yml.example -f tests/e2e/docker-compose.yml up --detach --wait --wait-timeout 120

      - name: Verify secret bootstrap drops to non-root FPM
        run: |
          app_container="$(docker compose -f docker-compose.yml -f docker-compose.secrets.yml.example -f tests/e2e/docker-compose.yml ps -q extplorer-app)"
          docker top "$app_container" -eo user,pid,args | awk 'NR > 1 {print $1}' | sort -u | grep -qx 82

      - name: Verify atomic code release rollback
        run: |
          initial_release="$(docker compose -f docker-compose.yml -f docker-compose.secrets.yml.example -f tests/e2e/docker-compose.yml exec --no-TTY extplorer-app readlink /var/www/html/current | sed 's#^.releases/##')"
          docker compose -f docker-compose.yml -f docker-compose.secrets.yml.example -f tests/e2e/docker-compose.yml run --rm -e EXTPLORER_CODE_FORCE=1 extplorer-init
          updated_release="$(docker compose -f docker-compose.yml -f docker-compose.secrets.yml.example -f tests/e2e/docker-compose.yml exec --no-TTY extplorer-app readlink /var/www/html/current | sed 's#^.releases/##')"
          test "$updated_release" != "$initial_release"
          docker compose -f docker-compose.yml -f docker-compose.secrets.yml.example -f tests/e2e/docker-compose.yml run --rm extplorer-init --rollback "$initial_release"
          test "$(docker compose -f docker-compose.yml -f docker-compose.secrets.yml.example -f tests/e2e/docker-compose.yml exec --no-TTY extplorer-app readlink /var/www/html/current | sed 's#^.releases/##')" = "$initial_release"
          docker compose -f docker-compose.yml -f docker-compose.secrets.yml.example -f tests/e2e/docker-compose.yml exec --no-TTY extplorer-app php /var/www/html/current/spark system:readiness

      - name: Run Chromium smoke tests
        run: npm run e2e

      - name: Collect container logs
        if: failure()
        run: docker compose -f docker-compose.yml -f docker-compose.secrets.yml.example -f tests/e2e/docker-compose.yml logs --no-color > e2e-compose.log

      - name: Upload E2E diagnostics
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-diagnostics
          path: |
            e2e-compose.log
            playwright-report
            test-results
          if-no-files-found: ignore
          retention-days: 7

      - name: Stop E2E stack
        if: always()
        run: docker compose -f docker-compose.yml -f docker-compose.secrets.yml.example -f tests/e2e/docker-compose.yml down --volumes --remove-orphans