Skip to content

Commit e440790

Browse files
juradeejuradee
committed
- enforce release creation only after successful CI build
- make CI dependency installation deterministic via `composer install` (lockfile-based) - add security checks to CI (`composer audit`) and add `roave/security-advisories` to dev dependencies - add professional repository standards: `SECURITY.md`, `CONTRIBUTING.md`, CODEOWNERS, issue and PR templates
1 parent 0660490 commit e440790

9 files changed

Lines changed: 170 additions & 4 deletions

File tree

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @dorazil

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: Bug report
2+
description: Report a reproducible defect
3+
title: "[Bug]: "
4+
labels:
5+
- bug
6+
body:
7+
- type: markdown
8+
attributes:
9+
value: |
10+
Thanks for reporting a bug. Please provide enough details to reproduce it.
11+
- type: textarea
12+
id: summary
13+
attributes:
14+
label: Summary
15+
description: What is wrong?
16+
placeholder: Briefly describe the issue.
17+
validations:
18+
required: true
19+
- type: input
20+
id: version
21+
attributes:
22+
label: Package version
23+
placeholder: e.g. 6.0.0
24+
validations:
25+
required: true
26+
- type: textarea
27+
id: steps
28+
attributes:
29+
label: Steps to reproduce
30+
placeholder: |
31+
1. ...
32+
2. ...
33+
3. ...
34+
validations:
35+
required: true
36+
- type: textarea
37+
id: expected
38+
attributes:
39+
label: Expected behavior
40+
validations:
41+
required: true
42+
- type: textarea
43+
id: actual
44+
attributes:
45+
label: Actual behavior
46+
validations:
47+
required: true

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Feature request
2+
description: Propose an enhancement
3+
title: "[Feature]: "
4+
labels:
5+
- enhancement
6+
body:
7+
- type: textarea
8+
id: problem
9+
attributes:
10+
label: Problem statement
11+
description: What limitation are you hitting?
12+
validations:
13+
required: true
14+
- type: textarea
15+
id: proposal
16+
attributes:
17+
label: Proposed solution
18+
description: What should be added or changed?
19+
validations:
20+
required: true
21+
- type: textarea
22+
id: alternatives
23+
attributes:
24+
label: Alternatives considered
25+
- type: textarea
26+
id: bc
27+
attributes:
28+
label: Backward compatibility impact
29+
description: Note any possible BC impact for existing users.

‎.github/pull_request_template.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
## Summary
2+
3+
Describe the change and why it is needed.
4+
5+
## Type of change
6+
7+
- [ ] Bug fix
8+
- [ ] New feature
9+
- [ ] Refactor
10+
- [ ] Documentation update
11+
12+
## Checklist
13+
14+
- [ ] I ran `composer ci` locally
15+
- [ ] I added/updated tests where needed
16+
- [ ] I updated docs/changelog where needed
17+
- [ ] The change is backward compatible within current major version

‎.github/workflows/main.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,13 @@ name: CI build
22
on: [ push, pull_request ]
33
jobs:
44
build:
5-
name: PHP ${{ matrix.php-versions }} on ${{ matrix.operating-system }} ${{ matrix.extra-label }} ${{ matrix.composer-dependencies }}
5+
name: PHP ${{ matrix.php-versions }} on ${{ matrix.operating-system }} ${{ matrix.extra-label }}
66
runs-on: ${{ matrix.operating-system }}
77
strategy:
88
fail-fast: false
99
matrix:
1010
operating-system: [ ubuntu-latest ]
1111
php-versions: [ '7.4', '8.0', '8.1', '8.2', '8.3', '8.4' ]
12-
composer-dependencies: [ '', '--prefer-lowest' ]
1312
extra-label: [ '' ]
1413
include:
1514

@@ -72,7 +71,7 @@ jobs:
7271
restore-keys: ${{ runner.os }}-composer-
7372

7473
- name: Install Composer dependencies
75-
run: composer update --no-progress --prefer-dist --optimize-autoloader ${{ matrix.composer-dependencies }}
74+
run: composer install --no-progress --prefer-dist --optimize-autoloader
7675

7776
- name: Run CI Build
7877
run: composer ci

‎CONTRIBUTING.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Contributing
2+
3+
Thank you for contributing to `webwingscz/fio-api-php`.
4+
5+
## Development Setup
6+
7+
Use WSL and project Docker setup:
8+
9+
```bash
10+
wsl.exe --cd /home/dorazil/projects/fio-api-php bash -lc "docker compose -f docker/local/docker-compose.yml run --rm php composer install"
11+
```
12+
13+
## Validation Before PR
14+
15+
Run full checks before opening a PR:
16+
17+
```bash
18+
wsl.exe --cd /home/dorazil/projects/fio-api-php bash -lc "docker compose -f docker/local/docker-compose.yml run --rm php composer ci"
19+
```
20+
21+
## Pull Request Rules
22+
23+
- Keep PRs focused and small.
24+
- Include tests for behavior changes and bug fixes.
25+
- Keep public API backward compatible within the same major line.
26+
- Update README or changelog notes when behavior/configuration changes.
27+
28+
## Commit Message Guidance
29+
30+
Use clear, imperative commit messages, for example:
31+
- `Fix PSR-12 formatting in uploader entities`
32+
- `Handle invalid JSON response in downloader`

‎README.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,9 +79,18 @@ Submitting bugs and feature requests
7979
------------------------------------
8080
Bugs and feature request are tracked on [GitHub](https://github.com/webwingscz/fio-api-php/issues)
8181

82+
Security
83+
--------
84+
Please report vulnerabilities according to [SECURITY.md](SECURITY.md).
85+
86+
Contributing
87+
------------
88+
Contribution guidelines are available in [CONTRIBUTING.md](CONTRIBUTING.md).
89+
8290
Author
8391
------
8492
Martin Hujer - <https://www.martinhujer.cz>
93+
Jiří Dorazil - <https://www.webwings.cz>
8594

8695
Changelog
8796
----------
@@ -93,6 +102,10 @@ Changelog
93102
- improve downloader error handling for connection and invalid JSON responses
94103
- remove invalid bundled CA certificate fallback and use explicit certificate resolution
95104
- modernize coding standards from PSR-2 to PSR-12 and update PHP_CodeSniffer
105+
- enforce release creation only after successful CI build
106+
- make CI dependency installation deterministic via `composer install` (lockfile-based)
107+
- add security checks to CI (`composer audit`) and add `roave/security-advisories` to dev dependencies
108+
- add professional repository standards: `SECURITY.md`, `CONTRIBUTING.md`, CODEOWNERS, issue and PR templates
96109

97110
## 5.0.0 (2024-06-07)
98111
- [#31](https://github.com/mhujer/fio-api-php/pull/31) add `composer/ca-bundle` as a required dependency instead of bundled root cert (thx @feldsam!)

‎SECURITY.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
Security fixes are provided for the latest stable major version.
6+
7+
| Version | Supported |
8+
| --- | --- |
9+
| 6.x | Yes |
10+
| < 6.0 | No |
11+
12+
## Reporting a Vulnerability
13+
14+
Please do not open public issues for security vulnerabilities.
15+
16+
Report vulnerabilities privately to:
17+
- dorazil@webwings.cz
18+
19+
When reporting, include:
20+
- affected version
21+
- impact and attack scenario
22+
- minimal reproduction steps
23+
- suggested fix (if available)
24+
25+
You will receive an initial response within 5 business days.

‎composer.json‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,8 @@
3838
"squizlabs/php_codesniffer": "^3.10",
3939
"phpstan/phpstan": "^2.1",
4040
"phpstan/phpstan-phpunit": "^2.0",
41-
"phpstan/phpstan-strict-rules": "^2.0"
41+
"phpstan/phpstan-strict-rules": "^2.0",
42+
"roave/security-advisories": "dev-latest"
4243
},
4344
"autoload": {
4445
"psr-4": {
@@ -52,10 +53,12 @@
5253
},
5354
"scripts": {
5455
"ci": [
56+
"@security",
5557
"@phpstan",
5658
"@phpcs",
5759
"@test"
5860
],
61+
"security": "composer audit --locked --no-dev",
5962
"test": "phpunit",
6063
"phpcs": "phpcs --standard=PSR12 src && phpcs --standard=PSR12 tests",
6164
"phpstan": "phpstan analyse -c phpstan.neon"

0 commit comments

Comments
 (0)