Merge uo 3.4.4 to 4.0.x

Author: Spomky

.gitattributes

@@ -8,12 +8,13 @@
 /.gitattributes export-ignore
 /.gitignore export-ignore
 /.gitsplit.yml export-ignore
+/.mergify.yml export-ignore
 /monorepo-builder.php export-ignore
 /CODE_OF_CONDUCT.md export-ignore
+/castor.php export-ignore
 /deptrac.yaml export-ignore
 /ecs.php export-ignore
 /infection.json export-ignore
-/Makefile export-ignore
 /phpbench.json export-ignore
 /phpstan.neon export-ignore
 /phpstan-baseline.neon export-ignore

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,19 +1,20 @@
-| Q             | A
-| ------------- | ---
-| Branch?       | <!-- see below -->
-| Bug fix?      | yes/no
-| New feature?  | yes/no <!-- please update src/**/CHANGELOG.md files -->
-| Deprecations? | yes/no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
-| Tickets       | Fix #... <!-- prefix each issue number with "Fix #", no need to create an issue if none exist, explain below instead -->
-| License       | MIT
+Target branch:
+Resolves issue # <!-- #-prefixed issue number(s), if any -->
+
+<!-- replace space with "x" in square brackets: [x] -->
+- [ ] It is a Bug fix
+- [ ] It is a New feature
+- [ ] It is related to dependencies
+
+Includes:
+- [ ] Breaks BC
+- [ ] Deprecations
+
 <!--
-Replace this notice by a short README for your feature/bugfix. This will help people
-understand your PR and can be used as a start for the documentation.
+Fill in this template according to the PR you're about to submit.
+Replace this comment by a description of what your PR is solving.
 
-Additionally:
-- Always add tests and ensure they pass.
-- Never break backward compatibility (unless you are working on the next major release branch).
-- Bug fixes must be submitted against the lowest maintained branch where they apply
-    (lowest branches are regularly merged to upper ones so they get the fixes too.)
-- Features and deprecations must be submitted against the last major branch (e.g. 1.x).
+Please consider the following requirement:
+* Modification of existing tests should be avoided unless deemed necessary.
+* You MUST never open a PR related to a security issue. Contact Spomky in private at https://gitter.im/Spomky/
 -->

.github/workflows/dependency-review.yml

@@ -0,0 +1,14 @@
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout Repository'
+        uses: actions/checkout@v4
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@v4

.github/workflows/infection.yml

@@ -1,6 +1,4 @@
-# yaml-language-server: $schema=https://json.schemastore.org/github-workflow
-
-name: "Integrate"
+name: "Infection"
 
 on:
   push:
@@ -9,26 +7,24 @@ on:
 
 jobs:
   mutation_testing:
-    name: "5️⃣ Mutation Testing"
+    name: "0️⃣ Mutation Testing"
     runs-on: "ubuntu-latest"
     steps:
       - name: "Set up PHP"
         uses: "shivammathur/setup-php@v2"
         with:
-          php-version: "8.1"
+          php-version: "8.3"
           extensions: "json, mbstring, openssl, sqlite3, curl, uuid"
+          tools: castor
 
       - name: "Checkout code"
         uses: "actions/checkout@v4"
 
-      - name: "Fetch Git base reference"
-        run: "git fetch --depth=1 origin ${GITHUB_BASE_REF}"
-
       - name: "Install dependencies"
         uses: "ramsey/composer-install@v3"
         with:
           dependency-versions: "highest"
           composer-options: "--optimize-autoloader"
 
       - name: "Execute Infection"
-        run: "make ci-mu"
+        run: "castor infect"

.github/workflows/integrate.yml

@@ -1,5 +1,3 @@
-# yaml-language-server: $schema=https://json.schemastore.org/github-workflow
-
 name: "Integrate"
 
 on:
@@ -31,18 +29,34 @@ jobs:
       - name: "Set up PHP"
         uses: "shivammathur/setup-php@v2"
         with:
-          php-version: "8.1"
+          php-version: "8.3"
+          extensions: "json, mbstring, openssl, sqlite3, curl, uuid"
+          tools: castor
 
       - name: "Checkout code"
         uses: "actions/checkout@v4"
 
+      - name: "Fetch Git base reference"
+        run: "git fetch --depth=1 origin ${GITHUB_BASE_REF}"
+
+      - name: "Validate Composer configuration"
+        run: "castor validate"
+
       - name: "Install dependencies"
         uses: "ramsey/composer-install@v3"
         with:
-          dependency-versions: "highest"
+          dependency-versions: "${{ matrix.dependencies }}"
+          composer-options: "--optimize-autoloader"
+
+      - name: "Cache dependencies"
+        uses: "actions/cache@v4"
+        id: "cache"
+        with:
+          path: "composer-cache"
+          key: "${{ runner.os }}-${{ hashFiles('**/composer.json') }}"
 
       - name: "Check source code for syntax errors"
-        run: "composer exec -- parallel-lint src/ tests/"
+        run: "castor lint"
 
   unit_tests:
     name: "2️⃣ Unit and functional tests"
@@ -54,8 +68,6 @@ jobs:
         operating-system:
           - "ubuntu-latest"
         php-version:
-          - "8.1"
-          - "8.2"
           - "8.3"
         dependencies:
           - "lowest"
@@ -67,6 +79,7 @@ jobs:
         with:
           php-version: "${{ matrix.php-version }}"
           extensions: "json, mbstring, openssl, sqlite3, curl, uuid"
+          tools: castor
           coverage: "xdebug"
 
       - name: "Checkout code"
@@ -79,15 +92,7 @@ jobs:
           composer-options: "--optimize-autoloader"
 
       - name: "Execute unit tests"
-        run: "make ci-cc"
-
-  #      - name: Send coverage to Coveralls
-  #        if: "matrix.php-version == '8.1' && matrix.dependencies == 'highest'"
-  #        env:
-  #          COVERALLS_REPO_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-  #        run: |
-  #          wget "https://github.com/php-coveralls/php-coveralls/releases/download/v2.5.2/php-coveralls.phar"
-  #          php ./php-coveralls.phar -v
+        run: "castor test --coverage-text"
 
   static_analysis:
     name: "3️⃣ Static Analysis"
@@ -99,23 +104,21 @@ jobs:
       - name: "Set up PHP"
         uses: "shivammathur/setup-php@v2"
         with:
-          php-version: "8.1"
+          php-version: "8.3"
           extensions: "json, mbstring, openssl, sqlite3, curl, uuid"
+          tools: castor
 
       - name: "Checkout code"
         uses: "actions/checkout@v4"
 
-      - name: "Validate Composer configuration"
-        run: "composer validate --strict"
-
       - name: "Install dependencies"
         uses: "ramsey/composer-install@v3"
         with:
           dependency-versions: "highest"
           composer-options: "--optimize-autoloader"
 
       - name: "Execute static analysis"
-        run: "make st"
+        run: "castor stan"
 
   coding_standards:
     name: "4️⃣ Coding Standards"
@@ -127,23 +130,50 @@ jobs:
       - name: "Set up PHP"
         uses: "shivammathur/setup-php@v2"
         with:
-          php-version: "8.1"
+          php-version: "8.3"
           extensions: "json, mbstring, openssl, sqlite3, curl, uuid"
+          tools: castor
 
       - name: "Checkout code"
         uses: "actions/checkout@v4"
 
+      - name: "Install dependencies"
+        uses: "ramsey/composer-install@v3"
+        with:
+          dependency-versions: "highest"
+          composer-options: "--optimize-autoloader"
+
       - name: "Check adherence to EditorConfig"
         uses: "greut/eclint-action@v0"
 
+      - name: "Check coding style"
+        run: "castor cs"
+
+  check_licenses:
+    name: "5️⃣ Check licenses"
+    needs:
+      - "byte_level"
+      - "syntax_errors"
+    runs-on: "ubuntu-latest"
+    steps:
+      - name: "Set up PHP"
+        uses: "shivammathur/setup-php@v2"
+        with:
+          php-version: "8.3"
+          extensions: "json, mbstring, openssl, sqlite3, curl, uuid"
+          tools: castor
+
+      - name: "Checkout code"
+        uses: "actions/checkout@v4"
+
       - name: "Install dependencies"
         uses: "ramsey/composer-install@v3"
         with:
           dependency-versions: "highest"
           composer-options: "--optimize-autoloader"
 
       - name: "Check coding style"
-        run: "make ci-cs"
+        run: "castor check-licenses"
 
   rector_checkstyle:
     name: "6️⃣ Rector Checkstyle"
@@ -155,24 +185,22 @@ jobs:
       - name: "Set up PHP"
         uses: "shivammathur/setup-php@v2"
         with:
-          php-version: "8.1"
+          php-version: "8.3"
           extensions: "json, mbstring, openssl, sqlite3, curl, uuid"
+          tools: castor
           coverage: "xdebug"
 
       - name: "Checkout code"
         uses: "actions/checkout@v4"
 
-      - name: "Fetch Git base reference"
-        run: "git fetch --depth=1 origin ${GITHUB_BASE_REF}"
-
       - name: "Install dependencies"
         uses: "ramsey/composer-install@v3"
         with:
           dependency-versions: "highest"
           composer-options: "--optimize-autoloader"
 
       - name: "Execute Rector"
-        run: "make rector"
+        run: "castor rector"
 
   exported_files:
     name: "7️⃣ Exported files"

.github/workflows/lock-closed-issues.yml

@@ -0,0 +1,23 @@
+name: 'Lock Issues'
+
+on:
+  schedule:
+    - cron: '28 4 * * *'
+
+jobs:
+  lock:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: dessant/lock-threads@v5
+        with:
+          github-token: ${{ github.token }}
+          issue-inactive-days: '31'
+          exclude-issue-created-before: ''
+          exclude-any-issue-labels: ''
+          add-issue-labels: ''
+          issue-comment: >
+            This thread has been automatically locked since there has not been
+            any recent activity after it was closed. Please open a new issue for
+            related bugs.
+          issue-lock-reason: 'resolved'
+          process-only: 'issues'

.github/workflows/release-on-milestone-closed.yml

@@ -1,5 +1,3 @@
-# https://help.github.com/en/categories/automating-your-workflow-with-github-actions
-
 name: "Automatic Releases"
 
 on:

.github/workflows/scorecards.yml

@@ -0,0 +1,44 @@
+name: Scorecards supply-chain security
+
+on:
+  schedule:
+    - cron: '34 4 * * 6'
+  push:
+    branches: [ "*.*.x" ]
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecards analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@v2.3.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@v4.3.3
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif

.gitignore

@@ -8,3 +8,4 @@ composer.lock
 vendor/
 src/Bundle/JoseFramework/var/
 infection.txt
+.castor.stub.php

.gitsplit.yml

@@ -56,6 +56,7 @@ splits:
   - prefix: "rc/Deprecated/Pack/Signature"
     target: "https://${GH_TOKEN}@github.com/web-token/signature-pack.git"
 
+
 origins:
   - ^\d+\.\d+\.x$
   - ^\d+\.\d+\.\d+$