name: Lint PHP

on:
    pull_request: null
    push:
        branches:
            - main

concurrency:
    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
    cancel-in-progress: true

permissions: {}

jobs:
    integration:
        name: Linting (${{ matrix.php }})
        runs-on: ubuntu-latest

        strategy:
            matrix:
                php: ['8.2'] # use lowest supported PHP version to prevent introducing syntax from newer PHP versions

        steps:

            -   name: Clone Kimai
                uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
                with:
                    persist-credentials: false

            -   name: Setup PHP
                uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
                with:
                    php-version: ${{ matrix.php }}
                    coverage: pcov
                    extensions: ctype, gd, iconv, intl, mbstring, xml, zip
                    tools: cs2pr, symfony-cli
                env:
                    fail-fast: true

            -   name: Determine composer cache directory
                id: composer-cache
                run: echo "composer_cache_directory=$(composer config cache-dir)" >> $GITHUB_ENV

            -   name: Cache Composer dependencies
                uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
                with:
                    path: "${{ env.composer_cache_directory }}"
                    key: ${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.lock') }}

            -   name: Install dependencies
                run: composer install

            -   name: Validate Composer
                run: composer validate --strict --no-check-all

            -   name: Lint YAML
                run: APP_ENV=dev bin/console lint:yaml --parse-tags config

            -   name: Lint XLIFF
                run: APP_ENV=dev bin/console lint:xliff translations

            -   name: Check codestyles
                run: vendor/bin/php-cs-fixer fix --dry-run --verbose --config=.php-cs-fixer.dist.php --using-cache=no --show-progress=none --format=checkstyle | cs2pr

            -   name: Run PHPStan for application
                run: vendor/bin/phpstan analyse -c phpstan.neon --no-progress --error-format=checkstyle | cs2pr

            -   name: Run PHPStan for tests
                run: vendor/bin/phpstan analyse -c tests/phpstan.neon --no-progress --error-format=checkstyle | cs2pr

            -   name: Lint codebase
                run: composer linting

            -   name: Check for published security advisories
                run: composer audit --abandoned=report

            -   name: Check for security issues in packages
                run: symfony security:check