README.md

Development

Actions are standalone. Prefer actions/github-script and its supplied core, exec, io, and glob helpers. Composer metadata validation needs no dependency installation. The standalone version resolver uses Composer's constraint parser and PHP.net release metadata; its Dockerfile installs only its own locked dependencies. The action builds and runs that image with the runner's UID/GID and a read-only checkout mount. github-script publishes the resolver's JSON as action outputs. Release planning and creation use ci-github-publish; the release workflow validates Composer metadata and tag identity before publication.

Validation

__shared-ci.yml runs lint, dedicated workflows for each action, and an end-to-end call to the public CI and documentation workflows. The Composer fixture covers automatic and explicit tool installation, lockfile and lockfile-free setup, installation hooks, PHPUnit reports, and PHPStan. Test-action cases cover Composer-owned report generation, coverage publication, preparation, custom commands, and failure propagation. Dedicated lint and test workflows retrieve native artifacts in dependent jobs after successful or intentionally failed commands finish. They compare report names and content hashes, check that hidden project paths work without uploading unrelated files, and verify empty artifact outputs when no reports are produced. Read-only jobs exercise the default comment policy; separate jobs verify opt-in comments with collapsed details. Package integration tests create independent Git repositories and exercise distribution omissions, consumer commands, archive immutability, and cleanup.

Release guard checks live in __test-workflow-release.yml. They exercise the actual preparation and publication scripts: event restrictions, no-change status, prepared tag handoff, retry context and Composer metadata. Shared planner and verifier tests in ci-github-publish cover force and tag recovery. They never create a tag or release.

With PHP 8.4.1 or newer, Composer and Git installed, run:

make setup
make test

setup installs dependencies for tracked Composer fixtures with scripts and plugins disabled. test runs fixture lint and the Composer projects that declare a test script. deps-update refreshes their lockfiles, with deps-update-interactive for selecting updates; deps-audit reports dependency advisories without changing files. make ci installs, audits, tests and lints; it does not automatically fix files.

Run make lint for the repository's Docker lint checks. PHP analysis runs in the Composer integration workflow, using its declared runtime and tools; the generic linter does not reinstall the PHP fixtures with its own runtime. Checkov skips third-party vendor/ contents installed by local fixture setup. Release integration tests must not publish tags or releases in consumer repositories. Validate planning and publication guards independently, and use caller pull requests for real CI runs.

Documentation and updates

Action readmes and workflow reference sections are generated by CI Dokumentor through ci-github-publish/.github/workflows/release-actions.yml. Update metadata, then regenerate using that tool. The CI and release workflows include their authored guides in leading comments; regeneration writes them to the corresponding .github/workflows/*.md files.

Dependabot updates GitHub Actions, action Composer manifests and lockfiles, Composer fixtures, containers, and development containers. Recursive action directory patterns cover standalone action dependencies without a per-action list. Each ecosystem explicitly uses the build commit prefix with a dependency scope. The root .commitlintrc.json configures the same rules for contributors and Dependabot. Conventional types and required subjects remain blocking; casing and line lengths produce warnings. Local linting, commit checks and the semantic pull request workflow read that repository configuration.

The resolver has unit coverage for Composer constraints, patch bounds, exclusions, prereleases and discovery failures. Its integration workflow checks default setup, explicit overrides, workspace containment, unchanged runner PHP, and the same resolver in local Docker builds. Public CI exercises automatic matrix discovery against the nested Composer fixture.

Renovate follows the common Hoverkraft maintenance workflow for Docker action references, the root .php-version, and the Composer bootstrap version. The maintenance workflow receives its GitHub App credentials from this repository's CI bot configuration; public reusable workflows do not assume those variables or secrets exist in callers.