ci.yml

name: CI for Plugin Boilerplate

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

# Cancel any in-progress runs for the same branch when a new push lands.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Disable all permissions by default; grant minimal permissions per job.
permissions: {}

# wp-env mounts the working tree at wp-content/plugins/<basename>, so check out into
# a directory named to match the slug used in composer.json's "integration" script.
defaults:
  run:
    working-directory: plugin-slug

jobs:
  lint:
    name: Lint and code standards

    runs-on: ubuntu-latest

    timeout-minutes: 15

    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          path: plugin-slug
          persist-credentials: false

      - name: Setup PHP 8.4
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
        with:
          php-version: '8.4'
          coverage: none
          tools: composer:v2, cs2pr
          extensions: mbstring # Just enough to keep phpunit happy when installing Composer dependencies.

      - name: Validate composer.json
        run: composer validate --strict

      - name: Install Composer dependencies
        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
        with:
          working-directory: plugin-slug
          composer-options: --prefer-dist --no-progress

      # The runner image does not ship xmllint, which bin/xml-lint uses to
      # validate the XML configs against their schemas.
      - name: Install xmllint
        run: sudo apt-get install --yes --no-install-recommends libxml2-utils

      # php-parallel-lint and bin/xml-lint cover the PHP and XML files,
      # so local runs and CI share one code path.
      - name: Lint PHP and XML files
        run: composer lint

      - name: Check composer.json normalisation
        run: composer normalize --dry-run

      # Pipe through cs2pr so sniff violations show as inline PR annotations.
      - name: Run PHPCS
        run: vendor/bin/phpcs -q --report=checkstyle | cs2pr

      - name: Run Rector (dry run)
        run: composer rector

      - name: Run PHPStan
        run: composer phpstan

      - name: Audit dependencies
        run: composer audit

  test:
    name: WP ${{ matrix.wordpress }} on PHP ${{ matrix.php }}

    runs-on: ubuntu-latest

    timeout-minutes: 30

    permissions:
      contents: read

    strategy:
      fail-fast: false
      matrix:
        include:
          # Lowest supported PHP with lowest supported WordPress.
          - php: '8.4'
            wordpress: '6.9'
          # Latest supported PHP with latest supported WordPress.
          - php: '8.5'
            wordpress: '7.0'

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          path: plugin-slug
          persist-credentials: false

      - name: Setup Node.js (for wp-env)
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 'lts/*'

      - name: Cache npm registry for wp-env
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ~/.npm
          key: ${{ runner.os }}-npm-wp-env-${{ hashFiles('plugin-slug/.wp-env.json') }}
          restore-keys: |
            ${{ runner.os }}-npm-wp-env-

      - name: Install wp-env
        run: npm install -g @wordpress/env@11.8.0

      - name: Setup PHP
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          php-version: ${{ matrix.php }}
          coverage: pcov
          tools: composer:v2
          # https://make.wordpress.org/hosting/handbook/handbook/server-environment/#php-extensions
          extensions: curl, dom, exif, fileinfo, hash, json, mbstring, mysqli, libsodium, openssl, pcre, imagick, xml, zip

      - name: Install Composer dependencies
        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
        with:
          working-directory: plugin-slug
          composer-options: --prefer-dist --no-progress

      - name: Setup Problem Matchers for PHPUnit
        env:
          RUNNER_TOOL_CACHE: ${{ runner.tool_cache }}
        run: echo "::add-matcher::${RUNNER_TOOL_CACHE}/phpunit.json"

      - name: Run unit tests
        run: composer test:unit

      # Mutation testing is slow; one leg on the latest PHP is enough,
      # and infection.json.dist gates on minimum MSI so failures are real.
      - name: Run infection tests
        if: matrix.php == '8.5'
        run: composer infection

      - name: Start wp-env
        run: wp-env start
        env:
          WP_ENV_CORE: WordPress/WordPress#${{ matrix.wordpress }}
          WP_ENV_PHP_VERSION: ${{ matrix.php }}

      - name: Run integration tests
        run: composer test:integration

      - name: Run multisite integration tests
        run: composer test:integration-ms