pull_requests.yml

name: Code Checks

on:
    pull_request:
    merge_group:
        types: [checks_requested]

permissions: {}

concurrency:
    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
    cancel-in-progress: true

jobs:
    prep-and-code-consistency:
        name: Prep and Code Consistency
        runs-on: ubuntu-22.04

        permissions:
            contents: read

        timeout-minutes: 15

        env:
            php-extensions: gd, gmp, redis, mailparse
            php-extensions-key: ext-cache-20250820
            php-version: '8.4'

        outputs:
            php-extensions: ${{ env.php-extensions }}
            php-extensions-key: ${{ env.php-extensions-key }}
            php-version: ${{ env.php-version }}

        steps:
            - name: Checkout code | Internal
              if: ${{ github.event_name == 'merge_group' || github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login != 'dependabot[bot]' }}
              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
              with:
                  ref: ${{ github.head_ref }}
                  token: ${{ secrets.PAT }} # zizmor: ignore[secrets-outside-env]
                  persist-credentials: true # zizmor: ignore[artipacked] -- credentials needed for git push

            - name: Checkout code | External
              if: ${{ github.event_name != 'merge_group' && github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]' }}
              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
              with:
                  ref: ${{ github.head_ref }}
                  persist-credentials: false

            - name: Setup cache environment
              id: extcache
              uses: shivammathur/cache-extensions@9b476298b44f2e4d4268dd103ff4c3e216314e27 # 1.14.6
              with:
                  php-version: ${{ env.php-version }}
                  extensions: ${{ env.php-extensions }}
                  key: ${{ env.php-extensions-key }}

            - name: Cache extensions
              uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              with:
                  path: ${{ steps.extcache.outputs.dir }}
                  key: ${{ runner.os }}-phpext-${{ env.php-version }}-${{ env.php-extensions-key }}
                  restore-keys: ${{ runner.os }}-phpext-${{ env.php-version }}

            - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
              with:
                  php-version: ${{ env.php-version }}
                  coverage: none
                  extensions: ${{ env.php-extensions }}

            - name: Validate Composer JSON
              run: composer validate --strict --no-check-all

            - name: Cache dependencies
              id: cache-composer
              uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              with:
                  path: vendor
                  key: ${{ runner.os }}-composer-${{ hashFiles('composer.lock', 'app-modules/**/composer.lock') }}

            - if: ${{ steps.cache-composer.outputs.cache-hit != 'true' }}
              name: Install Dependencies
              run: composer install -q --no-ansi --no-interaction --no-scripts --no-progress --prefer-dist --optimize-autoloader
              shell: bash

            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
              with:
                  node-version-file: '.nvmrc'
                  cache: 'npm'
            - run: npm install

            - name: Set up Ruby
              uses: ruby/setup-ruby@0dafeac902942906541bc140009cdbf32665b601 # v1.315.0

            - name: Run Ruby Script
              run: ruby ./copyright.rb

            - name: Cache PHP CS Fixer
              uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              with:
                  path: .cache/php-cs-fixer/.php-cs-fixer.cache
                  key: ${{ runner.OS }}-${{ github.repository }}-phpcsfixer-${{ github.run_id }}
                  restore-keys: |
                      ${{ runner.OS }}-${{ github.repository }}-phpcsfixer-

            - name: Cache Prettier
              uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              with:
                  path: .cache/prettier
                  key: ${{ runner.OS }}-${{ github.repository }}-prettier-${{ github.run_id }}
                  restore-keys: |
                      ${{ runner.OS }}-${{ github.repository }}-prettier-

            - name: Run Formatters
              run: composer format

            - name: Commit changes
              if: ${{ github.event_name != 'merge_group' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login != 'dependabot[bot]' }}
              run: |
                  git config user.name "github-actions[bot]"
                  git config user.email "github-actions[bot]@users.noreply.github.com"
                  git add -A
                  git diff --cached --quiet || (git commit -m "Update code formatting and copyright headers" && git push)

            - name: Check for changes
              if: ${{ github.event_name == 'merge_group' || github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]' }}
              uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20.0.4
              with:
                  fail-if-changed: 'true'

    test:
        name: Test
        strategy:
            matrix:
                testsuite: [Landlord, Tenant]

        runs-on: ubuntu-22.04

        permissions:
            contents: read

        env:
            DB_PORT: 5432
            DB_HOST: 127.0.0.1
            DB_USERNAME: root
            DB_PASSWORD: root
            DB_DATABASE: testing_landlord
            REDIS_HOST: 127.0.0.1

        timeout-minutes: 15

        needs: [prep-and-code-consistency]

        services:
            redis:
                image: redis:7.4@sha256:d3be87a1060455213a204d2b0a7f04d45d19a16a98e85b3c37b7c33b5f0c489e
                ports:
                    - 6379:6379
                options: --health-cmd="redis-cli ping" --health-interval=10s --health-timeout=5s --health-retries=3

        steps:
            - name: Start PostgreSQL
              run: |
                  docker run -d \
                    --name postgres \
                    -p 5432:5432 \
                    -e POSTGRES_DB=${DB_DATABASE} \
                    -e POSTGRES_USER=${DB_USERNAME} \
                    -e POSTGRES_PASSWORD=${DB_PASSWORD} \
                    --health-cmd pg_isready \
                    --health-interval 10s \
                    --health-timeout 5s \
                    --health-retries 5 \
                    postgres:16.8@sha256:301bcb60b8a3ee4ab7e147932723e3abd1cef53516ce5210b39fd9fe5e3602ae \
                    -c max_locks_per_transaction=256

            - name: Wait for PostgreSQL
              run: |
                  until docker inspect --format='{{.State.Health.Status}}' postgres | grep -q healthy; do
                    sleep 2
                  done

            - name: Create tenant database
              run: psql -h 127.0.0.1 -d ${DB_DATABASE} -U ${DB_USERNAME} -c 'CREATE DATABASE testing_tenant;'
              env:
                  PGPASSWORD: ${{ env.DB_PASSWORD }}

            - name: Setup cache environment
              id: extcache
              uses: shivammathur/cache-extensions@9b476298b44f2e4d4268dd103ff4c3e216314e27 # 1.14.6
              with:
                  php-version: ${{ needs.prep-and-code-consistency.outputs.php-version }}
                  extensions: ${{ needs.prep-and-code-consistency.outputs.php-extensions }}
                  key: ${{ needs.prep-and-code-consistency.outputs.php-extensions-key }}

            - name: Cache extensions
              uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              with:
                  path: ${{ steps.extcache.outputs.dir }}
                  key: ${{ runner.os }}-phpext-${{ needs.prep-and-code-consistency.outputs.php-version }}-${{ needs.prep-and-code-consistency.outputs.php-extensions-key }}
                  restore-keys: ${{ runner.os }}-phpext-${{ needs.prep-and-code-consistency.outputs.php-version }}

            - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
              with:
                  php-version: ${{ needs.prep-and-code-consistency.outputs.php-version }}
                  coverage: none
                  extensions: ${{ needs.prep-and-code-consistency.outputs.php-extensions }}

            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
              with:
                  fetch-depth: 0
                  fetch-tags: true
                  persist-credentials: false

            - name: Copy .env
              run: php -r "file_exists('.env') || copy('.env.example', '.env');"

            - name: Cache dependencies
              id: cache-composer
              uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              with:
                  path: vendor
                  key: ${{ runner.os }}-composer-${{ hashFiles('composer.lock', 'app-modules/**/composer.lock') }}

            - if: ${{ steps.cache-composer.outputs.cache-hit != 'true' }}
              name: Install Dependencies
              run: composer install -q --no-ansi --no-interaction --no-scripts --no-progress --prefer-dist --optimize-autoloader
              shell: bash

            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
              with:
                  node-version-file: '.nvmrc'
                  cache: 'npm'
            - run: npm install

            - name: Build Assets
              run: npm run build

            - name: Generate key
              run: php artisan key:generate

            - name: Cache Modular Modules
              run: php artisan modules:cache --env=testing

            - name: Cache Routes
              run: php artisan route:cache --env=testing

            - name: Cache Views
              run: php artisan view:cache --env=testing

            - name: Cache Events
              run: php artisan event:cache --env=testing

            - name: Cache Icons
              run: php artisan icons:cache --env=testing

            - name: Cache Filament Components
              run: php artisan filament:cache-components --env=testing

            - name: Check route integrity
              run: php artisan route:list

            - name: Execute tests
              env:
                  TESTSUITE: ${{ matrix.testsuite }}
              run: php artisan test --configuration phpunit-ci.xml --parallel --testsuite=${TESTSUITE}

    lint:
        name: Lint
        runs-on: ubuntu-22.04

        permissions:
            contents: read

        timeout-minutes: 15

        needs: [prep-and-code-consistency]

        env:
            DB_PORT: 5432
            DB_HOST: 127.0.0.1
            DB_USERNAME: root
            DB_PASSWORD: root
            DB_DATABASE: testing_landlord
            CACHE_DRIVER: array
            QUEUE_CONNECTION: sync
            AUDIT_QUEUE_CONNECTION: sync
            SESSION_DRIVER: array

        services:
            postgres:
                image: postgres:16.8@sha256:301bcb60b8a3ee4ab7e147932723e3abd1cef53516ce5210b39fd9fe5e3602ae
                ports:
                    - 5432:5432
                env:
                    PGPASSWORD: ${{ env.DB_PASSWORD }}
                    POSTGRES_DB: ${{ env.DB_DATABASE }}
                    POSTGRES_USER: ${{ env.DB_USERNAME }}
                    POSTGRES_PASSWORD: ${{ env.DB_PASSWORD }}
                options: >-
                    --health-cmd pg_isready
                    --health-interval 10s
                    --health-timeout 5s
                    --health-retries 5

        steps:
            - name: Setup cache environment
              id: extcache
              uses: shivammathur/cache-extensions@9b476298b44f2e4d4268dd103ff4c3e216314e27 # 1.14.6
              with:
                  php-version: ${{ needs.prep-and-code-consistency.outputs.php-version }}
                  extensions: ${{ needs.prep-and-code-consistency.outputs.php-extensions }}
                  key: ${{ needs.prep-and-code-consistency.outputs.php-extensions-key }}

            - name: Cache extensions
              uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              with:
                  path: ${{ steps.extcache.outputs.dir }}
                  key: ${{ runner.os }}-phpext-${{ needs.prep-and-code-consistency.outputs.php-version }}-${{ needs.prep-and-code-consistency.outputs.php-extensions-key }}
                  restore-keys: ${{ runner.os }}-phpext-${{ needs.prep-and-code-consistency.outputs.php-version }}

            - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
              with:
                  php-version: ${{ needs.prep-and-code-consistency.outputs.php-version }}
                  coverage: none
                  extensions: ${{ needs.prep-and-code-consistency.outputs.php-extensions }}

            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
              with:
                  fetch-depth: 0
                  fetch-tags: true
                  persist-credentials: false

            - name: Cache dependencies
              id: cache-composer
              uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              with:
                  path: vendor
                  key: ${{ runner.os }}-composer-${{ hashFiles('composer.lock', 'app-modules/**/composer.lock') }}

            - if: ${{ steps.cache-composer.outputs.cache-hit != 'true' }}
              name: Install Dependencies
              run: composer install -q --no-ansi --no-interaction --no-scripts --no-progress --prefer-dist --optimize-autoloader
              shell: bash

            - name: Copy .env
              run: php -r "file_exists('.env') || copy('.env.example', '.env');"

            - name: Generate key
              run: php artisan key:generate

            - name: Migrate Landlord Database
              run: php artisan migrate --database=landlord --path=database/landlord --force

            - name: Set up Tenant
              run: php artisan tenants:create test test.aidingapp.local -y

            - name: Generate Helper Files
              run: php artisan app:generate-helper-files

            - name: 'Restore result cache'
              uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              with:
                  path: .cache/phpstan
                  key: 'linting-result-cache-${{ github.run_id }}'
                  restore-keys: |
                      linting-result-cache-

            - name: Run PHPStan
              run: ./vendor/bin/phpstan analyse --configuration=phpstan-ci.neon --no-progress

            - name: 'Save result cache'
              uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              if: ${{ !cancelled() }}
              with:
                  path: .cache/phpstan
                  key: 'linting-result-cache-${{ github.run_id }}'

    renovate-config-validator:
        name: Renovate Config Validator
        runs-on: ubuntu-latest

        permissions:
            contents: read

        timeout-minutes: 15
        container:
            image: ghcr.io/renovatebot/renovate:43.204.0@sha256:fb9b7b988bd60c428d943ab59a2e31b6565588a550c348a289b06bd65d3e0061
            # github hosted runners are running as `1001:127` (ubuntu:docker)
            options: -u 1001:0 --group-add 1000 --group-add 12021 --group-add 127

        steps:
            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
              with:
                  show-progress: false
                  persist-credentials: false

            - name: Validate Renovate configuration
              run: |
                  renovate-config-validator renovate-config.json