main.yml

name: CI/CD

on:
  push:
    branches:
      - '**'
    tags-ignore:
      - '**'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  composer:
    name: composer install
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Setup PHP cache
        uses: shivammathur/cache-extensions@v1
        id: php-ext-cache
        with:
          php-version: '8.3'
          extensions: zip
          key: php83-cache
      - name: Cache PHP extensions
        uses: actions/cache@v4
        with:
          path: ${{ steps.php-ext-cache.outputs.dir }}
          key: ${{ steps.php-ext-cache.outputs.key }}
          restore-keys: ${{ steps.php-ext-cache.outputs.key }}
      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
          extensions: zip
          coverage: none

      - name: Cache Composer dependencies
        uses: actions/cache@v4
        id: composer-cache
        with:
          path: vendor
          key: ${{ runner.os }}-composer-${{ hashFiles('composer.lock') }}
          restore-keys: ${{ runner.os }}-composer-

      - name: Install Composer dependencies
        if: steps.composer-cache.outputs.cache-hit != 'true'
        run: composer install --prefer-dist --no-progress --no-scripts --no-autoloader

      - name: Generate Composer autoloader
        run: composer dump-autoload

  phpcs:
    name: phpcs
    needs: composer
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Setup PHP cache
        uses: shivammathur/cache-extensions@v1
        id: php-ext-cache
        with:
          php-version: '8.3'
          extensions: zip
          key: php83-cache
      - name: Cache PHP extensions
        uses: actions/cache@v4
        with:
          path: ${{ steps.php-ext-cache.outputs.dir }}
          key: ${{ steps.php-ext-cache.outputs.key }}
          restore-keys: ${{ steps.php-ext-cache.outputs.key }}
      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
          extensions: zip
          coverage: none

      - name: Cache Composer dependencies
        uses: actions/cache@v4
        id: composer-cache
        with:
          path: vendor
          key: ${{ runner.os }}-composer-${{ hashFiles('composer.lock') }}
          restore-keys: ${{ runner.os }}-composer-

      - name: Validate code style
        run: composer phpcs:ci

  phpstan:
    name: phpstan
    needs: composer
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Setup PHP cache
        uses: shivammathur/cache-extensions@v1
        id: php-ext-cache
        with:
          php-version: '8.3'
          extensions: zip
          key: php83-cache
      - name: Cache PHP extensions
        uses: actions/cache@v4
        with:
          path: ${{ steps.php-ext-cache.outputs.dir }}
          key: ${{ steps.php-ext-cache.outputs.key }}
          restore-keys: ${{ steps.php-ext-cache.outputs.key }}
      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
          extensions: zip
          coverage: none
      - name: Cache Composer dependencies
        uses: actions/cache@v4
        id: composer-cache
        with:
          path: vendor
          key: ${{ runner.os }}-composer-${{ hashFiles('composer.lock') }}
          restore-keys: ${{ runner.os }}-composer-

      - name: Cache PHPStan cache
        uses: actions/cache@v4
        id: phpstan-cache
        with:
          path: storage/tmp/phpstan
          key: ${{ runner.os }}-phpstan-${{ github.ref }}-${{ hashFiles('phpstan.neon') }}
          restore-keys: |
            ${{ runner.os }}-phpstan-${{ github.ref }}-
            ${{ runner.os }}-phpstan-
      - name: Run PHPStan
        run: |
          cp .env.testing.template .env.testing
          composer phpstan:ci
        env:
          APP_ENV: 'testing'
        timeout-minutes: 15

  security:
    name: security
    needs: composer
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Check for security issues in dependencies
        uses: symfonycorp/security-checker-action@v5

  yarn:
    name: yarn install
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Cache Yarn dependencies
        uses: actions/cache@v4
        id: yarn-cache
        with:
          path: node_modules
          key: ${{ runner.os }}-yarn-${{ hashFiles('yarn.lock') }}
          restore-keys: ${{ runner.os }}-yarn-

      - name: Install Yarn dependencies
        if: steps.yarn-cache.outputs.cache-hit != 'true'
        run: yarn install --frozen-lockfile

  prettier:
    name: prettier
    needs: yarn
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Cache Yarn dependencies
        uses: actions/cache@v4
        id: yarn-cache
        with:
          path: node_modules
          key: ${{ runner.os }}-yarn-${{ hashFiles('yarn.lock') }}
          restore-keys: ${{ runner.os }}-yarn-

      - name: Validate code style
        run: yarn run prettier:ci

  deploy:
    if: github.ref == 'refs/heads/master'
    name: deploy
    needs: [ phpstan, security, yarn ]
    runs-on: ubuntu-latest
    steps:
      - name: Trigger Deploy Chief production
        run: curl -s "$DEPLOYCHIEF?commit=$GITHUB_SHA" > /dev/null
        env:
          DEPLOYCHIEF: ${{ secrets.DEPLOYCHIEF_PRODUCTION }}

  sentry:
    if: github.ref == 'refs/heads/master'
    name: sentry release
    needs: deploy
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Notify Sentry
        uses: docker://stayallive/sentry:release
        env:
          PLUGIN_DEPLOY: 'production'
          PLUGIN_SENTRY_URL: 'https://sentry.io/'
          PLUGIN_SENTRY_ORG: ${{ secrets.SENTRY_CLOUD_ORG }}
          PLUGIN_SENTRY_PROJECT: ${{ github.event.repository.name }}
          PLUGIN_SENTRY_TOKEN: ${{ secrets.SENTRY_CLOUD_AUTH_TOKEN }}

      - name: Notify Sentry
        uses: docker://stayallive/sentry:release
        env:
          PLUGIN_DEPLOY: 'production'
          PLUGIN_SENTRY_URL: 'https://observ.app/'
          PLUGIN_SENTRY_ORG: ${{ github.event.repository.owner.login }}
          PLUGIN_SENTRY_PROJECT: ${{ github.event.repository.name }}
          PLUGIN_SENTRY_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}