ci: phpstan baseline + GitHub Actions workflow (E5, E4)

E5: generate phpstan-baseline.neon (the 41 pre-existing errors) and include it, so `phpstan analyse` returns OK and the gate now fails only on NEW errors. The baseline is meant to be burned down over time. E4: add .github/workflows/ci.yml — MariaDB 11.8 + redis services, composer install, JWT keygen, phpstan (baseline-clean), migrate-on-empty-db smoke, and phpunit. Locally verified the substantive checks: a fresh empty DB migrates cleanly to 64 tables (guards the "migrations break on empty DB" bug class), phpstan is green, and the 70-test suite passes. The GitHub Actions service wiring itself is first-run-pending (can't be exercised offline). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-28 21:25:09 +03:30
parent 66ab597efd
commit 2764e68e60
4 changed files with 235 additions and 2 deletions
@@ -0,0 +1,73 @@
+name: CI
+
+on:
+  push:
+    branches: [main, backend-audit]
+  pull_request:
+
+jobs:
+  backend:
+    name: PHP — phpstan + migrate-on-empty-db + phpunit
+    runs-on: ubuntu-latest
+
+    services:
+      mariadb:
+        image: mariadb:11.8
+        env:
+          MARIADB_ROOT_PASSWORD: root
+          MARIADB_DATABASE: db
+          MARIADB_USER: db
+          MARIADB_PASSWORD: db
+        ports:
+          - 3306:3306
+        options: >-
+          --health-cmd="healthcheck.sh --connect --innodb_initialized"
+          --health-interval=10s --health-timeout=5s --health-retries=20
+      redis:
+        image: redis:7
+        ports:
+          - 6379:6379
+        options: --health-cmd="redis-cli ping" --health-interval=10s --health-timeout=5s --health-retries=10
+
+    env:
+      # Real env vars take precedence over .env/.env.test. doctrine's when@test
+      # config appends `_test`, so this `db` becomes `db_test` for the test run.
+      DATABASE_URL: "mysql://db:db@127.0.0.1:3306/db?serverVersion=11.8.0-MariaDB&charset=utf8mb4"
+      REDIS_URL: "redis://127.0.0.1:6379"
+      APP_ENV: test
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          extensions: pdo_mysql, intl, redis, gd, zip, mbstring, bcmath
+          coverage: none
+
+      - name: Install dependencies
+        run: composer install --no-interaction --prefer-dist --no-progress
+
+      - name: Create test database
+        run: |
+          mysql -h127.0.0.1 -uroot -proot -e "CREATE DATABASE IF NOT EXISTS db_test; GRANT ALL ON db_test.* TO 'db'@'%'; FLUSH PRIVILEGES;"
+
+      - name: Generate JWT keypair
+        run: php bin/console lexik:jwt:generate-keypair --skip-if-exists --env=test
+
+      # phpstan's symfony extension reads the dev container XML (see phpstan.neon),
+      # so warm the dev cache first.
+      - name: Warm dev cache (for phpstan container)
+        run: php bin/console cache:warmup --env=dev
+        env:
+          APP_ENV: dev
+
+      - name: PHPStan (baselined — fails only on NEW errors)
+        run: php vendor/bin/phpstan analyse --no-progress
+
+      - name: Migrate on empty DB (smoke)
+        run: php bin/console doctrine:migrations:migrate --no-interaction --env=test
+
+      - name: PHPUnit
+        run: php bin/phpunit