hamed/clinicpro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: phpstan baseline + GitHub Actions workflow (E5, E4)

Browse Source 
E5: generate phpstan-baseline.neon (the 41 pre-existing errors) and include it,
so `phpstan analyse` returns OK and the gate now fails only on NEW errors. The
baseline is meant to be burned down over time.

E4: add .github/workflows/ci.yml — MariaDB 11.8 + redis services, composer
install, JWT keygen, phpstan (baseline-clean), migrate-on-empty-db smoke, and
phpunit. Locally verified the substantive checks: a fresh empty DB migrates
cleanly to 64 tables (guards the "migrations break on empty DB" bug class),
phpstan is green, and the 70-test suite passes. The GitHub Actions service
wiring itself is first-run-pending (can't be exercised offline).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
hamed
2026-06-28 21:25:09 +03:30
co-authored by Claude Opus 4.8
parent 66ab597efd
commit 2764e68e60
4 changed files with 235 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/audit-backlog.md
+2 -2
View File
@@ -106,8 +106,8 @@ _None outstanding._
| E1 | **Double-nest response contract** — ~12 controllers return `success(['data'=>X])` → `{data:{data:X}}`, others flat. Inconsistent envelope. | AppointmentSettings, Appointment, Rating, Settlement, Secretary, Sms, Location, Doctor, Blog, DoctorService/Specialty/Tag, Representation, UserProfile, Clinic, Insurance, Billing | Documented pitfall in CLAUDE.md; clients (`nobat724_front`, `clinic-pro-tauri`) already read `data.data`. Unifying breaks all 3 clients → needs coordinated cross-repo change + versioning. NOT a quick bug. |
| E2 | **No DTO/validator on sensitive writes** — admin create, auth flows, payment verify, booking read raw `json_decode` arrays | Admin, Auth, Payment, Appointment, Settlement controllers | Introduce request DTOs + validator incrementally. Large. |
| E3 | **Fat controllers** — AdminApiController (1938 LOC), MyAppointmentsController booking, RepresentationActionController (835), DoctorController/ClinicController | extract per-domain Services | SOLID refactor; lower urgency than security/db. |
| E4 | **CI** — no `.github/workflows`; add phpunit + phpstan + migrate-on-empty-db | devops | prompt var §DevOps |
| E5 | **phpstan baseline dirty** — 41 pre-existing errors across the codebase (D9 only repaired the config so it *runs*). Audit fixes must not add new ones; cleaning the 41 is its own task. | devops | `ddev exec php vendor/bin/phpstan analyse` → 41 errors (e.g. SlotCalculatorService.php:233, SubscriptionController.php:33) |
| ✅E4 | **CI** — no `.github/workflows`; add phpunit + phpstan + migrate-on-empty-db | devops | **DONE (scaffold, first-run-pending)** — `.github/workflows/ci.yml`: MariaDB+redis services, phpstan (baseline-clean), migrate-on-empty-db smoke, phpunit. Verified locally: empty-DB migrate → 64 tables, phpstan OK, 70 tests green. GH-Actions service wiring needs first-run validation. |
| ✅E5 | **phpstan baseline dirty** — 41 pre-existing errors across the codebase (D9 only repaired the config so it *runs*). Audit fixes must not add new ones; cleaning the 41 is its own task. | devops | **DONE** — generated `phpstan-baseline.neon` (41 errors) + included it; `phpstan analyse` now returns OK, so the gate catches only NEW errors. Burn down over time. |
| E6 | **No test DB isolation** — `ApiTestCase` doesn't reset/rollback `db_test` between tests/runs, so rows accumulate; count/time-based assertions are fragile (hit twice this session). Add per-test transaction rollback or a DB reset. | test | tests rely on random keys + relaxed assertions as a workaround |
---