security-analysis.yml

# https://help.github.com/en/categories/automating-your-workflow-with-github-actions

name: "Security Analysis"

on: # yamllint disable-line rule:truthy
    push:
        paths:
            - "**.php"
            - "composer.json"
    pull_request:
        paths:
            - "**.php"
            - "composer.json"

jobs:
    security-analysis:
        name: "Security Analysis"

        runs-on: "ubuntu-latest"

        strategy:
            matrix:
                php-versions: ["8.0"]
                dependencies: ["locked"]

        env:
            key: "security-analysis-v1" # change key (version) to clear cache
            extensions: "mbstring"
            ini-values: "date.timezone=Europe/Berlin, assert.exception=1, zend.assertions=1, opcache.enable=1, opcache.enable_cli=0, opcache.optimization_level=-1, opcache.jit=1255, opcache.jit_buffer_size=32M, serialize_precision=14"
            tools: "composer:v2"

        steps:
            - name: "Git checkout"
              uses: "actions/checkout@v2"
              with:
                  fetch-depth: 2
              env:
                  GIT_COMMITTER_NAME: "GitHub Actions Shell"
                  GIT_AUTHOR_NAME: "GitHub Actions Shell"
                  EMAIL: "github-actions[bot]@users.noreply.github.com"

            - name: "Setup cache environment"
              id: "cache-env"
              uses: "shivammathur/cache-extensions@v1"
              with:
                  php-version: "${{ matrix.php-versions }}"
                  extensions: "${{ env.extensions }}"
                  key: "${{ env.key }}"

            - name: "Cache extensions"
              uses: "actions/cache@v2"
              with:
                  path: "${{ steps.cache-env.outputs.dir }}"
                  key: "${{ steps.cache-env.outputs.key }}"
                  restore-keys: "${{ steps.cache-env.outputs.key }}"

            - name: "Setup PHP"
              uses: "shivammathur/setup-php@v2"
              with:
                  php-version: "${{ matrix.php-versions }}"
                  extensions: "${{ env.extensions }}"
                  ini-values: "${{ env.ini-values }}"
                  tools: "${{ env.tools }}"
                  coverage: "pcov"

            - name: "Setup Problem Matchers for PHP"
              run: "echo '::add-matcher::${{ runner.tool_cache }}/php.json'"

            - name: "Check PHP Version"
              run: "php -v"

            - name: "List all php extensions with versions"
              run: "php -r 'foreach (get_loaded_extensions() as $extension) echo $extension . \" \" . phpversion($extension) . PHP_EOL;'"

            - name: "Configure Container"
              env:
                  GIT_USER_EMAIL: "${{ secrets.GIT_USER_EMAIL }}"
                  GIT_USER_USERNAME: "${{ secrets.GIT_USER_USERNAME }}"
              run: |
                  EMAIL=${GIT_USER_EMAIL:-"github-actions[bot]@users.noreply.github.com"}
                  NAME=${GIT_USER_USERNAME:-"github-actions-shell"}

                  git config --global user.email "${EMAIL}"
                  git config --global user.name "${NAME}"

            - name: "Check Composer Version"
              run: "composer -V"

            - name: "Validate composer.json and composer.json"
              run: "composer validate --strict"

            - name: "Install dependencies with Composer"
              uses: "ramsey/composer-install@v1"
              with:
                  dependency-versions: "${{ matrix.dependencies }}"

            - name: "running security analysis ( psalm )"
              run: "vendor/bin/psalm  --output-format=github  --taint-analysis"