Skip to content

Commit 2b07911

Browse files
coisagithub-actions[bot]
coisa
and
github-actions[bot]
authored
[dependencies] Add Jack-powered dependency workflow (#34) (#102)
* [dependencies] Add Jack-powered dependency workflow (#34) * Update wiki submodule pointer for PR #102 * [dependencies] Inline Jack upgrade workflow (#34) * Update wiki submodule pointer for PR #102 * [dependencies] Finalize dependency command updates (#34) * [github-actions] Refine tests workflow concurrency (#34) * Update wiki submodule pointer for PR #102 * [tests] Align dependency upgrade command expectations (#34) * [github-actions] Ensure dependency health runs on PRs (#34) * Update wiki submodule pointer for PR #102 --------- Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 1890a0d commit 2b07911

10 files changed

Lines changed: 459 additions & 157 deletions

File tree

‎.github/wiki‎

Submodule wiki updated from 5e683c7 to c8ed75d

‎.github/workflows/tests.yml‎

Lines changed: 65 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,33 @@ on:
88
required: false
99
type: number
1010
default: 80
11+
run-dependencies-check:
12+
description: Whether to run the dependency health check during CI.
13+
required: false
14+
type: boolean
15+
default: true
16+
max-outdated:
17+
description: Maximum number of outdated packages allowed by the dependencies command.
18+
required: false
19+
type: number
20+
default: 5
1121
workflow_dispatch:
1222
inputs:
1323
min-coverage:
1424
description: Minimum line coverage percentage enforced by dev-tools tests.
1525
required: false
1626
type: number
1727
default: 80
28+
run-dependencies-check:
29+
description: Whether to run the dependency health check during CI.
30+
required: false
31+
type: boolean
32+
default: true
33+
max-outdated:
34+
description: Maximum number of outdated packages allowed by the dependencies command.
35+
required: false
36+
type: number
37+
default: 5
1838
pull_request:
1939
paths:
2040
- 'src/**'
@@ -29,8 +49,8 @@ permissions:
2949
contents: read
3050

3151
concurrency:
32-
group: "pages"
33-
cancel-in-progress: false
52+
group: ${{ github.event_name == 'pull_request' && format('tests-pr-{0}', github.event.pull_request.number) || format('tests-{0}', github.ref) }}
53+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
3454

3555
jobs:
3656
tests:
@@ -39,6 +59,8 @@ jobs:
3959
strategy:
4060
matrix:
4161
php-version: [ '8.3', '8.4', '8.5' ]
62+
env:
63+
TESTS_ROOT_VERSION: ${{ github.event_name == 'pull_request' && format('dev-{0}', github.event.pull_request.head.ref) || 'dev-main' }}
4264
steps:
4365
- uses: actions/checkout@v6
4466

@@ -64,12 +86,12 @@ jobs:
6486
env:
6587
COMPOSER_AUTH: '{"github-oauth": {"github.com": "${{ github.token }}"} }'
6688
COMPOSER_CACHE_DIR: /tmp/composer-cache
67-
COMPOSER_ROOT_VERSION: dev-main
89+
COMPOSER_ROOT_VERSION: ${{ env.TESTS_ROOT_VERSION }}
6890
run: composer install --prefer-dist --no-progress --no-interaction --no-plugins --no-scripts
6991

7092
- name: Composer Audit
7193
env:
72-
COMPOSER_ROOT_VERSION: dev-main
94+
COMPOSER_ROOT_VERSION: ${{ env.TESTS_ROOT_VERSION }}
7395
run: composer audit
7496

7597
- name: Resolve minimum coverage
@@ -80,5 +102,43 @@ jobs:
80102

81103
- name: Run PHPUnit tests
82104
env:
83-
COMPOSER_ROOT_VERSION: dev-main
105+
COMPOSER_ROOT_VERSION: ${{ env.TESTS_ROOT_VERSION }}
84106
run: composer dev-tools tests -- --coverage=public/coverage --min-coverage=${{ steps.minimum-coverage.outputs.value }}
107+
108+
dependency-health:
109+
name: Dependency Health
110+
if: ${{ github.event_name != 'workflow_call' || inputs.run-dependencies-check }}
111+
runs-on: ubuntu-latest
112+
continue-on-error: true
113+
env:
114+
TESTS_ROOT_VERSION: ${{ github.event_name == 'pull_request' && format('dev-{0}', github.event.pull_request.head.ref) || 'dev-main' }}
115+
steps:
116+
- uses: actions/checkout@v6
117+
118+
- name: Setup PHP
119+
uses: shivammathur/setup-php@v2
120+
with:
121+
php-version: '8.3'
122+
123+
- name: Cache Composer dependencies
124+
uses: actions/cache@v5
125+
with:
126+
path: /tmp/composer-cache
127+
key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
128+
restore-keys: |
129+
${{ runner.os }}-composer-
130+
131+
- name: Mark workspace as safe for git
132+
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
133+
134+
- name: Install dependencies
135+
env:
136+
COMPOSER_AUTH: '{"github-oauth": {"github.com": "${{ github.token }}"} }'
137+
COMPOSER_CACHE_DIR: /tmp/composer-cache
138+
COMPOSER_ROOT_VERSION: ${{ env.TESTS_ROOT_VERSION }}
139+
run: composer install --prefer-dist --no-progress --no-interaction --no-plugins --no-scripts
140+
141+
- name: Run dependency health check
142+
env:
143+
COMPOSER_ROOT_VERSION: ${{ env.TESTS_ROOT_VERSION }}
144+
run: composer dev-tools dependencies -- --max-outdated=${{ inputs.max-outdated || 5 }}

‎README.md‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,9 @@ composer dev-tools tests
5353
# Analyze missing and unused Composer dependencies
5454
composer dependencies
5555
vendor/bin/dev-tools dependencies
56+
composer dev-tools dependencies -- --max-outdated=8
57+
composer dev-tools dependencies -- --dev
58+
composer dev-tools dependencies -- --upgrade --dev
5659

5760
# Analyze code metrics with PhpMetrics
5861
composer metrics
@@ -105,7 +108,8 @@ composer dev-tools update-composer-json --force
105108
composer dev-tools:sync
106109
```
107110

108-
The `dependencies` command ships with both dependency analyzers as direct
111+
The `dependencies` command ships with both dependency analyzers and
112+
`rector/jack` as direct
109113
dependencies of `fast-forward/dev-tools`, so it works without extra
110114
installation in the consumer project.
111115

@@ -125,7 +129,7 @@ automation assets.
125129
|---------|---------|
126130
| `composer dev-tools` | Runs the full `standards` pipeline. |
127131
| `composer dev-tools tests` | Runs PHPUnit with local-or-packaged configuration. |
128-
| `composer dev-tools dependencies` | Reports missing and unused Composer dependencies. |
132+
| `composer dev-tools dependencies` | Previews Jack dependency updates, then reports missing, unused, and overly outdated Composer dependencies. |
129133
| `composer dev-tools metrics` | Runs PhpMetrics for a working directory and generates requested report artifacts. |
130134
| `composer dev-tools docs` | Builds the HTML documentation site from PSR-4 code and `docs/`. |
131135
| `composer dev-tools skills` | Creates or repairs packaged skill links in `.agents/skills`. |

‎composer.json‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -32,31 +32,32 @@
3232
"composer/composer": "^2.9",
3333
"container-interop/service-provider": "^0.4.1",
3434
"dg/bypass-finals": "^1.9",
35-
"ergebnis/composer-normalize": "^2.50",
36-
"ergebnis/rector-rules": "^1.14",
35+
"ergebnis/composer-normalize": "^2.51",
36+
"ergebnis/rector-rules": "^1.18",
3737
"fakerphp/faker": "^1.24",
3838
"fast-forward/phpdoc-bootstrap-template": "^1.0",
39-
"friendsofphp/php-cs-fixer": "^3.94",
39+
"friendsofphp/php-cs-fixer": "^3.95",
4040
"icanhazstring/composer-unused": "^0.9.6",
4141
"jolicode/jolinotif": "^3.3",
4242
"nikic/php-parser": "^5.7",
4343
"php-di/php-di": "^7.1",
4444
"php-parallel-lint/php-parallel-lint": "^1.4",
4545
"phpdocumentor/shim": "^3.9",
4646
"phpmetrics/phpmetrics": "^2.9",
47-
"phpro/grumphp-shim": "^2.19",
47+
"phpro/grumphp-shim": "^2.20",
4848
"phpspec/prophecy": "^1.26",
4949
"phpspec/prophecy-phpunit": "^2.5",
50-
"phpunit/php-code-coverage": "^12.5",
51-
"phpunit/phpunit": "^12.5",
50+
"phpunit/php-code-coverage": "^12.5 || ^13.0",
51+
"phpunit/phpunit": "^12.5 || ^13.0",
5252
"psr/clock": "^1.0",
5353
"psr/container": "^2.0",
5454
"psr/log": "^3.0",
5555
"pyrech/composer-changelogs": "^2.2",
56-
"rector/rector": "^2.3",
56+
"rector/jack": "^0.5",
57+
"rector/rector": "^2.4",
5758
"saggre/phpdocumentor-markdown": "^1.0",
5859
"shipmonk/composer-dependency-analyser": "^1.8.4",
59-
"symfony/config": "^7.4",
60+
"symfony/config": "^7.4 || ^8.0",
6061
"symfony/console": "^7.4 || ^8.0",
6162
"symfony/filesystem": "^7.4 || ^8.0",
6263
"symfony/finder": "^7.4 || ^8.0",
@@ -65,7 +66,7 @@
6566
"symfony/var-exporter": "^7.4 || ^8.0",
6667
"symplify/easy-coding-standard": "^13.0",
6768
"thecodingmachine/safe": "^3.4",
68-
"twig/twig": "^3.0"
69+
"twig/twig": "^3.24"
6970
},
7071
"minimum-stability": "stable",
7172
"autoload": {

‎docs/commands/dependencies.rst‎

Lines changed: 50 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,13 @@ Analyzes missing and unused Composer dependencies.
66
Description
77
-----------
88

9-
The ``dependencies`` command (alias: ``deps``) analyzes missing and unused
9+
The ``dependencies`` command (alias: ``deps``) analyzes missing, unused, and
10+
overly outdated
1011
Composer dependencies using two tools:
1112

1213
- ``composer-unused`` - detects unused packages
1314
- ``composer-dependency-analyser`` - detects missing packages
15+
- ``jack breakpoint`` - fails when too many outdated packages accumulate
1416

1517
This command ships as a direct dependency of ``fast-forward/dev-tools``.
1618

@@ -31,7 +33,23 @@ Usage
3133
Options
3234
-------
3335

34-
This command does not accept additional options.
36+
``--max-outdated=<count>`` (optional)
37+
Maximum number of outdated packages allowed by ``jack breakpoint``.
38+
39+
Default: ``5``.
40+
41+
``--upgrade`` (optional)
42+
Applies the Jack upgrade workflow before the analyzers:
43+
44+
- ``vendor/bin/jack open-versions``
45+
- ``vendor/bin/jack raise-to-installed``
46+
- ``composer update -W``
47+
48+
Without ``--upgrade``, the command runs the Jack workflow in preview mode
49+
before the analyzers.
50+
51+
``--dev`` (optional)
52+
Prioritizes dev dependencies where Jack supports it.
3553

3654
Examples
3755
--------
@@ -42,6 +60,24 @@ Run dependency analysis:
4260
4361
composer dependencies
4462
63+
Allow up to 10 outdated packages:
64+
65+
.. code-block:: bash
66+
67+
composer dev-tools dependencies -- --max-outdated=10
68+
69+
Preview the upgrade workflow:
70+
71+
.. code-block:: bash
72+
73+
composer dev-tools dependencies -- --dev
74+
75+
Apply the upgrade workflow and then analyze dependencies:
76+
77+
.. code-block:: bash
78+
79+
composer dev-tools dependencies -- --upgrade --dev
80+
4581
Using the alias:
4682

4783
.. code-block:: bash
@@ -57,16 +93,23 @@ Exit Codes
5793
* - Code
5894
- Meaning
5995
* - 0
60-
- Success. No missing or unused dependencies.
96+
- Success. No missing, unused, or excessive outdated dependencies.
6197
* - 1
62-
- Failure. Missing or unused dependencies found.
98+
- Failure. A dependency analyzer or Jack reported findings or errors.
6399

64100
Behavior
65101
---------
66102

67-
- Runs both ``composer-unused`` and ``composer-dependency-analyser``.
103+
- Runs ``composer-unused``, ``composer-dependency-analyser``, and
104+
``jack breakpoint``.
68105
- ``composer-dependency-analyser`` is configured with:
69106
- ``--ignore-unused-deps`` (leaves unused detection to ``composer-unused``)
70107
- ``--ignore-prod-only-in-dev-deps`` (ignores dev-only usage in production code)
71-
- Returns a non-zero exit code when missing or unused dependencies are found.
72-
- Both tools must be available in ``vendor/bin/``.
108+
- ``jack breakpoint`` maps ``--max-outdated`` to Jack's ``--limit`` option.
109+
- It always previews Jack's ``open-versions`` and ``raise-to-installed``
110+
commands before the analyzers.
111+
- ``--upgrade`` applies Jack's ``open-versions`` and ``raise-to-installed``
112+
commands before ``composer update -W``.
113+
- Returns a non-zero exit code when missing, unused, or too many outdated
114+
dependencies are found.
115+
- All three tools must be available in ``vendor/bin/``.

‎docs/running/specialized-commands.rst‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,16 +31,25 @@ Analyzes missing and unused Composer dependencies.
3131
.. code-block:: bash
3232
3333
composer dependencies
34+
composer dev-tools dependencies -- --max-outdated=10
35+
composer dev-tools dependencies -- --dev
36+
composer dev-tools dependencies -- --upgrade --dev
3437
3538
Important details:
3639

3740
- it ships ``shipmonk/composer-dependency-analyser`` and
38-
``icanhazstring/composer-unused`` as direct dependencies of
41+
``icanhazstring/composer-unused`` and ``rector/jack`` as direct dependencies of
3942
``fast-forward/dev-tools``;
4043
- it uses ``composer-dependency-analyser`` only for missing dependency checks
4144
and leaves unused-package reporting to ``composer-unused``;
42-
- it returns a non-zero exit code when missing or unused dependencies are
43-
found.
45+
- it uses ``jack breakpoint --limit=<max-outdated>`` to fail when too many
46+
outdated dependencies accumulate;
47+
- it previews ``jack open-versions`` and ``jack raise-to-installed`` before
48+
the analyzers;
49+
- ``--upgrade`` runs ``jack open-versions``, ``jack raise-to-installed``, and
50+
``composer update -W`` before the analyzers;
51+
- it returns a non-zero exit code when missing, unused, or too many outdated
52+
dependencies are found.
4453

4554
``metrics``
4655
-----------

‎resources/github-actions/tests.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,25 @@ name: "Fast Forward Test Suite"
33
on:
44
push:
55
workflow_dispatch:
6+
inputs:
7+
run-dependencies-check:
8+
description: Whether to run the dependency health check during CI.
9+
required: false
10+
type: boolean
11+
default: true
12+
max-outdated:
13+
description: Maximum number of outdated packages allowed by the dependencies command.
14+
required: false
15+
type: number
16+
default: 5
617

718
permissions:
819
contents: read
920

1021
jobs:
1122
tests:
1223
uses: php-fast-forward/dev-tools/.github/workflows/tests.yml@main
24+
with:
25+
run-dependencies-check: ${{ inputs.run-dependencies-check || true }}
26+
max-outdated: ${{ inputs.max-outdated || 5 }}
1327
secrets: inherit

0 commit comments

Comments
 (0)