Merge v19 -> v20

.github/phpstan.neon

@@ -45,7 +45,7 @@ parameters:
         # Too much noise from "Variable $this might not be defined"
         - */app/code/core/*/*/data/*
         - */app/code/core/*/*/sql/*
-    level: 2
+    level: 3
     checkFunctionNameCase: true
     checkInternalClassCaseSensitivity: true
 

.github/phpstan_experimental_level.neon

@@ -1,4 +1,9 @@
 includes:
     - phpstan.neon
 parameters:
-    level: 3
+    paths:
+         - %currentWorkingDirectory%/app/code/core/Mage
+         - %currentWorkingDirectory%/lib/Mage
+         - %currentWorkingDirectory%/lib/Magento
+         - %currentWorkingDirectory%/lib/Varien
+    level: 4

.github/workflows/labeler.yml

@@ -11,7 +11,7 @@ on:
 
 jobs:
   triage:
-    runs-on: ubuntu-latest
+    runs-on: [ubuntu-latest]
     steps:
       - uses: actions/labeler@main
         with:

.github/workflows/phpstan.yml

@@ -0,0 +1,54 @@
+name: "PHPStan Static Code Analyses"
+
+on:
+  # Run on all pushes and on all pull requests.
+  # Prevent the build from running when there are only irrelevant changes.
+  push:
+    paths:
+      - '**.php'
+  pull_request:
+    paths:
+      - '**.php'
+  # Allow manually triggering the workflow.
+  workflow_dispatch:
+
+jobs:
+  php_stan:
+    runs-on: [ubuntu-latest]
+
+    strategy:
+      matrix:
+        config_files: [
+          '.github/phpstan.neon',
+          '.github/phpstan_experimental_level.neon'
+        ]
+
+    name: PHP Stan ${{ matrix.config_files }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Validate composer
+        run: composer validate --strict
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache dependencies
+        uses: actions/cache@v2
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install dependencies
+        run: composer install --prefer-dist --no-progress --ignore-platform-req=ext-*
+
+      - name: ensure existance of ./app/code/local
+        run: mkdir -p app/code/local
+
+      - name: PHPStan Static Analysis
+        run: php vendor/bin/phpstan.phar analyze -c ${{ matrix.config_files }}
+        continue-on-error: ${{ matrix.config_files == '.github/phpstan_experimental_level.neon' }}

.github/workflows/unit-tests.yml → .github/workflows/phpunit.yml

@@ -1,22 +1,40 @@
 name: OpenMage LTS - Unit Tests
 
 on:
+  # Run on all pushes and on all pull requests.
+  # Prevent the build from running when there are only irrelevant changes.
   push:
+    paths:
+      - '**.php'
   pull_request:
+    paths:
+      - '**.php'
+  # Allow manually triggering the workflow.
+  workflow_dispatch:
 
 jobs:
   unit-tests:
-
-    runs-on: ubuntu-latest
+    runs-on: [ubuntu-latest]
 
     steps:
       - uses: actions/checkout@v3
         with:
           repository: OpenMage/Testfield
           path: ./
 
-      - name: php & Composer version
-        run: php --version && composer --version
+      - name: Validate composer
+        run: composer validate
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache dependencies
+        uses: actions/cache@v2
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
 
       - name: Install dependencies
         run: composer install --prefer-dist --no-progress --ignore-platform-reqs

.github/workflows/security-php.yml

@@ -0,0 +1,27 @@
+name: "PHP Security Check"
+
+on:
+  # Run automatically every Monday on midnight.
+  schedule:
+    - cron: '0 0 * * 1'
+  # Run on pull requests only when composer.lock has changed.
+  pull_request:
+    paths:
+      - 'composer.lock'
+  # Allow manually triggering the workflow.
+  workflow_dispatch:
+
+jobs:
+  check:
+    runs-on: [ubuntu-latest]
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/cache@v2
+        id: cache-db
+        with:
+          path: ~/.symfony/cache
+          key: db
+
+      - uses: symfonycorp/security-checker-action@v4

.github/workflows/sonar.yml

@@ -1,43 +1,61 @@
 name: OpenMage LTS - Sonar - Full Analyses
 
 on:
+  # Run on all pushes and on all pull requests.
+  # Prevent the build from running when there are only irrelevant changes.
   push:
+    paths-ignore:
+      - '**.md'
   pull_request:
+    paths-ignore:
+      - '**.md'
     types: [opened, synchronize, reopened]
 
-
-
 jobs:
   unit:
-    name: Unit Tests on ${{ matrix.php-versions }}
-    runs-on: ${{ matrix.operating-system }}
+    name: Unit Tests on ${{ matrix.php }}
+    runs-on: ${{ matrix.os }}
     strategy:
       max-parallel: 5
       matrix:
-        operating-system: [ubuntu-latest]
-        php-versions: ['7.4', '8.1']
+        os: [ubuntu-latest]
+        php: ['7.4', '8.1']
     steps:
       - uses: actions/checkout@v3
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: ${{ matrix.php-versions }}
+          php-version: ${{ matrix.php }}
           extensions: mbstring
           tools: composer, pecl, phpcs, phpstan, phpunit:9.5
-          ini-values-csv: pcov.directory=api, post_max_size=256M, short_open_tag=On #optional, setup php.ini configuration
+          ini-values: pcov.directory=api, post_max_size=256M, short_open_tag=On #optional, setup php.ini configuration
           coverage: pcov #optional, setup coverage driver
         env:
           COMPOSER_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Prepare
-        run: |
-          php -v
-          composer --version
-          composer install --dev -n --prefer-source --ignore-platform-req=php
+
+      - name: Validate composer
+        run: composer validate --strict
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache dependencies
+        uses: actions/cache@v2
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install dependencies
+        run: composer install --dev -n --prefer-source --ignore-platform-req=php+
+
       - name: Run Unit Tests
         run: phpunit --configuration ./dev/phpunit.xml.dist --testsuite=Unit;
+
       - name: prepare SonarCloud Scan Data
         continue-on-error: true
-        if: ${{ matrix.php-versions == '8.1' }}
+        if: ${{ matrix.php == '8.1' }}
         run: |
           echo $PWD
           ls -la
@@ -46,10 +64,11 @@ jobs:
           sed -i 's@'$GITHUB_WORKSPACE'/@/github/workspace/@g' ./dev/tests/clover.xml
           head ./dev/tests/clover.xml
           ls -la
+
       - name: SonarCloud Scan
         uses: SonarSource/sonarcloud-github-action@master
         continue-on-error: true
-        if: ${{ matrix.php-versions == '8.1' }} && SONAR_TOKEN
+        if: ${{ matrix.php == '8.1' }} && SONAR_TOKEN
         with:
           args: >
             -Dproject.settings=dev/sonar-project.properties