From afecc20cfae9d1a6aaddfb5ebe6c80c4f53792ea Mon Sep 17 00:00:00 2001 From: Andrew Longosz Date: Fri, 19 Jun 2026 12:56:32 +0200 Subject: [PATCH 01/10] [GHA] Updated actions/cache to v6 Co-Authored-By: Claude Fable 5 --- .github/workflows/integration-tests-callable.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/integration-tests-callable.yaml b/.github/workflows/integration-tests-callable.yaml index 4372dc0a..cdb746a4 100644 --- a/.github/workflows/integration-tests-callable.yaml +++ b/.github/workflows/integration-tests-callable.yaml @@ -42,7 +42,7 @@ jobs: php-version: '${{ matrix.php }}' - name: Cache dependencies - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ${{ env.COMPOSER_CACHE_DIR }} key: ${{ env.PROJECT_EDITION }}-${{ env.version }}-${{ github.sha }} From 56b0baf05843f2cb0a209532538b16151348dab4 Mon Sep 17 00:00:00 2001 From: Andrew Longosz Date: Fri, 19 Jun 2026 12:57:29 +0200 Subject: [PATCH 02/10] [GHA] Updated actions/checkout to v7 Co-Authored-By: Codex --- .github/workflows/backend-ci.yaml | 4 ++-- .github/workflows/integration-tests-callable.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/backend-ci.yaml b/.github/workflows/backend-ci.yaml index c9d0b5f8..854b410c 100644 --- a/.github/workflows/backend-ci.yaml +++ b/.github/workflows/backend-ci.yaml @@ -16,7 +16,7 @@ jobs: php: - '8.1' steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: ibexa/gh-workflows/actions/composer-install@main with: @@ -42,7 +42,7 @@ jobs: - '8.4' steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: ibexa/gh-workflows/actions/composer-install@main with: diff --git a/.github/workflows/integration-tests-callable.yaml b/.github/workflows/integration-tests-callable.yaml index cdb746a4..8d946b07 100644 --- a/.github/workflows/integration-tests-callable.yaml +++ b/.github/workflows/integration-tests-callable.yaml @@ -23,7 +23,7 @@ jobs: - php: '8.3' node: 22 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Set project version run: | From a700689f6810c766e4b276c242df535e62f4d0c4 Mon Sep 17 00:00:00 2001 From: Andrew Longosz Date: Fri, 19 Jun 2026 13:08:49 +0200 Subject: [PATCH 03/10] [GHA][REST integration] Configured explicitly generated GitHub App token --- .github/workflows/backend-ci.yaml | 1 + .github/workflows/integration-tests-callable.yaml | 15 +++++++++++++++ 2 files changed, 16 insertions(+) diff --git a/.github/workflows/backend-ci.yaml b/.github/workflows/backend-ci.yaml index 854b410c..c810e7b5 100644 --- a/.github/workflows/backend-ci.yaml +++ b/.github/workflows/backend-ci.yaml @@ -65,3 +65,4 @@ jobs: functional-tests: name: "REST functional tests" uses: ./.github/workflows/integration-tests-callable.yaml + secrets: inherit diff --git a/.github/workflows/integration-tests-callable.yaml b/.github/workflows/integration-tests-callable.yaml index 8d946b07..92e78b63 100644 --- a/.github/workflows/integration-tests-callable.yaml +++ b/.github/workflows/integration-tests-callable.yaml @@ -49,6 +49,21 @@ jobs: restore-keys: | ${{ env.PROJECT_EDITION }}-${{ env.version }} + - name: Generate token + id: generate_token + uses: actions/create-github-app-token@v3 + with: + client-id: ${{ secrets.AUTOMATION_CLIENT_ID }} + private-key: ${{ secrets.AUTOMATION_CLIENT_SECRET }} + owner: ${{ github.repository_owner }} + + - name: Add composer key for GitHub App + if: ${{ steps.generate_token.outputs.token != '' }} + run: | + composer config github-oauth.github.com $GITHUB_TOKEN + env: + GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }} + - name: Set up whole project using the tested dependency run: | curl -L "https://raw.githubusercontent.com/ibexa/ci-scripts/main/bin/${{ env.version }}/prepare_project_edition.sh" > prepare_project_edition.sh From c4f9b503c9e935f0562c09b00aac26920f0699b8 Mon Sep 17 00:00:00 2001 From: Andrew Longosz Date: Fri, 19 Jun 2026 16:35:45 +0200 Subject: [PATCH 04/10] [GHA][REST integration] Bumped Node version for PHP 7.4 to 20 --- .github/workflows/integration-tests-callable.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/integration-tests-callable.yaml b/.github/workflows/integration-tests-callable.yaml index 92e78b63..beb19db6 100644 --- a/.github/workflows/integration-tests-callable.yaml +++ b/.github/workflows/integration-tests-callable.yaml @@ -19,7 +19,7 @@ jobs: matrix: include: - php: '7.4' - node: 18 + node: 20 - php: '8.3' node: 22 steps: From 3de1fc7533a7765592641b838a626d9ddecadb26 Mon Sep 17 00:00:00 2001 From: Andrew Longosz Date: Fri, 19 Jun 2026 16:55:37 +0200 Subject: [PATCH 05/10] [Tests] Fixed incorrect usage of `json_decode` Co-Authored-By: Codex --- tests/bundle/Functional/SessionTest.php | 6 +++--- tests/bundle/Functional/TestCase.php | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/bundle/Functional/SessionTest.php b/tests/bundle/Functional/SessionTest.php index 24942946..9b1e971c 100644 --- a/tests/bundle/Functional/SessionTest.php +++ b/tests/bundle/Functional/SessionTest.php @@ -159,7 +159,7 @@ public function testDeletedSessionCookieCannotReauthenticate(): void ); $currentSessionResponse = $this->sendHttpRequest($currentSessionRequest); self::assertHttpResponseCodeEquals($currentSessionResponse, 200); - $authenticatedData = json_decode($currentSessionResponse->getBody()->getContents(), true, JSON_THROW_ON_ERROR); + $authenticatedData = json_decode($currentSessionResponse->getBody()->getContents(), true, 512, JSON_THROW_ON_ERROR); $authenticatedUserHref = $authenticatedData['Session']['User']['_href']; // Logout @@ -178,7 +178,7 @@ public function testDeletedSessionCookieCannotReauthenticate(): void ) ); - $reusedData = json_decode($reusedResponse->getBody()->getContents(), true, JSON_THROW_ON_ERROR); + $reusedData = json_decode($reusedResponse->getBody()->getContents(), true, 512, JSON_THROW_ON_ERROR); self::assertNotEquals( $authenticatedUserHref, $reusedData['Session']['User']['_href'], @@ -220,7 +220,7 @@ public function testCheckSession(): void $response = $this->sendHttpRequest($request); self::assertHttpResponseCodeEquals($response, 200); $contents = $response->getBody()->getContents(); - $data = json_decode($contents, true, JSON_THROW_ON_ERROR); + $data = json_decode($contents, true, 512, JSON_THROW_ON_ERROR); self::assertArrayHasKey('Session', $data); } diff --git a/tests/bundle/Functional/TestCase.php b/tests/bundle/Functional/TestCase.php index 2c36a61d..e22171da 100644 --- a/tests/bundle/Functional/TestCase.php +++ b/tests/bundle/Functional/TestCase.php @@ -400,7 +400,7 @@ protected function login(): \stdClass $response = $this->sendHttpRequest($request); self::assertHttpResponseCodeEquals($response, 201); - return json_decode($response->getBody()->getContents(), false, JSON_THROW_ON_ERROR)->Session; + return json_decode($response->getBody()->getContents(), false, 512, JSON_THROW_ON_ERROR)->Session; } /** From ff87253c71187aba3399bb198bf47a816e8cec1a Mon Sep 17 00:00:00 2001 From: Andrew Longosz Date: Fri, 19 Jun 2026 17:15:01 +0200 Subject: [PATCH 06/10] [CI][GHA][REST integration] Passed GitHub App token to setup PHP Co-Authored-By: Codex --- .../workflows/integration-tests-callable.yaml | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/.github/workflows/integration-tests-callable.yaml b/.github/workflows/integration-tests-callable.yaml index beb19db6..ea11d3ea 100644 --- a/.github/workflows/integration-tests-callable.yaml +++ b/.github/workflows/integration-tests-callable.yaml @@ -30,11 +30,20 @@ jobs: version=$(jq -r '.extra | ."branch-alias" | ."dev-main"' < composer.json) echo "version=$version" >> $GITHUB_ENV + - name: Generate token + id: generate_token + uses: actions/create-github-app-token@v3 + with: + client-id: ${{ secrets.AUTOMATION_CLIENT_ID }} + private-key: ${{ secrets.AUTOMATION_CLIENT_SECRET }} + owner: ${{ github.repository_owner }} + - name: Setup PHP Action uses: shivammathur/setup-php@v2 with: php-version: ${{ matrix.php }} coverage: none + github-token: ${{ steps.generate_token.outputs.token }} - name: Ignore unsolvable advisories for PHP versions past EOL uses: ibexa/gh-workflows/actions/composer-audit-ignore@main @@ -49,14 +58,6 @@ jobs: restore-keys: | ${{ env.PROJECT_EDITION }}-${{ env.version }} - - name: Generate token - id: generate_token - uses: actions/create-github-app-token@v3 - with: - client-id: ${{ secrets.AUTOMATION_CLIENT_ID }} - private-key: ${{ secrets.AUTOMATION_CLIENT_SECRET }} - owner: ${{ github.repository_owner }} - - name: Add composer key for GitHub App if: ${{ steps.generate_token.outputs.token != '' }} run: | From 52c8a29afdf8ab1bb903d8ed0e5936881cda0142 Mon Sep 17 00:00:00 2001 From: Andrew Longosz Date: Wed, 15 Jul 2026 19:19:37 +0200 Subject: [PATCH 07/10] [GHA][REST integration] Dropped Selenium from functional tests setup The selenium.yml compose file was only needed because it injects EZP_TEST_REST_HOST=$WEB_HOST into the app container, pointing the functional tests at the nginx "web" service instead of the default localhost. Passing the variable explicitly on docker compose exec makes the whole Selenium container redundant. Co-Authored-By: Claude Fable 5 --- .github/workflows/integration-tests-callable.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/integration-tests-callable.yaml b/.github/workflows/integration-tests-callable.yaml index ea11d3ea..7d2939c4 100644 --- a/.github/workflows/integration-tests-callable.yaml +++ b/.github/workflows/integration-tests-callable.yaml @@ -7,7 +7,7 @@ env: PHP_INI_ENV_memory_limit: 512M COMPOSER_CACHE_DIR: ~/.composer/cache PROJECT_EDITION: oss - SETUP: "doc/docker/base-dev.yml:doc/docker/selenium.yml" + SETUP: "doc/docker/base-dev.yml" WEB_HOST: web jobs: @@ -79,4 +79,4 @@ jobs: - name: Run tests run: | cd "$HOME/build/project" - docker compose --env-file=.env exec -T --user www-data app sh -c "cd vendor/ibexa/rest && composer update && composer test-functional" + docker compose --env-file=.env exec -T --user www-data -e EZP_TEST_REST_HOST=$WEB_HOST app sh -c "cd vendor/ibexa/rest && composer update && composer test-functional" From 337b199ca0293709085cd67155856ccefb55a2f6 Mon Sep 17 00:00:00 2001 From: Andrew Longosz Date: Wed, 15 Jul 2026 19:44:47 +0200 Subject: [PATCH 08/10] [Composer] Used branch-alias constraints instead of `@dev` stability flags `@dev` is only a stability flag: `~4.6.0@dev` still matches any tagged 4.6.* release, so the solver may resolve to old stable versions with different dependency sets. An explicit `~4.6.x-dev` branch-alias constraint is more predictable. Co-Authored-By: Claude Fable 5 --- composer.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/composer.json b/composer.json index 5390abc5..b7ba7768 100644 --- a/composer.json +++ b/composer.json @@ -30,7 +30,7 @@ "ext-libxml": "*", "ext-simplexml": "*", "ext-xmlwriter": "*", - "ibexa/core": "~4.6.0@dev", + "ibexa/core": "~4.6.x-dev", "symfony/http-kernel": "^5.3", "symfony/dependency-injection": "^5.3", "symfony/routing": "^5.3", @@ -47,7 +47,7 @@ }, "require-dev": { "ibexa/ci-scripts": "^0.2@dev", - "ibexa/doctrine-schema": "~4.6.0@dev", + "ibexa/doctrine-schema": "~4.6.x-dev", "ibexa/code-style": "^1.0", "ibexa/test-core": "^0.1.x-dev", "friendsofphp/php-cs-fixer": "^3.0", From 648b36270ab4bfb0d63d3f0b9daacf7d20225e0e Mon Sep 17 00:00:00 2001 From: Andrew Longosz Date: Wed, 15 Jul 2026 19:48:03 +0200 Subject: [PATCH 09/10] [Composer] Dropped `ibexa/ci-scripts` dev dependency ibexa/ci-scripts is a standalone project; CI workflows fetch its scripts directly from GitHub, so the Composer package was unused. Co-Authored-By: Claude Fable 5 --- composer.json | 1 - 1 file changed, 1 deletion(-) diff --git a/composer.json b/composer.json index b7ba7768..c5bfb77f 100644 --- a/composer.json +++ b/composer.json @@ -46,7 +46,6 @@ "lexik/jwt-authentication-bundle": "^2.8" }, "require-dev": { - "ibexa/ci-scripts": "^0.2@dev", "ibexa/doctrine-schema": "~4.6.x-dev", "ibexa/code-style": "^1.0", "ibexa/test-core": "^0.1.x-dev", From bc3001a9b802a532f2c4c75ae5efb009addc7a2c Mon Sep 17 00:00:00 2001 From: Andrew Longosz Date: Wed, 15 Jul 2026 20:28:29 +0200 Subject: [PATCH 10/10] [GHA][REST integration] Applied Composer audit ignores inside tested package Audit ignores were only ever configured on the workflow checkout, which becomes vendor/ibexa/rest solely when this callable runs in ibexa/rest itself. For external callers (e.g. ibexa/http-cache) the checkout is the caller's package and vendor/ibexa/rest comes pristine from the 4.6 branch, so its composer update hit Composer 2.10's advisory blocking on PHP 7.4 (unsolvable twig/guzzle advisories on EOL PHP). Applying the ignores inside vendor/ibexa/rest covers every caller and makes the runner-side audit ignores step redundant, hence it's dropped. Co-Authored-By: Claude Fable 5 --- .../workflows/integration-tests-callable.yaml | 22 +++++++++++++------ 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/.github/workflows/integration-tests-callable.yaml b/.github/workflows/integration-tests-callable.yaml index 7d2939c4..4071e743 100644 --- a/.github/workflows/integration-tests-callable.yaml +++ b/.github/workflows/integration-tests-callable.yaml @@ -45,11 +45,6 @@ jobs: coverage: none github-token: ${{ steps.generate_token.outputs.token }} - - name: Ignore unsolvable advisories for PHP versions past EOL - uses: ibexa/gh-workflows/actions/composer-audit-ignore@main - with: - php-version: '${{ matrix.php }}' - - name: Cache dependencies uses: actions/cache@v6 with: @@ -76,7 +71,20 @@ jobs: cd "$HOME/build/project" docker compose --env-file=.env exec -T --user www-data app sh -c "APP_ENV=behat php bin/console ibexa:behat:create-language 'pol-PL' 'Polish (polski)'" - - name: Run tests + - name: Configure composer inside vendor/ibexa/rest + run: | + cd "$HOME/build/project" + docker compose --env-file=.env exec -T --user www-data app sh -c " + cd vendor/ibexa/rest && + curl -fsSLO https://raw.githubusercontent.com/ibexa/ci-scripts/main/bin/_common/configure_composer_audit_ignores.sh && + bash configure_composer_audit_ignores.sh && + composer update + " + + - name: Run tests inside vendor/ibexa/rest against configured instance run: | cd "$HOME/build/project" - docker compose --env-file=.env exec -T --user www-data -e EZP_TEST_REST_HOST=$WEB_HOST app sh -c "cd vendor/ibexa/rest && composer update && composer test-functional" + docker compose --env-file=.env exec -T --user www-data -e EZP_TEST_REST_HOST=$WEB_HOST app sh -c " + cd vendor/ibexa/rest && + composer test-functional + "