githubmirror/symfony

.github/sync-maintained-versions.php
153 строки5 KB
Hugo Alliaume
[CI] pin GitHub Actions references and add Dependabot
05 июн 2026, 11:21
05 июн 2026, 11:2161c7551
<?php

// Syncs branch-dependent CI config from the maintained branches published at
// https://symfony.com/maintained-versions.json (ordered low -> high).
//
// Standalone helper: run it by hand whenever the maintained branches change.
//
// Updates:
//   - .github/dependabot.yml             one github-actions entry per maintained
//                                        branch; cooldown.default-days grows by one
//                                        in merge-up order so the lowest branch
//                                        surfaces first and the review queue is staggered.
//   - .github/workflows/scorecards.yml   push trigger pinned to the default (highest) branch.
//   - .github/workflows/unit-tests.yml   LTS test versions for the current branch: cross-test
//                                        against the latest LTS at or below it, low-deps floor
//                                        against the LTS one major below that.
//
// Usage:
//   php .github/sync-maintained-versions.php           # rewrite the files
//   php .github/sync-maintained-versions.php --check    # exit 1 if anything would change

if ('cli' !== PHP_SAPI) {
    echo "This script can only be run from the command line.\n";
    exit(1);
}

$self = basename(__FILE__);
$source = 'https://symfony.com/maintained-versions.json';
$branches = json_decode(file_get_contents($source), true, 512, \JSON_THROW_ON_ERROR);

if (!\is_array($branches) || !$branches) {
    fwrite(\STDERR, "No maintained versions found at $source\n");
    exit(1);
}

$branches = array_values($branches);
$default = end($branches); // highest branch == dev == default
$check = \in_array('--check', $argv, true);

// Identify the checked-out branch from the source tree itself (robust to detached
// HEAD and branch naming, unlike `git branch`), then refuse to run unless it is one
// of the maintained versions.
if (!preg_match("/VERSION = '(\d+\.\d+)/", file_get_contents(__DIR__.'/../src/Symfony/Component/HttpKernel/Kernel.php'), $m)) {
    fwrite(\STDERR, "Could not read the branch version from Kernel.php\n");
    exit(1);
}
$branch = $m[1];

if (!\in_array($branch, $branches, true)) {
    fwrite(\STDERR, "Refusing to run: $branch is not a maintained version (".implode(', ', $branches).")\n");
    exit(1);
}

$sync = static function (string $path, string $contents) use ($check): bool {
    if (is_file($path) && file_get_contents($path) === $contents) {
        return false;
    }
    if ($check) {
        fwrite(\STDERR, basename($path)." is out of date\n");
    } else {
        file_put_contents($path, $contents);
    }

    return true;
};

// --- .github/dependabot.yml -------------------------------------------------

$dependabot = <<<YAML
# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference

# Generated by .github/$self from $source
# One entry per maintained branch; cooldown increases in merge-up order so the lowest branch surfaces first.

version: 2
updates:

YAML;

$entry = <<<YAML
    - package-ecosystem: 'github-actions'
      directory: '/'
      target-branch: '%s'
      schedule:
          interval: 'weekly'
      groups:
          github-actions:
              patterns:
                  - '*'
      cooldown:
          default-days: %d

YAML;

foreach ($branches as $i => $b) {
    $dependabot .= "\n".sprintf($entry, $b, 7 + $i);
}

$dirty = $sync(__DIR__.'/dependabot.yml', rtrim($dependabot)."\n");

// --- .github/workflows/scorecards.yml (push trigger only) -------------------

$scorecards = __DIR__.'/workflows/scorecards.yml';
$yaml = file_get_contents($scorecards);
$patched = preg_replace('/^(\s*branches:\s*\[\s*")[^"]*("\s*\])/m', '${1}'.$default.'${2}', $yaml, 1, $count);

if (1 !== $count) {
    fwrite(\STDERR, "Could not find the push branch trigger in scorecards.yml\n");
    exit(1);
}

$dirty = $sync($scorecards, $patched) || $dirty;

// --- .github/workflows/unit-tests.yml (LTS test versions) -------------------

// LTS releases are the *.4 maintained versions. Cross-test against the latest one
// at or below this branch; the low-deps floor is the LTS one major below that.
$crossLts = null;
foreach (array_filter($branches, static fn ($v) => str_ends_with($v, '.4')) as $v) {
    if (version_compare($v, $branch, '<=')) {
        $crossLts = $v;
    }
}

if (null === $crossLts) {
    fwrite(\STDERR, "No maintained LTS at or below $branch\n");
    exit(1);
}

$floor = ((int) $crossLts - 1).'.4';

$unitTests = __DIR__.'/workflows/unit-tests.yml';
$yaml = file_get_contents($unitTests);

$patches = [
    ['/(&& echo )\d+\.\d+( \|\| echo \$SYMFONY_VERSION)/', '${1}'.$floor.'${2}'],
    ['/(# for )\d+\.\d+( LTS, checkout and test previous major)/', '${1}'.$crossLts.'${2}'],
    ['/(\$SYMFONY_VERSION = )\d+\.\d+/', '${1}'.$crossLts],
];

foreach ($patches as [$pattern, $replacement]) {
    $yaml = preg_replace($pattern, $replacement, $yaml, 1, $count);
    if (1 !== $count) {
        fwrite(\STDERR, "Could not patch unit-tests.yml ($pattern matched $count times)\n");
        exit(1);
    }
}

$dirty = $sync($unitTests, $yaml) || $dirty;

if ($check && $dirty) {
    exit(1);
}