From ca8a1c3a006414062b40ffcfb810bd7f33382bd1 Mon Sep 17 00:00:00 2001 From: Aditya Singh Date: Thu, 7 May 2026 17:21:48 +0530 Subject: [PATCH 1/2] feat: add rtcamp-standard reusable workflow with build-artifact gate and PHPStan Introduces .github/workflows/rtcamp-standard.yml as a reusable workflow exposing two jobs: - build-artifact-gate: fails any PR that commits files under assets/build/ (configurable via build-artifact-paths input). Diffs PR head against the base ref and reports offending files with a fix hint. - phpstan: runs `composer phpstan` (gated by the run-phpstan input so callers can skip when no PHP files changed). --- .github/workflows/rtcamp-standard.yml | 97 +++++++++++++++++++++++++++ .github/workflows/test-measure.yml | 10 ++- 2 files changed, 106 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/rtcamp-standard.yml diff --git a/.github/workflows/rtcamp-standard.yml b/.github/workflows/rtcamp-standard.yml new file mode 100644 index 00000000..6d748e49 --- /dev/null +++ b/.github/workflows/rtcamp-standard.yml @@ -0,0 +1,97 @@ +name: rtCamp Standard + +on: + workflow_call: + inputs: + build-artifact-paths: + description: 'Newline-separated paths whose contents must not be committed.' + required: false + type: string + default: | + assets/build/ + run-phpstan: + description: 'Whether to run the PHPStan job.' + required: false + type: boolean + default: true + +permissions: + contents: read + +jobs: + build-artifact-gate: + name: 'Block committed build artifacts' + runs-on: ubuntu-latest + if: ${{ github.event_name == 'pull_request' }} + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Fetch base branch + run: git fetch --depth=1 --no-tags origin "${{ github.base_ref }}" + + - name: Detect committed build artifacts + env: + GATED_PATHS: ${{ inputs.build-artifact-paths }} + run: | + set -euo pipefail + + PATTERN=$(printf '%s\n' "$GATED_PATHS" \ + | sed 's/^[[:space:]]*//; s/[[:space:]]*$//' \ + | grep -v '^$' \ + | sed 's/\./\\./g' \ + | paste -sd '|' -) + + if [[ -z "$PATTERN" ]]; then + echo "No gated paths configured; skipping." + exit 0 + fi + + ANCHORED="^(${PATTERN})" + echo "Checking changed files against: ${ANCHORED}" + + CHANGED=$(git diff --name-only --diff-filter=ACMR FETCH_HEAD HEAD \ + | grep -E "${ANCHORED}" || true) + + if [[ -n "$CHANGED" ]]; then + echo "::error::Build artifacts must not be committed. Offending files:" + printf '%s\n' "$CHANGED" | sed 's/^/ - /' + echo + echo "These paths are produced by CI on merge. Remove them from the PR" + echo "(e.g. 'git rm --cached ') and ensure they are gitignored." + exit 1 + fi + + echo "No committed build artifacts detected." + + phpstan: + name: 'PHPStan' + runs-on: ubuntu-latest + if: ${{ inputs.run-phpstan }} + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Setup PHP + uses: shivammathur/setup-php@v2 + with: + php-version: '8.2' + coverage: none + + - name: Get Composer Cache Directory + id: composer-cache + run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT + + - name: Configure Composer cache + uses: actions/cache@v5.0.3 + with: + path: ${{ steps.composer-cache.outputs.dir }} + key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }} + restore-keys: | + ${{ runner.os }}-composer- + + - name: Install Composer dependencies + run: composer install --prefer-dist --optimize-autoloader --no-progress --no-interaction --no-scripts + + - name: Run PHPStan + run: composer phpstan diff --git a/.github/workflows/test-measure.yml b/.github/workflows/test-measure.yml index 7ade3296..a8225dbf 100644 --- a/.github/workflows/test-measure.yml +++ b/.github/workflows/test-measure.yml @@ -61,7 +61,7 @@ jobs: MODIFIED_FILES_DATA=$(node .github/bin/determine-modified-files-count.js "$IGNORE_PATH_REGEX" "$MODIFIED_FILES" "all") CSS_FILE_COUNT=$(node .github/bin/determine-modified-files-count.js ".+\.s?css|package\.json|package-lock\.json" "$MODIFIED_FILES") JS_FILE_COUNT=$(node .github/bin/determine-modified-files-count.js ".+\.(js|snap)|package\.json|package-lock\.json" "$MODIFIED_FILES") - PHP_FILE_COUNT=$(node .github/bin/determine-modified-files-count.js ".+\.php|composer\.(json|lock)|phpstan\.neon\.dist" "$MODIFIED_FILES") + PHP_FILE_COUNT=$(node .github/bin/determine-modified-files-count.js ".+\.php|composer\.(json|lock)|phpstan\.neon\.dist|phpstan-baseline\.neon" "$MODIFIED_FILES") GHA_WORKFLOW_COUNT=$(node .github/bin/determine-modified-files-count.js "(\.github\/(workflows|actions)\/.+\.yml)" "$MODIFIED_FILES") echo "Changed file count: $MODIFIED_FILES_DATA" @@ -218,3 +218,11 @@ jobs: run: npm run build:prod env: CI: true + + rtcamp-standard: + name: 'rtCamp Standard' + needs: pre-run + if: ${{ github.event_name == 'pull_request' }} + uses: ./.github/workflows/rtcamp-standard.yml + with: + run-phpstan: ${{ fromJSON(needs.pre-run.outputs.changed-php-count) > 0 }} From 9a97196d557ac9ac1c6cf60fc01933170aef129a Mon Sep 17 00:00:00 2001 From: Aditya Singh Date: Mon, 18 May 2026 10:03:55 +0530 Subject: [PATCH 2/2] refactor: replace custom build artifact detection with shared workflow --- .github/workflows/rtcamp-standard.yml | 44 ++------------------------- 1 file changed, 3 insertions(+), 41 deletions(-) diff --git a/.github/workflows/rtcamp-standard.yml b/.github/workflows/rtcamp-standard.yml index 6d748e49..60e1757c 100644 --- a/.github/workflows/rtcamp-standard.yml +++ b/.github/workflows/rtcamp-standard.yml @@ -21,48 +21,10 @@ permissions: jobs: build-artifact-gate: name: 'Block committed build artifacts' - runs-on: ubuntu-latest if: ${{ github.event_name == 'pull_request' }} - steps: - - name: Checkout - uses: actions/checkout@v6 - - - name: Fetch base branch - run: git fetch --depth=1 --no-tags origin "${{ github.base_ref }}" - - - name: Detect committed build artifacts - env: - GATED_PATHS: ${{ inputs.build-artifact-paths }} - run: | - set -euo pipefail - - PATTERN=$(printf '%s\n' "$GATED_PATHS" \ - | sed 's/^[[:space:]]*//; s/[[:space:]]*$//' \ - | grep -v '^$' \ - | sed 's/\./\\./g' \ - | paste -sd '|' -) - - if [[ -z "$PATTERN" ]]; then - echo "No gated paths configured; skipping." - exit 0 - fi - - ANCHORED="^(${PATTERN})" - echo "Checking changed files against: ${ANCHORED}" - - CHANGED=$(git diff --name-only --diff-filter=ACMR FETCH_HEAD HEAD \ - | grep -E "${ANCHORED}" || true) - - if [[ -n "$CHANGED" ]]; then - echo "::error::Build artifacts must not be committed. Offending files:" - printf '%s\n' "$CHANGED" | sed 's/^/ - /' - echo - echo "These paths are produced by CI on merge. Remove them from the PR" - echo "(e.g. 'git rm --cached ') and ensure they are gitignored." - exit 1 - fi - - echo "No committed build artifacts detected." + uses: rtCamp/wp-shared-workflows/.github/workflows/ci-build-artifact-gate.yml@ff44a8745c5360e28a5316c39b4468c6cf5e0cb6 + with: + gated-paths: ${{ inputs.build-artifact-paths }} phpstan: name: 'PHPStan'