Modernize skeleton to PHP 8.2+, PSR-12, and PHPUnit 11/12 - #1
Merged
Merged
Conversation
- Bump PHPUnit from the long-EOL 3.7.* to ^11.0 || ^12.0, dropping the unmaintained phpunit/dbunit and phpunit/phpunit-selenium dev dependencies that were unused by the skeleton and carried unnecessary supply-chain risk. - Switch autoloading from PSR-0 to PSR-4 and flatten lib/Application and tests/Application into lib/ and tests/ so the namespace root maps directly onto the source directory (mirrors DBDiff's src/ layout). - Rewrite Example.php and ExampleTest.php for PHP 8.2+: strict_types, scalar/union type hints, constructor-less typed property, PHPUnit attribute-based #[DataProvider] instead of the removed @dataProvider/ @ExpectedException annotations, and PSR-12 formatting throughout. - Modernize phpunit.xml to the PHPUnit 11 schema with a <source> block replacing the legacy <coverage><include> config. - Add PHP-CS-Fixer with a PSR-12 ruleset plus composer cs-check/cs-fix scripts. - Replace .travis.yml (PHP 5.4/5.5/5.6, long EOL and unpatched) with a GitHub Actions workflow that validates composer.json, checks coding standards, and runs tests across PHP 8.2-8.4. - Remove the committed composer.phar binary (stale, unpatched executable checked into version control) in favor of installing Composer via the CI tool cache / the developer's own install. - Update README for the new install/test/customize workflow. composer audit reports no known vulnerabilities in the new dependency set.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This project hadn't moved since the PHP 5.4/PHPUnit 3.7 era. This PR brings it up to date: modern PHP (8.2+), PSR-4 autoloading, PSR-12 code style, current PHPUnit (11/12), and a GitHub Actions pipeline — using DBDiff as a reference for what a modern PHP project in this org looks like (PSR-4 layout, composer scripts, GitHub Actions matrix).
phpunit/phpunitbumped from the long-EOL3.7.*to^11.0 || ^12.0. Droppedphpunit/dbunitandphpunit/phpunit-selenium— both abandoned packages that the skeleton never actually used, and both irrelevant to a plain unit-testing starter kit.lib/Application/Example.phpandtests/Application/ExampleTest.phpflattened tolib/Example.phpandtests/ExampleTest.phpso the namespace root maps 1:1 onto the source directory (same convention DBDiff uses for itssrc/tree), instead of duplicating the namespace name as a subdirectory.declare(strict_types=1), scalar/union type hints, PSR-12 formatting. Tests converted to PHPUnit's attribute-based#[DataProvider]andexpectException()— the old@dataProvider/@expectedExceptiondoc-comment annotations and thePHPUnit_Framework_TestCasebase class no longer exist in current PHPUnit.<coverage><include>replaced with the current<source><include>block.composer cs-check/cs-fixscripts..travis.yml(PHP 5.4/5.5/5.6, all long past EOL and unpatched) with.github/workflows/tests.yml, testing PHP 8.2–8.4 and runningcomposer validate, the CS check, and the test suite on every push/PR.Security
composer.pharbinary that was committed directly to the repo — a stale, unpatched executable checked into version control is itself a supply-chain risk; CI now installs Composer via thesetup-phpaction's tool cache instead.phpunit/dbunitandphpunit/phpunit-selenium, both abandoned/unmaintained dev dependencies that unnecessarily widened the install's attack surface.composer.jsononmaster— consistent with known CVEs in the ancient PHPUnit 3.7.x line this PR removes. The alert should clear automatically once this merges, since the vulnerable version constraint no longer exists on the branch.composer auditagainst the new dependency set (phpunit/phpunit,friendsofphp/php-cs-fixer) reports no known vulnerability advisories.Test plan
composer validate --strictpasses with no warningscomposer installresolves cleanly, PSR-4 autoload generates with zero "does not comply" warningscomposer test(./vendor/bin/phpunit) — 4 tests, 4 assertions, all greencomposer cs-check(PHP-CS-Fixer dry-run) — 0 files need fixingcomposer audit— no advisories found