Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 6 additions & 21 deletions .github/workflows/emulator-tests.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
name: Emulator Tests

on:
pull_request_target:
# TEMPORARY: Use pull_request to run emulator tests in this PR. Revert to pull_request_target before merging.
pull_request:
types: [ opened, synchronize, reopened ]
paths:
- 'src/**'
Expand Down Expand Up @@ -32,43 +33,27 @@ jobs:
runs-on: ubuntu-latest

env:
php-version: '8.4'
extensions: grpc
key: cache-v1
php-version: '8.5'

steps:
- name: Checkout code
uses: actions/checkout@v6
with:
ref: ${{ (github.event_name == 'pull_request_target' && github.event.pull_request.head.sha) || github.sha }}

- name: Setup cache environment
id: extcache
uses: shivammathur/cache-extensions@v1
with:
php-version: ${{ env.php-version }}
extensions: ${{ env.extensions }}
key: ${{ env.key }}

- name: Cache extensions
uses: actions/cache@v5.0.2
with:
path: ${{ steps.extcache.outputs.dir }}
key: ${{ steps.extcache.outputs.key }}
restore-keys: ${{ steps.extcache.outputs.key }}

- name: Setup PHP
uses: shivammathur/setup-php@v2
with:
php-version: ${{ env.php-version }}
extensions: ${{ env.extensions }}
tools: composer, pecl
coverage: xdebug

- name: Setup problem matchers for PHP
run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"

- uses: "ramsey/composer-install@v3"
with:
composer-options: "--ignore-platform-req=ext-grpc"

- name: Setup Problem Matchers for PHPUnit
run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"
Expand Down Expand Up @@ -97,7 +82,7 @@ jobs:
FIREBASE_DATABASE_EMULATOR_HOST: localhost:9100
FIREBASE_AUTH_EMULATOR_HOST: localhost:9099
XDEBUG_MODE: coverage
run: firebase emulators:exec --only auth,database --project beste-firebase 'XDEBUG_MODE=coverage vendor/bin/phpunit --group=emulator --coverage-clover=coverage.xml --log-junit=test-report.xml'
run: firebase emulators:exec --only auth,database --project beste-firebase 'XDEBUG_MODE=coverage vendor/bin/phpunit --group=emulator --exclude-group grpc --coverage-clover=coverage.xml --log-junit=test-report.xml'

- name: Upload test results to Codecov
if: ${{ !cancelled() }}
Expand Down
128 changes: 128 additions & 0 deletions .github/workflows/grpc-tests.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,128 @@
name: gRPC Tests

on:
# TEMPORARY: Use pull_request to run gRPC tests in this PR. Revert to pull_request_target before merging.
pull_request:
Comment on lines +4 to +5
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Address the TODO before merging: revert pull_request to pull_request_target.

Line 4 contains a reminder to revert the trigger type. Ensure this is completed before merging to maintain proper security boundaries for fork PRs accessing secrets.

🤖 Prompt for AI Agents
In @.github/workflows/grpc-tests.yml around lines 4 - 5, Update the GitHub
Actions workflow trigger: replace the temporary pull_request trigger key with
pull_request_target (i.e., change "pull_request:" to "pull_request_target:") and
remove the TODO comment so the workflow uses the secure target trigger for fork
PRs; verify any related conditional or permissions blocks still align with the
new trigger.

types: [opened, synchronize, reopened]
paths:
- 'src/**'
- 'tests/**'
- '.github/workflows/grpc-tests.yml'
- 'composer.json'
- 'phpstan.neon.dist'
push:
branches: ['8.x']
paths:
- 'src/**'
- 'tests/**'
- '.github/workflows/grpc-tests.yml'
- 'composer.json'
- 'phpstan.neon.dist'
Comment on lines +7 to +20
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Add composer.lock to the workflow path filters.

Line 7-20: dependency updates via composer.lock alone won’t trigger these gRPC tests, so regressions can slip through. Add it to both pull_request and push path filters.

🔧 Suggested diff
     paths:
       - 'src/**'
       - 'tests/**'
       - '.github/workflows/grpc-tests.yml'
       - 'composer.json'
+      - 'composer.lock'
       - 'phpstan.neon.dist'
...
     paths:
       - 'src/**'
       - 'tests/**'
       - '.github/workflows/grpc-tests.yml'
       - 'composer.json'
+      - 'composer.lock'
       - 'phpstan.neon.dist'
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
paths:
- 'src/**'
- 'tests/**'
- '.github/workflows/grpc-tests.yml'
- 'composer.json'
- 'phpstan.neon.dist'
push:
branches: ['8.x']
paths:
- 'src/**'
- 'tests/**'
- '.github/workflows/grpc-tests.yml'
- 'composer.json'
- 'phpstan.neon.dist'
paths:
- 'src/**'
- 'tests/**'
- '.github/workflows/grpc-tests.yml'
- 'composer.json'
- 'composer.lock'
- 'phpstan.neon.dist'
push:
branches: ['8.x']
paths:
- 'src/**'
- 'tests/**'
- '.github/workflows/grpc-tests.yml'
- 'composer.json'
- 'composer.lock'
- 'phpstan.neon.dist'
🤖 Prompt for AI Agents
In @.github/workflows/grpc-tests.yml around lines 7 - 20, The workflow path
filters under the pull_request and push jobs in .github/workflows/grpc-tests.yml
are missing composer.lock, so updates to dependencies won't trigger the gRPC
tests; update the path arrays used in the pull_request and push sections (the
paths entries shown in the diff) to include 'composer.lock' alongside 'src/**',
'tests/**', '.github/workflows/grpc-tests.yml', 'composer.json', and
'phpstan.neon.dist'.

workflow_dispatch:

permissions:
contents: read

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

jobs:
grpc-tests:
name: gRPC Tests (PHP 8.5)
runs-on: ubuntu-latest
# Non-blocking while the gRPC extension is broken/unstable on PHP 8.5.
# See https://github.com/shivammathur/setup-php/issues/1041.
# Remove this once upstream releases a stable extension and tests pass.
continue-on-error: true
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}

env:
key: cache-grpc
php-version: 8.5
extensions: grpc

steps:
- name: Checkout code
uses: actions/checkout@v6
with:
ref: ${{ (github.event_name == 'pull_request_target' && github.event.pull_request.head.sha) || github.sha }}

- name: Setup cache environment
id: extcache
uses: shivammathur/cache-extensions@v1
with:
php-version: ${{ env.php-version }}
extensions: ${{ env.extensions }}
key: ${{ env.key }}

- name: Cache extensions
uses: actions/cache@v5.0.2
with:
path: ${{ steps.extcache.outputs.dir }}
key: ${{ steps.extcache.outputs.key }}
restore-keys: ${{ steps.extcache.outputs.key }}

- name: Setup PHP
uses: shivammathur/setup-php@v2
with:
php-version: ${{ env.php-version }}
extensions: ${{ env.extensions }}
ini-values: grpc.grpc_verbosity=error, grpc.grpc_trace=
tools: composer, pecl
coverage: xdebug

- name: Setup problem matchers for PHP
run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"

- name: Verify gRPC extension
id: grpc
run: php -m | grep -i '^grpc$'

- uses: "ramsey/composer-install@v3"
id: composer
if: ${{ steps.grpc.outcome == 'success' }}

- name: Setup Problem Matchers for PHPUnit
run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"

- name: Run gRPC Tests
id: grpc-tests
if: ${{ steps.grpc.outcome == 'success' }}
env:
GOOGLE_APPLICATION_CREDENTIALS: ${{secrets.GOOGLE_APPLICATION_CREDENTIALS}}
TEST_FIREBASE_APP_ID: ${{secrets.TEST_FIREBASE_APP_ID}}
TEST_FIREBASE_RTDB_URI: ${{secrets.TEST_FIREBASE_RTDB_URI}}
TEST_FIREBASE_TENANT_ID: ${{secrets.TEST_FIREBASE_TENANT_ID}}
TEST_REGISTRATION_TOKENS: ${{secrets.TEST_REGISTRATION_TOKENS}}
XDEBUG_MODE: coverage
run: vendor/bin/phpunit --testsuite=integration --group grpc --coverage-clover=coverage.xml --log-junit=test-report.xml --testdox

- name: Summarize gRPC failures
if: ${{ always() && (steps.grpc.outcome == 'failure' || steps.grpc-tests.outcome == 'failure') }}
run: |
echo "::notice::gRPC tests are non-blocking due to missing/broken gRPC on PHP 8.5."
{
echo "### gRPC tests are non-blocking"
echo
echo "gRPC extension was not available or gRPC tests failed (likely due to missing/broken gRPC on PHP 8.5)."
echo "See https://github.com/shivammathur/setup-php/issues/1041."
} >> "$GITHUB_STEP_SUMMARY"

- name: Upload test results to Codecov
if: ${{ !cancelled() && steps.grpc.outcome == 'success' }}
uses: codecov/codecov-action@v5
with:
token: ${{ secrets.CODECOV_TOKEN }}
flags: grpc
report_type: test_results
fail_ci_if_error: false

- name: Upload coverage to Codecov
if: ${{ !cancelled() && steps.grpc.outcome == 'success' }}
uses: codecov/codecov-action@v5
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: ./coverage.xml
flags: grpc
fail_ci_if_error: false
27 changes: 6 additions & 21 deletions .github/workflows/integration-tests.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
name: Integration Tests

on:
pull_request_target:
# TEMPORARY: Use pull_request to run integration tests in this PR. Revert to pull_request_target before merging.
pull_request:
types: [opened, synchronize, reopened]
Comment on lines +4 to 6
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Guard integration tests on forked PRs to avoid secret-less failures.

pull_request runs do not receive secrets from forks, but this job requires several secrets (Line 63–67). That will hard-fail external PRs. Consider gating the job to same-repo PRs (or skip when secrets are absent).

✅ Suggested guard to skip forked PRs
 jobs:
   integration-tests:
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
     name: Integration Tests
🤖 Prompt for AI Agents
In @.github/workflows/integration-tests.yml around lines 4 - 6, The workflow
currently triggers on pull_request which doesn't provide secrets for forked PRs;
update the integration-tests job to guard against forked PRs by either switching
the trigger back to pull_request_target or adding a runtime condition that
ensures the PR comes from the same repository (use the context expression
github.event.pull_request.head.repo.full_name == github.repository) before
running steps that read secrets, or alternatively add a guard that checks for
required secrets presence and skips the job when they're absent; change the
job-level "if" expression (or the top-level trigger) accordingly so jobs
referencing secrets (the integration tests) are never executed on secret-less
forked PRs.

paths:
- 'src/**'
Expand Down Expand Up @@ -32,43 +33,27 @@ jobs:
runs-on: ubuntu-latest

env:
php-version: '8.4'
extensions: grpc
key: cache-v1
php-version: '8.5'

steps:
- name: Checkout code
uses: actions/checkout@v6
with:
ref: ${{ (github.event_name == 'pull_request_target' && github.event.pull_request.head.sha) || github.sha }}

- name: Setup cache environment
id: extcache
uses: shivammathur/cache-extensions@v1
with:
php-version: ${{ env.php-version }}
extensions: ${{ env.extensions }}
key: ${{ env.key }}

- name: Cache extensions
uses: actions/cache@v5.0.2
with:
path: ${{ steps.extcache.outputs.dir }}
key: ${{ steps.extcache.outputs.key }}
restore-keys: ${{ steps.extcache.outputs.key }}

- name: Setup PHP
uses: shivammathur/setup-php@v2
with:
php-version: ${{ env.php-version }}
extensions: ${{ env.extensions }}
tools: composer, pecl
coverage: xdebug

- name: Setup problem matchers for PHP
run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"

- uses: "ramsey/composer-install@v3"
with:
composer-options: "--ignore-platform-req=ext-grpc"

- name: Setup Problem Matchers for PHPUnit
run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"
Expand All @@ -81,7 +66,7 @@ jobs:
TEST_FIREBASE_TENANT_ID: ${{secrets.TEST_FIREBASE_TENANT_ID}}
TEST_REGISTRATION_TOKENS: ${{secrets.TEST_REGISTRATION_TOKENS}}
XDEBUG_MODE: coverage
run: vendor/bin/phpunit --testsuite=integration --coverage-clover=coverage.xml --log-junit=test-report.xml --testdox
run: vendor/bin/phpunit --testsuite=integration --exclude-group grpc --coverage-clover=coverage.xml --log-junit=test-report.xml --testdox

- name: Upload test results to Codecov
if: ${{ !cancelled() }}
Expand Down
22 changes: 1 addition & 21 deletions .github/workflows/static-analysis.yml
Original file line number Diff line number Diff line change
Expand Up @@ -38,40 +38,20 @@ jobs:
- "8.4"
- "8.5"

env:
extensions: grpc
key: cache-v1

steps:
- name: Checkout code
uses: actions/checkout@v6

- name: Setup cache environment
id: extcache
uses: shivammathur/cache-extensions@v1
with:
php-version: ${{ matrix.php }}
extensions: ${{ env.extensions }}
key: ${{ env.key }}

- name: Cache extensions
uses: actions/cache@v5.0.2
with:
path: ${{ steps.extcache.outputs.dir }}
key: ${{ steps.extcache.outputs.key }}
restore-keys: ${{ steps.extcache.outputs.key }}

- name: Setup PHP
uses: shivammathur/setup-php@v2
with:
php-version: ${{ matrix.php }}
extensions: ${{ env.extensions }}
tools: composer, pecl
coverage: none

- uses: "ramsey/composer-install@v3"
with:
composer-options: "${{ matrix.composer-options }}"
composer-options: "--ignore-platform-req=ext-grpc"

- name: Setup problem matchers for PHP
run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"
Expand Down
22 changes: 1 addition & 21 deletions .github/workflows/tests.yml
Original file line number Diff line number Diff line change
Expand Up @@ -41,40 +41,20 @@ jobs:
- "lowest"
- "highest"

env:
extensions: grpc
key: cache-v1

steps:
- name: Checkout code
uses: actions/checkout@v6

- name: Setup cache environment
id: extcache
uses: shivammathur/cache-extensions@v1
with:
php-version: ${{ matrix.php }}
extensions: ${{ env.extensions }}
key: ${{ env.key }}

- name: Cache extensions
uses: actions/cache@v5.0.2
with:
path: ${{ steps.extcache.outputs.dir }}
key: ${{ steps.extcache.outputs.key }}
restore-keys: ${{ steps.extcache.outputs.key }}

- name: Setup PHP
uses: shivammathur/setup-php@v2
with:
php-version: ${{ matrix.php }}
extensions: ${{ env.extensions }}
tools: composer, pecl
coverage: xdebug

- uses: "ramsey/composer-install@v3"
with:
composer-options: "${{ matrix.composer-options }}"
composer-options: "--ignore-platform-req=ext-grpc"
dependency-versions: "${{ matrix.dependencies }}"

- name: Setup problem matchers for PHP
Expand Down
14 changes: 4 additions & 10 deletions tests/Integration/Factory/FirestoreTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,14 @@
use Exception;
use Kreait\Firebase\Tests\IntegrationTestCase;
use Kreait\Firebase\Util;
use PHPUnit\Framework\Attributes\Group;
use PHPUnit\Framework\Attributes\RequiresPhpExtension;

/**
* @internal
*/
#[Group('grpc')]
#[RequiresPhpExtension('grpc')]
final class FirestoreTest extends IntegrationTestCase
{
/**
Expand All @@ -19,11 +23,6 @@ final class FirestoreTest extends IntegrationTestCase
*/
public function testItUsesTheDefaultDatabaseByDefault(): void
{
// @see https://github.com/grpc/grpc/issues/38184
// @see https://github.com/googleapis/gax-php/issues/584
// @see https://www.php.net/manual/en/info.configuration.php#ini.zend.reserved-stack-size
$this->markTestSkipped('Skipped because of an infinite recursion with certain PHP/gRPC versions.');
// @phpstan-ignore deadCode.unreachable
$collection = __FUNCTION__;
$documentName = __FUNCTION__.self::randomString();

Expand All @@ -42,11 +41,6 @@ public function testItUsesTheDefaultDatabaseByDefault(): void

public function testItCannotConnectToAnUnknownDatabase(): void
{
// @see https://github.com/grpc/grpc/issues/38184
// @see https://github.com/googleapis/gax-php/issues/584
// @see https://www.php.net/manual/en/info.configuration.php#ini.zend.reserved-stack-size
$this->markTestSkipped('Skipped because of an infinite recursion with certain PHP/gRPC versions.');
// @phpstan-ignore deadCode.unreachable
$name = self::randomString();

$database = self::$factory->createFirestore($name)->database();
Expand Down
Loading