composer-update.yml

name: Composer Dependency Update

on:
  workflow_dispatch:
    inputs:
      update_type:
        description: 'Type of update to perform'
        required: true
        type: 'choice'
        options:
          - 'security-patch'
          - 'patch-minor'
          - 'all-dependencies'
          - 'repair'
        default: 'security-patch'
  schedule:
    # Run weekly on Monday at 9:00 AM UTC
    - cron: '0 9 * * 1'

permissions:
  contents: write
  pull-requests: write

# Note: This workflow requires a Personal Access Token (PAT) to create pull requests.
# The default GITHUB_TOKEN has restricted permissions and cannot create PRs that trigger other workflows.
#
# To configure the required secret:
# 1. Create a Personal Access Token (classic) with 'repo' and 'workflow' scopes
#    at https://github.com/settings/tokens
# 2. Add the token as a repository secret named 'PAT_TOKEN'
#    at https://github.com/OWNER/REPO/settings/secrets/actions
#
# See: https://github.com/peter-evans/create-pull-request#action-inputs

jobs:
  update-composer-dependencies:
    runs-on: ubuntu-latest

    services:
      mysql:
        image: mariadb:11
        env:
          MARIADB_ROOT_PASSWORD: root
          MARIADB_ROOT_HOST: '%'
          MARIADB_DATABASE: testing
        ports:
          - 3306:3306
        options: >-
          --health-cmd="healthcheck.sh --connect --innodb_initialized"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5

    env:
      DB_CONNECTION: mysql
      DB_HOST: 127.0.0.1
      DB_PORT: 3306
      DB_DATABASE: testing
      DB_USERNAME: root
      DB_PASSWORD: root

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.4'
          extensions: mbstring, xml, ctype, json, fileinfo, pdo, pdo_mysql, bcmath
          coverage: none

      - name: Repair Composer install
        if: github.event_name == 'workflow_dispatch' && inputs.update_type == 'repair'
        run: |
          rm -f composer.lock
          rm -rf vendor
          composer install --prefer-dist --no-interaction

      - name: Update Composer dependencies (Security & Patch)
        if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.update_type == 'security-patch')
        run: |
          # Updates all dependencies while respecting version constraints in composer.json.
          # For true security-only updates, manually update specific vulnerable packages.
          composer update --with-dependencies --prefer-stable --no-interaction

      - name: Update Composer dependencies (Patch & Minor)
        if: github.event_name == 'workflow_dispatch' && inputs.update_type == 'patch-minor'
        run: |
          composer update --prefer-stable --no-interaction

      - name: Update Composer dependencies (All)
        if: github.event_name == 'workflow_dispatch' && inputs.update_type == 'all-dependencies'
        run: |
          composer bump && composer update

      - name: Run Composer audit
        id: audit
        run: |
          composer audit --format=json > audit-report.json || true
          if [ -s audit-report.json ]; then
            echo "vulnerabilities_found=true" >> $GITHUB_OUTPUT
          else
            echo "vulnerabilities_found=false" >> $GITHUB_OUTPUT
          fi

      - name: Check for changes
        id: check-changes
        run: |
          if git diff --quiet composer.lock; then
            echo "changes_detected=false" >> $GITHUB_OUTPUT
          else
            echo "changes_detected=true" >> $GITHUB_OUTPUT
          fi

      - name: Run smoke tests
        if: steps.check-changes.outputs.changes_detected == 'true'
        run: |
          cp .env.testing.example .env.testing
          php artisan key:generate --env=testing
          php artisan test --configuration=phpunit.smoke.xml --env=testing
        continue-on-error: true

      - name: Get updated packages
        if: steps.check-changes.outputs.changes_detected == 'true'
        id: updated-packages
        run: |
          EMPTY_LOCK='{"packages":[],"packages-dev":[]}'
          git show HEAD:composer.lock > /tmp/composer.lock.old 2>/dev/null || echo "$EMPTY_LOCK" > /tmp/composer.lock.old

          php -r '
          $old = json_decode(file_get_contents("/tmp/composer.lock.old"), true);
          $new = json_decode(file_get_contents("composer.lock"), true);

          if (file_exists("composer.json")) {
              $composerJson = json_decode(file_get_contents("composer.json"), true);
              if ($composerJson === null) {
                  $composerJson = ["require" => [], "require-dev" => []];
              }
          } else {
              $composerJson = ["require" => [], "require-dev" => []];
          }

          $directDeps = array_keys($composerJson["require"] ?? []);
          $directDevDeps = array_keys($composerJson["require-dev"] ?? []);

          $oldPackages = [];
          foreach (array_merge($old["packages"] ?? [], $old["packages-dev"] ?? []) as $pkg) {
              $oldPackages[$pkg["name"]] = $pkg["version"];
          }

          $newPackages = [];
          foreach (array_merge($new["packages"] ?? [], $new["packages-dev"] ?? []) as $pkg) {
              $newPackages[$pkg["name"]] = $pkg["version"];
          }

          $directChanges = [];
          $transientChanges = [];

          foreach ($newPackages as $name => $newVersion) {
              $isDirect = in_array($name, $directDeps) || in_array($name, $directDevDeps);
              if (!isset($oldPackages[$name])) {
                  $change = "$name: (new) → $newVersion";
              } elseif ($oldPackages[$name] !== $newVersion) {
                  $change = "$name: {$oldPackages[$name]} → $newVersion";
              } else {
                  continue;
              }
              if ($isDirect) { $directChanges[] = $change; } else { $transientChanges[] = $change; }
          }

          foreach ($oldPackages as $name => $version) {
              if (!isset($newPackages[$name])) {
                  $isDirect = in_array($name, $directDeps) || in_array($name, $directDevDeps);
                  $change = "$name: $version → (removed)";
                  if ($isDirect) { $directChanges[] = $change; } else { $transientChanges[] = $change; }
              }
          }

          if (empty($directChanges) && empty($transientChanges)) {
              echo "No package changes detected\n";
          } else {
              if (!empty($directChanges)) {
                  echo "## Direct Dependencies (from composer.json)\n\n";
                  foreach ($directChanges as $change) { echo "$change\n"; }
              }
              if (!empty($transientChanges)) {
                  if (!empty($directChanges)) { echo "\n"; }
                  echo "## Transient Dependencies (indirect)\n\n";
                  foreach ($transientChanges as $change) { echo "$change\n"; }
              }
          }
          ' > updated-packages.txt

          echo "UPDATED_PACKAGES<<EOF" >> $GITHUB_OUTPUT
          cat updated-packages.txt >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Create Pull Request
        if: steps.check-changes.outputs.changes_detected == 'true'
        uses: peter-evans/create-pull-request@v6
        with:
          token: ${{ secrets.PAT_TOKEN }}
          commit-message: "chore(deps): update Composer dependencies (${{ inputs.update_type || 'security-patch' }})"
          branch: automated/composer-update-${{ github.run_number }}
          delete-branch: false
          title: "chore(deps): Update Composer dependencies (${{ inputs.update_type || 'security-patch' }})"
          body: |
            ## Composer Dependency Update

            This PR updates Composer dependencies.

            **Update Type:** ${{ inputs.update_type || 'security-patch' }}
            **Triggered by:** ${{ github.event_name }}

            ### Updated Packages

            ```
            ${{ steps.updated-packages.outputs.UPDATED_PACKAGES }}
            ```

            ### Checks Performed

            - [ ] ~~Unit tests passed~~ (commented out until further notice)
            - [ ] ~~Static analysis completed~~ (commented out until further notice)
            - [ ] ~~Code formatting checked~~ (commented out until further notice)

            ### Security Audit

            ${{ steps.audit.outputs.vulnerabilities_found == 'true' && 'Security vulnerabilities detected. Please review audit-report.json.' || 'No security vulnerabilities detected.' }}

            ### Review Checklist

            - [ ] Review updated packages and their changelogs
            - [ ] Verify all tests pass
            - [ ] Check for breaking changes
            - [ ] Update documentation if needed
            - [ ] Test manually in development environment

            ---

            *This PR was automatically created by the Composer Update workflow.*
          labels: |
            dependencies
            composer
            automated-pr

      - name: No changes detected
        if: steps.check-changes.outputs.changes_detected == 'false'
        run: echo "No Composer dependency updates available."