Harden CI: Artifactory OIDC, fork-aware workflows, composer.lock

.github/actions/artifactory-oidc/action.yml

@@ -0,0 +1,56 @@
+name: "Artifactory OIDC - PHP/Composer"
+description: "Exchange GitHub OIDC token for Artifactory access and configure Composer to resolve through Artifactory"
+
+inputs:
+  artifactory_url:
+    description: "Artifactory base URL (e.g. https://segment.jfrog.io)"
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Exchange OIDC token for Artifactory access token
+      id: oidc
+      shell: bash
+      env:
+        ARTIFACTORY_URL: ${{ inputs.artifactory_url }}
+      run: |
+        # Request OIDC token from GitHub
+        OIDC_TOKEN=$(curl -sS -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+          "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=jfrog-github" | jq -r '.value')
+
+        if [ -z "$OIDC_TOKEN" ] || [ "$OIDC_TOKEN" = "null" ]; then
+          echo "::error::Failed to obtain OIDC token"
+          exit 1
+        fi
+
+        # Exchange OIDC token for Artifactory access token
+        ART_TOKEN=$(curl -sS -X POST \
+          "$ARTIFACTORY_URL/access/api/v1/oidc/token" \
+          -H "Content-Type: application/json" \
+          -d "{\"grant_type\": \"urn:ietf:params:oauth:grant-type:token-exchange\", \"subject_token\": \"$OIDC_TOKEN\", \"subject_token_type\": \"urn:ietf:params:oauth:token-type:id_token\", \"provider_name\": \"github\"}" \
+          | jq -r '.access_token')
+
+        if [ -z "$ART_TOKEN" ] || [ "$ART_TOKEN" = "null" ]; then
+          echo "::error::Failed to exchange OIDC token for Artifactory access token"
+          exit 1
+        fi
+
+        echo "::add-mask::$ART_TOKEN"
+        echo "art_token=$ART_TOKEN" >> "$GITHUB_OUTPUT"
+
+    - name: Configure Composer to use Artifactory
+      shell: bash
+      env:
+        ART_TOKEN: ${{ steps.oidc.outputs.art_token }}
+        ARTIFACTORY_URL: ${{ inputs.artifactory_url }}
+      run: |
+        HOST=$(echo "$ARTIFACTORY_URL" | sed 's|https://||')
+
+        # Configure Composer to use the Artifactory Packagist mirror
+        composer config --global repositories.packagist composer "https://:${ART_TOKEN}@${HOST}/artifactory/api/composer/virtual-php-thirdparty"
+
+        # Disable the default packagist.org to force all resolution through Artifactory
+        composer config --global repositories.packagist.org false
+
+        echo "Composer configured to resolve packages through Artifactory"

.github/workflows/ci.yml

@@ -0,0 +1,158 @@
+name: CI
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
+
+env:
+  ARTIFACTORY_URL: ${{ vars.ARTIFACTORY_URL }}
+
+jobs:
+  coding-standard:
+    name: Coding Standards
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'ubuntu-x64' }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@cf4cade2721270509d5b1c766dad417c269cbb11 # v2
+        with:
+          php-version: "8.2"
+          coverage: none
+          tools: cs2pr
+
+      - name: Configure Artifactory
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        uses: ./.github/actions/artifactory-oidc
+        with:
+          artifactory_url: ${{ vars.ARTIFACTORY_URL }}
+
+      - name: Install Composer dependencies
+        run: composer install --no-scripts --no-interaction --prefer-dist
+
+      - name: Check coding standards
+        continue-on-error: true
+        run: ./vendor/bin/phpcs -s --report-full --report-checkstyle=./phpcs-report.xml
+
+      - name: Show PHPCS results in PR
+        run: cs2pr ./phpcs-report.xml
+
+  lint:
+    name: "Lint: PHP ${{ matrix.php }}"
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'ubuntu-x64' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ["8.1", "8.2", "8.3", "8.4"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@cf4cade2721270509d5b1c766dad417c269cbb11 # v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+          tools: cs2pr
+
+      - name: Configure Artifactory
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        uses: ./.github/actions/artifactory-oidc
+        with:
+          artifactory_url: ${{ vars.ARTIFACTORY_URL }}
+
+      - name: Install Composer dependencies
+        run: composer install --no-scripts --no-interaction --prefer-dist
+
+      - name: Lint against parse errors
+        run: composer lint
+
+  test:
+    name: "Test: PHP ${{ matrix.php }}"
+    needs: [coding-standard, lint]
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'ubuntu-x64' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ["8.1", "8.2", "8.3", "8.4"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@cf4cade2721270509d5b1c766dad417c269cbb11 # v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: xdebug
+          ini-values: error_reporting=E_ALL, display_errors=On
+          extensions: curl, json, mbstring
+
+      - name: Configure Artifactory
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        uses: ./.github/actions/artifactory-oidc
+        with:
+          artifactory_url: ${{ vars.ARTIFACTORY_URL }}
+
+      - name: Install Composer dependencies
+        run: composer install --no-scripts --no-interaction --prefer-dist
+
+      - name: Run tests
+        run: ./vendor/bin/phpunit --no-coverage
+
+      - name: Run tests with coverage
+        if: ${{ matrix.php == '8.2' }}
+        run: ./vendor/bin/phpunit
+
+      - name: Upload coverage to Codecov
+        if: ${{ success() && matrix.php == '8.2' }}
+        uses: codecov/codecov-action@v5
+        with:
+          files: ./build/logs/clover.xml
+          fail_ci_if_error: true
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+  build-verification:
+    name: Build Verification
+    needs: [test]
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'ubuntu-x64' }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@cf4cade2721270509d5b1c766dad417c269cbb11 # v2
+        with:
+          php-version: "8.2"
+          coverage: none
+
+      - name: Configure Artifactory
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        uses: ./.github/actions/artifactory-oidc
+        with:
+          artifactory_url: ${{ vars.ARTIFACTORY_URL }}
+
+      - name: Install Composer dependencies (production)
+        run: composer install --no-scripts --no-interaction --prefer-dist --no-dev --optimize-autoloader
+
+      - name: Verify autoload
+        run: php -r "require 'vendor/autoload.php'; echo 'Autoload OK' . PHP_EOL;"
+
+      - name: Verify package structure
+        run: |
+          # Ensure required files exist for Packagist
+          test -f composer.json
+          test -f LICENSE.md
+          test -d lib
+          echo "Package structure verified"

.github/workflows/e2e-tests.yml

@@ -2,45 +2,61 @@ name: E2E Tests
 
 on:
   push:
-    branches: [master]
+    branches: [master, main]
   pull_request:
-    branches: [master]
+    branches: [master, main]
   workflow_dispatch:
     inputs:
       e2e_tests_ref:
-        description: 'Branch or ref of sdk-e2e-tests to use'
+        description: "Branch or ref of sdk-e2e-tests to use"
         required: false
-        default: 'main'
+        default: "main"
+
+permissions:
+  id-token: write
+  contents: read
+
+env:
+  ARTIFACTORY_URL: ${{ vars.ARTIFACTORY_URL }}
 
 jobs:
   e2e-tests:
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
-    runs-on: ubuntu-latest
+    # Skip for forks — E2E tests require internal infrastructure
+    if: ${{ !github.event.pull_request.head.repo.fork }}
+    runs-on: ubuntu-x64
 
     steps:
       - name: Checkout SDK
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           path: sdk
 
       - name: Checkout sdk-e2e-tests
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           repository: segmentio/sdk-e2e-tests
           ref: ${{ inputs.e2e_tests_ref || 'main' }}
-          token: ${{ secrets.E2E_TESTS_TOKEN }}
           path: sdk-e2e-tests
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@cf4cade2721270509d5b1c766dad417c269cbb11 # v2
         with:
-          php-version: '8.2'
+          php-version: "8.2"
           extensions: curl, json
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: "20"
+
+      - name: Configure Artifactory
+        uses: ./sdk/.github/actions/artifactory-oidc
+        with:
+          artifactory_url: ${{ vars.ARTIFACTORY_URL }}
+
+      - name: Install SDK dependencies
+        working-directory: sdk
+        run: composer install --no-scripts --no-interaction --prefer-dist
 
       - name: Run E2E tests
         working-directory: sdk-e2e-tests

.gitignore

@@ -1,4 +1,3 @@
-composer.lock
 vendor
 composer.phar
 test/analytics.log