Best practices: must-fix deviations #13

New Issue

2026-09-15T09:21:07-04:00

lyra commented

2026-09-15 09:21:07 -04:00

Must Fix

These are actively wrong / risky, not just style.

1. phpunit.dist.xml → rename to phpunit.xml.dist. PHPUnit's documented lookup order is phpunit.xml then phpunit.xml.dist. The current phpunit.dist.xml is not auto-discovered — running vendor/bin/phpunit with no -c flag only works coincidentally here because there's no competing file. Any contributor or tool (IDE, CI, symfony/phpunit-bridge) invoking PHPUnit with the default config search will silently run with no config (no bootstrap, no APP_ENV=test, no test TOTP secret/env vars) and get failures or, worse, a false-pass. The custom bin/phpunit shim doesn't pass -c either.
2. .gitea/ is not in .dockerignore. All four CI workflow files (which contain secret names and the GitHub sync remote logic) are shipped into the Docker build context and can be COPYed/layered into images. Add .gitea/ (and .github/) to .dockerignore.
3. Docker build context is far too broad. .dockerignore only excludes a handful of paths. .git/ is excluded but .phpunit.cache/, .php-cs-fixer.cache, .php-cs-fixer.dist.php, phpunit.*.xml, symfony.lock handling, .editorconfig, Caddyfile(used separately), and bin/composer/bin/dev.sh/bin/franken.sh all still flow in. Should whitelist-only what's needed (the Dockerfile already COPYs an explicit list — make .dockerignore match: *, then un-ignore bin/console, config/, public/, src/, templates/, composer.*, symfony.lock, Caddyfile, .env).

(Related security note: item 3 is what makes item 2 a real exposure rather than cosmetic.)

## Must Fix These are actively wrong / risky, not just style. - [ ] **1. `phpunit.dist.xml` → rename to `phpunit.xml.dist`.** PHPUnit's documented lookup order is `phpunit.xml` then `phpunit.xml.dist`. The current `phpunit.dist.xml` is **not** auto-discovered — running `vendor/bin/phpunit` with no `-c` flag only works coincidentally here because there's no competing file. Any contributor or tool (IDE, CI, `symfony/phpunit-bridge`) invoking PHPUnit with the default config search will silently run with **no config** (no bootstrap, no `APP_ENV=test`, no test TOTP secret/env vars) and get failures or, worse, a false-pass. The custom `bin/phpunit` shim doesn't pass `-c` either. - [ ] **2. `.gitea/` is not in `.dockerignore`.** All four CI workflow files (which contain secret *names* and the GitHub sync remote logic) are shipped into the Docker build context and can be COPYed/layered into images. Add `.gitea/` (and `.github/`) to `.dockerignore`. - [ ] **3. Docker build context is far too broad.** `.dockerignore` only excludes a handful of paths. `.git/` is excluded but `.phpunit.cache/`, `.php-cs-fixer.cache`, `.php-cs-fixer.dist.php`, `phpunit.*.xml`, `symfony.lock` handling, `.editorconfig`, `Caddyfile`(used separately), and `bin/composer`/`bin/dev.sh`/`bin/franken.sh` all still flow in. Should whitelist-only what's needed (the Dockerfile already COPYs an explicit list — make `.dockerignore` match: `*`, then un-ignore `bin/console`, `config/`, `public/`, `src/`, `templates/`, `composer.*`, `symfony.lock`, `Caddyfile`, `.env`). (Related security note: item 3 is what makes item 2 a real exposure rather than cosmetic.)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: public/preauth#13