lyra
2064153cd3
Tests / test (pull_request) Successful in 1m10s
Brings preauth from 18/34 to 30/34 conformance (auth-gateway profile). The
remaining four checks all depend on files this branch cannot change (see below).
PHP toolchain (§1)
- require.php >=8.4 -> ^8.5, and pin config.platform to 8.5.0. The old
constraint also permitted PHP 9, which is not a promise we can keep.
composer.lock regenerated with --lock: content-hash + platform-overrides
only, zero dependency version movement.
- friendsofphp/php-cs-fixer * -> ^3.95. A wildcard meant CI was not
reproducible.
PHPStan (§2.2)
- vendor the shared phpstan.neon.dist (level 6) + a generated baseline.
187 errors are captured rather than fixed; the baseline should only shrink
from here.
- add phpstan/phpstan:^2.1 to require-dev.
Code style (§8.2)
- vendor the shared .php-cs-fixer.dist.php (@Symfony + @Symfony:risky +
declare_strict_types) and apply it: 59 of 67 files reformatted.
- Verified this is a formatting change, not a behaviour change: all 313 tests
pass after the reformat, all in_array() calls already passed strict=true,
and the remaining edits are @Symfony:risky idiom (yoda conditions, \count(),
self:: over the class name).
Repository layout (§4.4)
- docs/{Caddyfile,compose.yaml,example.env} -> docs/examples/, with
example.env becoming the conventional .env.example. This is the layout
GUIDING-LIGHT already cites preauth as doing correctly — it just needed
renaming.
- update the four readme.md references and a stale compose.yaml comment.
- docs/v1.1-plan.md references are left alone deliberately: it is a historical
plan recording what was done at the time, not live documentation.
Licence and security policy (§7)
- add LICENSE (uniform MIT, matching composer.json).
- add SECURITY.md describing the actual threat model: per-request
allow/intercept, no caching of the login flow, app-set security headers,
TOTP, and the fact that REMOTE_USER is trusted input.
Mobile accessibility (§3.3a)
- templates/base.html.twig: drop maximum-scale=1 and add viewport-fit=cover.
preauth was the one app already past the font-size precondition (controls
render at 21.6px = 0.9em x 24px), so removing the lock is safe here and
restores pinch-zoom for Android users.
Conformance tooling (§8.2)
- vendor .ci/conformance.sh and .ci/css-control-size.py so the check runs
from a checkout rather than fetching from the LAN-only private/ci.
- .editorconfig synced from the version that keeps the Caddyfile tab rule.
Not included (blocked by the .gitea/workflows pre-receive hook):
- ci-composer-audit, ci-composer-validate, ci-reusable-workflows.
Workflow files may only change via a trusted ref, so the caller files are
staged but not committed.
Also not included: dockerfile-nonroot (§6.4). Adding USER to an image with
VOLUME [/config, /data] changes volume ownership and needs an actual container
build/run to verify, so it goes in its own change.
74 lines
2.7 KiB
PHP
74 lines
2.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
/**
|
|
* .php-cs-fixer.dist.php — canonical shared config.
|
|
*
|
|
* Copy verbatim into a project root. LEAF file: sync = overwrite, never merge.
|
|
* Change it here and re-sync; do not hand-edit per repo (GUIDING-LIGHT §8.2).
|
|
*
|
|
* This replaces three divergent versions found in the 2026-09 audit:
|
|
* context-loom — had @Symfony + risky + declare_strict_types
|
|
* penny-track / preauth / vital-pulse — a second variant
|
|
* task-weaver — a third variant
|
|
*
|
|
* Pin friendsofphp/php-cs-fixer to ^3.95 in composer.json. preauth was on
|
|
* "*", which means its CI was not reproducible.
|
|
*/
|
|
|
|
$config = new PhpCsFixer\Config();
|
|
|
|
return $config
|
|
->setRiskyAllowed(true)
|
|
->setRules([
|
|
'@Symfony' => true,
|
|
'@Symfony:risky' => true,
|
|
|
|
// Unambiguous wins.
|
|
'declare_strict_types' => true,
|
|
'no_unused_imports' => true,
|
|
'ordered_imports' => [
|
|
'sort_algorithm' => 'alpha',
|
|
'imports_order' => ['class', 'function', 'const'],
|
|
],
|
|
'php_unit_method_casing' => ['case' => 'snake_case'],
|
|
|
|
// Trailing commas in multiline constructs keep diffs to one line when
|
|
// a parameter is appended — reviewable, and no reformat noise.
|
|
'trailing_comma_in_multiline' => [
|
|
'elements' => ['arrays', 'arguments', 'parameters', 'match'],
|
|
],
|
|
|
|
// `array()` → `[]`, consistent with everything else in these repos.
|
|
'array_syntax' => ['syntax' => 'short'],
|
|
|
|
// Group imports so a file's dependency surface is scannable.
|
|
'global_namespace_import' => [
|
|
'import_classes' => true,
|
|
'import_constants' => false,
|
|
'import_functions' => false,
|
|
],
|
|
|
|
// Keep `#[Attribute]`-style attributes on their own line for long ones.
|
|
'attribute_empty_parentheses' => true,
|
|
])
|
|
->setFinder(
|
|
(new PhpCsFixer\Finder())
|
|
->in(__DIR__)
|
|
->exclude('vendor')
|
|
->exclude('var')
|
|
->exclude('node_modules')
|
|
// Migration classes are generated and version-stamped upstream;
|
|
// reformatting them makes diffs against the generator noisy.
|
|
->notPath('src/Migrations')
|
|
// Symfony's config reference is regenerated by `cache:clear`, which
|
|
// composer runs on every install — so it is present in CI even
|
|
// though it is gitignored. Formatting it makes the fixer report a
|
|
// file the author cannot commit, and a fresh `cache:clear`
|
|
// immediately undoes the fix, so CI can never go green.
|
|
->notPath('config/reference.php')
|
|
->ignoreDotFiles(true)
|
|
->ignoreVCS(true)
|
|
);
|