Repository navigation
Pin Psalm for the scan, and don't release from pull requests - #226
Merged
Merged
Conversation
- php-sast.yml: run Psalm 6 from Composer on PHP 8.4 instead of the psalm-github-actions Docker image, which always uses the latest Psalm. Its 7.0.0-rc1 crashes with humanmade/psalm-plugin-wordpress, so the scan failed on every run. The workflow now also runs when it changes. - Plugin release workflows: on pull requests, the build job still builds the plugin, but stops before the version bump, commit, push and release, which always failed there. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Psalm findings currently prevent the generated SARIF report from being uploaded.
1 open finding
What changed in this PR
Pins Psalm 6 on PHP 8.4 and prevents plugin releases from pull-request workflows.
Changes:
- Installs and runs Psalm through Composer.
- Builds or validates plugins on pull requests without versioning or release creation.
- Preserves releases for master pushes and manual runs.
| File | Description |
|---|---|
.github/workflows/php-sast.yml |
Pins PHP and Psalm scan dependencies. |
.github/workflows/bcc-post-update-translations-notifier-plugin-release.yml |
Skips PR releases. |
.github/workflows/bcc-login-plugin-release.yml |
Skips PR releases. |
.github/workflows/bcc-keep-translated-posts-status-same-as-original-plugin-release.yml |
Skips PR releases. |
.github/workflows/bcc-image-ocr-with-openai-plugin-release.yml |
Skips PR releases. |
.github/workflows/bcc-generate-summary-with-ai-plugin-release.yml |
Skips PR releases. |
.github/workflows/bcc-attachments-rss-feed-plugin-release.yml |
Skips PR releases. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…ings - Release workflows: when one push to master releases several plugins, their runs race to push their version bumps and only the first got through. A run now rebases onto the bumps pushed in the meantime and retries, and fails clearly, before zipping and releasing, if it still can't push. - Release workflows: set the release tag through $GITHUB_OUTPUT instead of the deprecated ::set-output command. - Scan: also upload the SARIF report when Psalm found issues, so they show up in code scanning. The check still fails. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Scan (
php-sast.yml). The scan has failed on every run since 9 October. Thepsalm/psalm-github-actionsaction runs its Docker image without a tag, so it always uses the latest Psalm. That is now 7.0.0-rc1, which crashes inhumanmade/psalm-plugin-wordpress(aTypeErroratPlugin.php:1064) before analyzing anything.^6.0, and runs with the same options as the action:--output-format=github --taint-analysis --report=results.sarif.shivammathur/setup-php, itself pinned to the 2.40.0 commit. The PHP version decides which Psalm 6.x Composer picks: on the runner's PHP 8.3.6 it's 6.5.0, which refuses to start below PHP 8.3.16. On PHP 8.4 it's 6.20.0.Plugin release workflows. On pull requests, the
buildjob tried to bump the version, then commit and push a release, which always failed (exit 128). It now builds the plugin and stops before the version bump, so pull requests still check that the plugin builds. The Create Release step is skipped on pull requests. Pushes tomasterand manual runs release as before.Merging
Each release workflow also runs when its own file changes on
master. A normal merge would start all six from the same commit: one would release a plugin with no code changes, and the others would fail ongit push. Please merge with[skip ci]in the merge commit message.Testing
masterand writes a valid SARIF report.echo $_GET[...]fails the scan withTaintedHtml.bash -eo pipefailon GNU/Linux, withyarn,gitandzipstubbed. As a pull request, the job builds and stops with no git calls. A push or a manual run releases as before.tags-ignoreandset-outputwarnings are unchanged.🤖 Generated with Claude Code