code-quality.yml

name: Code Quality

on:
  push:
    branches: [main, master, 'feature/**', 'feat/**', 'fix/**', 'release/**']
    tags:
      - 'v[0-9]*.*'
  pull_request:
    branches: [main, master]

# Cancel in-progress runs for the same branch
permissions:
  contents: read
  security-events: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ==========================================================================
  # PHP Static Analysis (PHPStan + PHPCS)
  # ==========================================================================
  php-analysis:
    name: PHP Static Analysis
    runs-on: ubuntu-24.04
    timeout-minutes: 15

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup PHP
        uses: shivammathur/setup-php@728c6c6b8cf02c2e48117716a91ee48313958a19 # v2
        with:
          php-version: '8.3'
          tools: composer:v2
          coverage: none

      - name: Get Composer cache directory
        id: composer-cache
        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT

      - name: Cache Composer dependencies
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
        with:
          path: ${{ steps.composer-cache.outputs.dir }}
          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock', '**/composer.json') }}
          restore-keys: |
            ${{ runner.os }}-composer-

      - name: Install Composer dependencies
        run: composer install --prefer-dist --no-progress

      - name: Run PHPStan
        run: vendor/bin/phpstan analyse --error-format=github

      - name: Run PHPCS
        run: vendor/bin/phpcs --report=checkstyle src/ | cs2pr || vendor/bin/phpcs src/

  # ==========================================================================
  # Stub Sync Check (php-firebird-stubs / doctrine-firebird-driver protection)
  # ==========================================================================
  stubs-sync:
    name: Stubs Sync Check
    runs-on: ubuntu-24.04
    timeout-minutes: 15

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Check stubs are in sync with firebird.c PHP_FE registrations
        run: |
          chmod +x scripts/check-stubs-sync.sh
          bash scripts/check-stubs-sync.sh

      - name: Check --CLEAN-- sections for DDL tests
        run: |
          chmod +x scripts/check-clean-sections.sh
          bash scripts/check-clean-sections.sh

  # ==========================================================================
  # C/C++ Static Analysis (clang-tidy + cppcheck)
  # ==========================================================================
  c-analysis:
    name: C/C++ Static Analysis
    runs-on: ubuntu-24.04
    timeout-minutes: 15

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install analysis tools
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            clang-tidy \
            cppcheck \
            bear \
            php-dev \
            libfbclient2 \
            firebird-dev || true

      - name: Generate compile_commands.json
        run: |
          # Create a minimal compile_commands.json for static analysis
          # This allows analysis without full Firebird installation
          cat > compile_commands.json << 'EOF'
          [
            {
              "directory": "${{ github.workspace }}",
              "command": "gcc -I/usr/include/php/20230831 -I/usr/include/firebird -DHAVE_CONFIG_H -c firebird.c -o firebird.o",
              "file": "firebird.c"
            },
            {
              "directory": "${{ github.workspace }}",
              "command": "gcc -I/usr/include/php/20230831 -I/usr/include/firebird -DHAVE_CONFIG_H -c fbird_blobs.c -o fbird_blobs.o",
              "file": "fbird_blobs.c"
            },
            {
              "directory": "${{ github.workspace }}",
              "command": "gcc -I/usr/include/php/20230831 -I/usr/include/firebird -DHAVE_CONFIG_H -c fbird_events.c -o fbird_events.o",
              "file": "fbird_events.c"
            },
            {
              "directory": "${{ github.workspace }}",
              "command": "gcc -I/usr/include/php/20230831 -I/usr/include/firebird -DHAVE_CONFIG_H -c fbird_inspection.c -o fbird_inspection.o",
              "file": "fbird_inspection.c"
            },
            {
              "directory": "${{ github.workspace }}",
              "command": "gcc -I/usr/include/php/20230831 -I/usr/include/firebird -DHAVE_CONFIG_H -c fbird_metadata.c -o fbird_metadata.o",
              "file": "fbird_metadata.c"
            },
            {
              "directory": "${{ github.workspace }}",
              "command": "gcc -I/usr/include/php/20230831 -I/usr/include/firebird -DHAVE_CONFIG_H -c fbird_query_exec.c -o fbird_query_exec.o",
              "file": "fbird_query_exec.c"
            },
            {
              "directory": "${{ github.workspace }}",
              "command": "gcc -I/usr/include/php/20230831 -I/usr/include/firebird -DHAVE_CONFIG_H -c fbird_result.c -o fbird_result.o",
              "file": "fbird_result.c"
            },
            {
              "directory": "${{ github.workspace }}",
              "command": "gcc -I/usr/include/php/20230831 -I/usr/include/firebird -DHAVE_CONFIG_H -c fbird_service.c -o fbird_service.o",
              "file": "fbird_service.c"
            },
            {
              "directory": "${{ github.workspace }}",
              "command": "g++ -I/usr/include/php/20230831 -I/usr/include/firebird -DHAVE_CONFIG_H -std=c++17 -c firebird_utils.cpp -o firebird_utils.o",
              "file": "firebird_utils.cpp"
            }
          ]
          EOF

      - name: Run cppcheck
        run: |
          # Define FB_API_VER to satisfy Firebird version check during static analysis
          # The extension requires FB 3.0+ (FB_API_VER >= 30), we simulate FB 4.0 headers
          CPPCHECK_DEFINES="-DFB_API_VER=40 -DHAVE_CONFIG_H -DZEND_ENABLE_STATIC_TSRMLS_CACHE=1"

          cppcheck \
            $CPPCHECK_DEFINES \
            --enable=warning,style,performance,portability \
            --suppress=missingIncludeSystem \
            --suppress=missingInclude \
            --suppress=unknownMacro \
            --error-exitcode=0 \
            --inline-suppr \
            --xml \
            --xml-version=2 \
            *.c *.cpp 2>&1 | tee cppcheck-report.xml

          # Check for errors (exit code 0 = no errors)
          cppcheck \
            $CPPCHECK_DEFINES \
            --enable=warning,performance,portability \
            --suppress=missingIncludeSystem \
            --suppress=missingInclude \
            --suppress=unknownMacro \
            --error-exitcode=1 \
            --inline-suppr \
            *.c *.cpp

      - name: Run clang-tidy (informational, non-blocking per-file due to PHP header noise)
        run: |
          # clang-tidy output is informational; PHP headers generate unavoidable
          # warnings. Per-file `|| true` prevents blocking on those. Review logs manually.
          for file in *.c *.cpp; do
            if [ -f "$file" ]; then
              echo "Analyzing $file..."
              clang-tidy "$file" \
                --checks='-*,bugprone-*,cert-*,clang-analyzer-*,-clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling,performance-*' \
                --header-filter='.*\.h$' \
                -- -I/usr/include/php/20230831 -I/usr/include/firebird 2>/dev/null || true
            fi
          done

  # ==========================================================================
  # Version Stamp Check (stubs @version must match VERSION.txt)
  # ==========================================================================
  version-stamps:
    name: Version Stamps Check
    runs-on: ubuntu-24.04
    timeout-minutes: 15

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Check stubs @version tags match VERSION.txt
        run: |
          chmod +x scripts/check-version-stamps.sh
          bash scripts/check-version-stamps.sh

  # ==========================================================================
  # Secret Detection (Gitleaks CLI - no license required)
  # ==========================================================================
  secrets-scan:
    name: Secret Detection
    runs-on: ubuntu-24.04
    timeout-minutes: 15

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0

      - name: Install Gitleaks
        run: |
          # Download latest gitleaks release using jq for reliable JSON parsing
          GITLEAKS_VERSION=$(curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest | jq -r '.tag_name')
          if [ -z "$GITLEAKS_VERSION" ] || [ "$GITLEAKS_VERSION" = "null" ]; then
            echo "Failed to get gitleaks version, using fallback v8.21.2"
            GITLEAKS_VERSION="v8.21.2"
          fi
          echo "Installing gitleaks ${GITLEAKS_VERSION}"
          curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION#v}_linux_x64.tar.gz" -o gitleaks.tar.gz
          tar xzf gitleaks.tar.gz
          chmod +x gitleaks
          sudo mv gitleaks /usr/local/bin/
          rm -f gitleaks.tar.gz

      - name: Run Gitleaks
        run: |
          gitleaks detect \
            --config=.gitleaks.toml \
            --source=. \
            --verbose \
            --redact

  # ==========================================================================
  # Quality Summary
  # ==========================================================================
  quality-summary:
    name: Quality Gate
    runs-on: ubuntu-24.04
    needs: [php-analysis, stubs-sync, c-analysis, version-stamps, secrets-scan]
    if: always()
    timeout-minutes: 15

    steps:
      - name: Check job results
        run: |
          echo "PHP Analysis: ${{ needs.php-analysis.result }}"
          echo "Stubs Sync: ${{ needs.stubs-sync.result }}"
          echo "C/C++ Analysis: ${{ needs.c-analysis.result }}"
          echo "Version Stamps: ${{ needs.version-stamps.result }}"
          echo "Secrets Scan: ${{ needs.secrets-scan.result }}"

          if [ "${{ needs.php-analysis.result }}" = "failure" ] || \
             [ "${{ needs.stubs-sync.result }}" = "failure" ] || \
             [ "${{ needs.c-analysis.result }}" = "failure" ] || \
             [ "${{ needs.version-stamps.result }}" = "failure" ] || \
             [ "${{ needs.secrets-scan.result }}" = "failure" ]; then
            echo "❌ Quality gate failed"
            exit 1
          fi

          echo "✅ All quality checks passed"