moved CI to GH actions, took phpstan to lvl 9

Author: garrettw

.devcontainer/devcontainer.json

@@ -1,7 +1,7 @@
 // For format details, see https://aka.ms/devcontainer.json. For config options, see the
 // README at: https://github.com/devcontainers/templates/tree/main/src/php
 {
-	"name": "PHP",
+	"name": "PHP 8.2",
 	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
 	"image": "mcr.microsoft.com/devcontainers/php:1-8.2-bullseye",
 
@@ -10,21 +10,31 @@
 	// Configure properties specific to VS Code.
 		"vscode": {
 			"extensions": [
-				"ikappas.composer"
+				"ikappas.composer",
+                "neilbrayfield.php-docblocker",
+                "mehedidracula.php-namespace-resolver",
+                "github.vscode-github-actions",
+                "-xdebug.php-debug",
+                "nhoizey.gremlins",
+                "oderwat.indent-rainbow",
+                "bmewburn.vscode-intelephense-client",
+                "pflannery.vscode-versionlens",
+                "sonarsource.sonarlint-vscode",
+                "editorconfig.editorconfig",
+                "predrag-nikolic.php-class-helper",
+                "redhat.vscode-yaml"
 			]
 		}
 	},
 
 	// Use 'forwardPorts' to make a list of ports inside the container available locally.
-	"forwardPorts": [
-		8080
-	],
+	// "forwardPorts": [],
 	"features": {
 		"ghcr.io/devcontainers/features/github-cli:1": {}
 	},
 
 	// Use 'postCreateCommand' to run commands after the container is created.
-	"postCreateCommand": "sudo chmod a+x \"$(pwd)\" && sudo rm -rf /var/www/html && sudo ln -s \"$(pwd)\" /var/www/html; if [ -f composer.json ];then composer install;fi"
+	"postCreateCommand": "if [ -f composer.json ];then composer install;fi"
 
 	// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
 	// "remoteUser": "root"

.github/workflows/codacy.yml

@@ -0,0 +1,59 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow checks out code, performs a Codacy security scan
+# and integrates the results with the
+# GitHub Advanced Security code scanning feature.  For more information on
+# the Codacy security scan action usage and parameters, see
+# https://github.com/codacy/codacy-analysis-cli-action.
+# For more information on Codacy Analysis CLI in general, see
+# https://github.com/codacy/codacy-analysis-cli.
+
+name: Codacy Security Scan
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "master" ]
+
+permissions:
+  contents: read
+
+jobs:
+  codacy-security-scan:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    name: Codacy Security Scan
+    runs-on: ubuntu-latest
+    steps:
+      # Checkout the repository to the GitHub Actions runner
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis
+      - name: Run Codacy Analysis CLI
+        uses: codacy/codacy-analysis-cli-action@d840f886c4bd4edc059706d09c6a1586111c540b
+        with:
+          # Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository
+          # You can also omit the token and run the tools that support default configurations
+          project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
+          verbose: true
+          output: results.sarif
+          format: sarif
+          # Adjust severity of non-security issues
+          gh-code-scanning-compat: true
+          # Force 0 exit code to allow SARIF file generation
+          # This will handover control about PR rejection to the GitHub side
+          max-allowed-issues: 2147483647
+
+      # Upload the SARIF file generated in the previous step
+      - name: Upload SARIF results file
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif

.github/workflows/php.yml

@@ -0,0 +1,69 @@
+name: PHP Composer
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Composer, test, PHPMD
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # for checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+
+    steps:
+    - name: 🚚 Get latest code
+      uses: actions/checkout@v4
+
+    - name: Setup PHP
+      uses: shivammathur/setup-php@v2
+      with:
+        coverage: none
+        extensions: mbstring
+        tools: phpmd
+    
+    - name: Setup problem matchers for PHP
+      run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"
+
+    - name: Update Composer
+      run: composer self-update
+
+    - name: Validate composer.json and composer.lock
+      run: composer validate --strict
+
+    - name: Get composer cache directory
+      id: composer-cache
+      run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+    - name: Cache Composer packages
+      uses: actions/cache@v4
+      with:
+        path: ${{ steps.composer-cache.outputs.dir }}
+        key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+        restore-keys: ${{ runner.os }}-composer-
+
+    - name: Install dependencies
+      run: composer install --prefer-dist --no-progress
+
+    # Add a test script to composer.json, for instance: "test": "vendor/bin/phpunit"
+    # Docs: https://getcomposer.org/doc/articles/scripts.md
+
+    - name: Run test suite
+      run: composer run-script test
+
+    - name: Run PHPMD
+      run: phpmd . sarif codesize --reportfile phpmd-results.sarif
+      continue-on-error: true
+
+    - name: Upload analysis results to GitHub
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: phpmd-results.sarif
+        wait-for-processing: true

.github/workflows/psalm.yml

@@ -0,0 +1,36 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+name: Psalm Security Scan
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "master" ]
+
+permissions:
+  contents: read
+
+jobs:
+  php-security:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Psalm Security Scan
+        uses: psalm/psalm-github-security-scan@f3e6fd9432bc3e44aec078572677ce9d2ef9c287
+
+      - name: Upload Security Analysis results to GitHub
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif

.travis.yml

@@ -13,6 +13,5 @@ The goal of this library is to provide an object interface to interact with stri
 
   - Write tests for Utf8String
   - Work on normalization code
-  - Migrate Travis config to GitHub Action
   - Consider using a different testing framework because nobody uses PhpSpec... PHPUnit, Codeception, or Pest
   - Flesh out devcontainer config with extensions

README.md

@@ -26,6 +26,7 @@
 		}
 	},
 	"scripts": {
-		"phpstan": "vendor/bin/phpstan analyse src --level=5"
+		"phpstan": "vendor/bin/phpstan analyse src --level=9",
+		"test": "vendor/bin/phpspec run -v"
 	}
 }

composer.json

@@ -9,17 +9,16 @@ abstract class AbstractString implements StringObject
 {
     // PROPERTIES
 
-    protected $raw;
-    protected $caret = 0;
-    protected $token = false;
+    protected string $raw;
+    protected int $caret = 0;
+    protected bool $token = false;
 
     /**
-     * @param mixed $thing Anything that can be cast to a string
+     * @param string|object $thing Anything that can be cast to a string
      */
     final public function __construct($thing)
     {
-        static::stringableOrFail($thing);
-        $this->raw = (string) $thing;
+        $this->raw = static::stringify($thing);
     }
 
     public function __get(string $name): mixed
@@ -76,12 +75,12 @@ public function valid(): bool
 
     // END Iterator methods }
 
+    /**
+     * @param string|object $str
+     */
     public function equals($str): bool
     {
-        static::stringableOrFail($str);
-
-        $str = (string) $str;
-        return ($str == $this->raw);
+        return (static::stringify($str) == $this->raw);
     }
 
     public function length(): int
@@ -111,12 +110,12 @@ public function isEmpty(): bool
         return empty($this->raw);
     }
 
-    public function append($str): static
+    public function append(string $str): static
     {
         return new static($this->raw . $str);
     }
 
-    public function concat($str): static
+    public function concat(string $str): static
     {
         return $this->append($str);
     }
@@ -139,7 +138,7 @@ public function escape(int $mode = self::NORMAL, string $charlist = ''): static
 
     public function hexDecode(): static
     {
-        return new static(\hex2bin($this->raw));
+        return new static(\hex2bin($this->raw) ?: '');
     }
 
     public function hexEncode(): static
@@ -152,7 +151,7 @@ public function prepend(string $str): static
         return new static($str . $this->raw);
     }
 
-    public function remove(string $str, $mode = self::NORMAL): static
+    public function remove(string $str, int $mode = self::NORMAL): static
     {
         return $this->replace($str, '', $mode);
     }
@@ -175,6 +174,9 @@ public function replace(string $search, string $replace, int $mode = self::NORMA
         return new static(\str_replace($search, $replace, $this->raw));
     }
 
+    /**
+     * @param string|string[] $search
+     */
     public function translate(mixed $search, string $replace = ''): static
     {
         if (is_array($search)) {
@@ -212,10 +214,10 @@ public function unescape(int $mode = self::NORMAL): static
     public function nextToken(string $delim): static
     {
         if ($this->token) {
-            return new static(\strtok($delim));
+            return new static(\strtok($delim) ?: '');
         }
         $this->token = true;
-        return new static(\strtok($this->raw, $delim));
+        return new static(\strtok($this->raw, $delim) ?: '');
     }
 
     public function resetToken(): void
@@ -230,21 +232,25 @@ public function times(int $times): static
 
     public function uuDecode(): static
     {
-        return new static(\convert_uudecode($this->raw));
+        return new static(\convert_uudecode($this->raw) ?: '');
     }
 
     public function uuEncode(): static
     {
         return new static(\convert_uuencode($this->raw));
     }
 
-    protected static function stringableOrFail($thing): bool
+    /**
+     * @param string|object $thing
+     * @throws InvalidArgumentException
+     */
+    protected static function stringify(mixed $thing): string
     {
-        if (
-            is_string($thing)
-            || (\is_object($thing) && \method_exists($thing, '__toString'))
-        ) {
-            return true;
+        if (\is_object($thing) && \method_exists($thing, '__toString')) {
+            return $thing->__toString();
+        }
+        if (\is_string($thing)) {
+            return $thing;
         }
 
         // return false;