Updates PHP version, dependencies, CI workflows, and Makefile for improved tooling and automation.

.gitattributes

@@ -4,7 +4,6 @@
 /LICENSE export-ignore
 /Makefile export-ignore
 /README.md export-ignore
-/phpmd.xml export-ignore
 /phpunit.xml export-ignore
 /phpstan.neon.dist export-ignore
 /infection.json.dist export-ignore

.github/dependabot.yml

@@ -0,0 +1,31 @@
+version: 2
+
+updates:
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 0
+    labels:
+      - "php"
+      - "security"
+      - "dependencies"
+    groups:
+      php-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "build"
+    labels:
+      - "dependencies"
+      - "github-actions"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/auto-assign.yml

@@ -18,7 +18,7 @@ jobs:
       - name: Assign issues and pull requests
         uses: gustavofreze/auto-assign@2.0.0
         with:
-          assignees: '${{ secrets.ASSIGNEES }}'
+          assignees: '${{ vars.ASSIGNEES }}'
           github_token: '${{ secrets.GITHUB_TOKEN }}'
           allow_self_assign: 'true'
           allow_no_assignees: 'true'

.github/workflows/ci.yml

@@ -7,43 +7,84 @@ permissions:
   contents: read
 
 env:
-  PHP_VERSION: '8.3'
+  PHP_VERSION: '8.5'
 
 jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Configure PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ env.PHP_VERSION }}
+          extensions: bcmath
+          tools: composer:2
+
+      - name: Validate composer.json
+        run: composer validate --no-interaction
+
+      - name: Install dependencies
+        run: composer install --no-progress --optimize-autoloader --prefer-dist --no-interaction
+
+      - name: Upload vendor and composer.lock as artifact
+        uses: actions/upload-artifact@v6
+        with:
+          name: vendor-artifact
+          path: |
+            vendor
+            composer.lock
+
   auto-review:
     name: Auto review
     runs-on: ubuntu-latest
+    needs: build
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Configure PHP
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ env.PHP_VERSION }}
+          extensions: bcmath
+          tools: composer:2
 
-      - name: Install dependencies
-        run: composer update --no-progress --optimize-autoloader
+      - name: Download vendor artifact from build
+        uses: actions/download-artifact@v7
+        with:
+          name: vendor-artifact
+          path: .
 
       - name: Run review
         run: composer review
 
   tests:
     name: Tests
     runs-on: ubuntu-latest
+    needs: auto-review
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
-      - name: Use PHP ${{ env.PHP_VERSION }}
+      - name: Configure PHP
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ env.PHP_VERSION }}
+          extensions: bcmath
+          tools: composer:2
 
-      - name: Install dependencies
-        run: composer update --no-progress --optimize-autoloader
+      - name: Download vendor artifact from build
+        uses: actions/download-artifact@v7
+        with:
+          name: vendor-artifact
+          path: .
 
       - name: Run tests
         run: composer tests

.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: Security checks
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: "0 0 * * *"
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ "actions" ]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v4

.gitignore

@@ -4,4 +4,4 @@ vendor
 report
 
 *.lock
-.phpunit.*
+.phpunit.*

Makefile

@@ -1,38 +1,68 @@
-ifeq ($(OS),Windows_NT)
-    PWD := $(shell cd)
-else
-    PWD := $(shell pwd -L)
-endif
-
+PWD := $(CURDIR)
 ARCH := $(shell uname -m)
 PLATFORM :=
 
 ifeq ($(ARCH),arm64)
     PLATFORM := --platform=linux/amd64
 endif
 
-DOCKER_RUN = docker run ${PLATFORM} --rm -it --net=host -v ${PWD}:/app -w /app gustavofreze/php:8.3
+DOCKER_RUN = docker run ${PLATFORM} --rm -it --net=host -v ${PWD}:/app -w /app gustavofreze/php:8.5-alpine
 
-.PHONY: configure test test-file test-no-coverage review show-reports clean
+RESET := \033[0m
+GREEN := \033[0;32m
+YELLOW := \033[0;33m
 
-configure:
+.DEFAULT_GOAL := help
+
+.PHONY: configure
+configure: ## Configure development environment
 	@${DOCKER_RUN} composer update --optimize-autoloader
 
-test:
+.PHONY: test
+test: ## Run all tests with coverage
 	@${DOCKER_RUN} composer tests
 
-test-file:
+.PHONY: test-file
+test-file: ## Run tests for a specific file (usage: make test-file FILE=path/to/file)
 	@${DOCKER_RUN} composer test-file ${FILE}
 
-test-no-coverage:
+.PHONY: test-no-coverage
+test-no-coverage: ## Run all tests without coverage
 	@${DOCKER_RUN} composer tests-no-coverage
 
-review:
+.PHONY: review
+review: ## Run static code analysis
 	@${DOCKER_RUN} composer review
 
-show-reports:
+.PHONY: show-reports
+show-reports: ## Open static analysis reports (e.g., coverage, lints) in the browser
 	@sensible-browser report/coverage/coverage-html/index.html report/coverage/mutation-report.html
 
-clean:
+.PHONY: clean
+clean: ## Remove dependencies and generated artifacts
 	@sudo chown -R ${USER}:${USER} ${PWD}
 	@rm -rf report vendor .phpunit.cache *.lock
+
+.PHONY: help
+help:  ## Display this help message
+	@echo "Usage: make [target]"
+	@echo ""
+	@echo "$$(printf '$(GREEN)')Setup$$(printf '$(RESET)')"
+	@grep -E '^(configure):.*?## .*$$' $(MAKEFILE_LIST) \
+		| awk 'BEGIN {FS = ":.*? ## "}; {printf "$(YELLOW)%-25s$(RESET) %s\n", $$1, $$2}'
+	@echo ""
+	@echo "$$(printf '$(GREEN)')Testing$$(printf '$(RESET)')"
+	@grep -E '^(test|test-file|test-no-coverage):.*?## .*$$' $(MAKEFILE_LIST) \
+		| awk 'BEGIN {FS = ":.*?## "}; {printf "$(YELLOW)%-25s$(RESET) %s\n", $$1, $$2}'
+	@echo ""
+	@echo "$$(printf '$(GREEN)')Quality$$(printf '$(RESET)')"
+	@grep -E '^(review):.*?## .*$$' $(MAKEFILE_LIST) \
+		| awk 'BEGIN {FS = ":.*?## "}; {printf "$(YELLOW)%-25s$(RESET) %s\n", $$1, $$2}'
+	@echo ""
+	@echo "$$(printf '$(GREEN)')Reports$$(printf '$(RESET)')"
+	@grep -E '^(show-reports):.*?## .*$$' $(MAKEFILE_LIST) \
+		| awk 'BEGIN {FS = ":.*?## "}; {printf "$(YELLOW)%-25s$(RESET) %s\n", $$1, $$2}'
+	@echo ""
+	@echo "$$(printf '$(GREEN)')Cleanup$$(printf '$(RESET)')"
+	@grep -E '^(clean):.*?## .*$$' $(MAKEFILE_LIST) \
+		| awk 'BEGIN {FS = ":.*?## "}; {printf "$(YELLOW)%-25s$(RESET) %s\n", $$1, $$2}'

composer.json

@@ -39,27 +39,24 @@
         }
     },
     "require": {
-        "php": "^8.3",
-        "tiny-blocks/immutable-object": "^1"
+        "php": "^8.5",
+        "tiny-blocks/immutable-object": "^1.1"
     },
     "require-dev": {
-        "phpmd/phpmd": "^2.15",
-        "phpunit/phpunit": "^11",
-        "phpstan/phpstan": "^1",
-        "infection/infection": "^0",
-        "squizlabs/php_codesniffer": "^3.11"
+        "phpunit/phpunit": "^11.5",
+        "phpstan/phpstan": "^2.1",
+        "infection/infection": "^0.32",
+        "squizlabs/php_codesniffer": "^4.0"
     },
     "scripts": {
-        "test": "phpunit --configuration phpunit.xml tests",
-        "phpcs": "phpcs --standard=PSR12 --extensions=php ./src",
-        "phpmd": "phpmd ./src text phpmd.xml --suffixes php --ignore-violations-on-exit",
-        "phpstan": "phpstan analyse -c phpstan.neon.dist --quiet --no-progress",
-        "test-file": "phpunit --configuration phpunit.xml --no-coverage --filter",
-        "mutation-test": "infection --only-covered --threads=max --logger-html=report/coverage/mutation-report.html --coverage=report/coverage",
-        "test-no-coverage": "phpunit --configuration phpunit.xml --no-coverage tests",
+        "test": "php -d memory_limit=2G ./vendor/bin/phpunit --configuration phpunit.xml tests",
+        "phpcs": "php ./vendor/bin/phpcs --standard=PSR12 --extensions=php ./src",
+        "phpstan": "php ./vendor/bin/phpstan analyse -c phpstan.neon.dist --quiet --no-progress",
+        "test-file": "php ./vendor/bin/phpunit --configuration phpunit.xml --no-coverage --filter",
+        "mutation-test": "php ./vendor/bin/infection --threads=max --logger-html=report/coverage/mutation-report.html --coverage=report/coverage",
+        "test-no-coverage": "php ./vendor/bin/phpunit --configuration phpunit.xml --no-coverage tests",
         "review": [
             "@phpcs",
-            "@phpmd",
             "@phpstan"
         ],
         "tests": [

phpstan.neon.dist

@@ -4,4 +4,5 @@ parameters:
   level: 9
   tmpDir: report/phpstan
   ignoreErrors:
+    - '#is used zero times and is not analysed#'
   reportUnmatchedIgnoredErrors: false