How to use stable/tagged versions?

[mpdude]

Lieber Oskar,

we've been using this action for years now (including auto-committing and pushing the fixups) and it is making our lives so much easier. Thank you for your work and for maintaining it!

There is one issue I came across recently and I wonder whether you have any ideas how to deal with it.

Some time ago, I had the impression that PHP-CS-Fixer was a bit unstable regarding its defaults and the way how it fixed particular CS issues. In some cases, it might change the code style in one way, only to revert it in the next release (probably a bug?). Or, new defaults are included and change the code in a way you don't like, so you have to update the config to keep it "stable".

All this lead to a desire to run this action with a stable, traceable version of PHP-CS-Fixer and being able to update to another version explicitly, without getting PHP-CS-Fixer updates out of the blue. Thus, I've been specifying uses: docker://oskarstark/php-cs-fixer-ga:3.26.0, but realized that doesn't cut it either.

Clearly the issue is that you need some kind of tagging and release numbering scheme that covers changes you make to this repo here (i. e. actions definition, build process, the entrypoint.sh script and similar). But in addition to that, we also have to deal with the version numbers/releases that go into the Docker image. Mostly this is the actual version of PHP-CS-Fixer being included, but potentially other libraries might matter as well (probably we can neglect this). And, of course, on top of this all goes the requirement that for new upstream releases, new action versions will be shipped automatically, not through a manual process.

Do you have any ideas how this could be addressed? Do you know of any examples of how people solve this "version of the upstream tool plus versioning of the build process" issue through release numbering?

[mpdude]

I've checked how we solve the similar problem over at https://github.com/webfactory/docker-composer-require-checker/blob/main/.github/workflows/build.yml – in fact, we tag the Docker images with the version number of the tool (ComposerRequireChecker) included and omit the "build process" part.

Alternatively, one could tag images with two tags - one for the version of the tool included, and another one like version_of_tool-commit_sha_of_build_repo, for those who want extra scrutinity.

[OskarStark]

Exactly, we need to tag specific versions, but to be honest, I am not using it anymore in my projects.

I would be happy if someone would contribute it or would take a maintainer seat next to me 😅

Have a good day 👋

[mpdude]

So what are you using instead?

[OskarStark]

It is part of my composer.json anyway in my projects:

name: "CI"

on: # yamllint disable-line rule:truthy
    pull_request: ~
    push:
        branches:
            - "master"

env:
    DATANA_BOT_EMAIL: "[email protected]"
    DATANA_BOT_NAME: "datana-bot"
    REQUIRED_PHP_EXTENSIONS: "ctype, filter, hash, iconv, imagick"
    PHP_INI_VALUES: "date.timezone=Europe/Berlin"

jobs:
    coding-standards:
        name: "Coding Standards"

        runs-on: "ubuntu-latest"

        strategy:
            matrix:
                php-version:
                    - "8.3"

        steps:
            # workaround for missing secret in fork PRs - see https://github.com/actions/checkout/issues/298
            # see https://github.com/rectorphp/rector/commit/d395e1c28b8e6a56711dcc2e10490a82965850e4
            -   if: github.actor != 'dependabot[bot]'
                name: "Checkout"
                uses: "actions/checkout@v4"
                with:
                    ref: "${{ github.head_ref }}"
                    # Must be used to be able to commit changed files
                    token: "${{ secrets.DATANA_BOT_TOKEN }}"

            # in forks, the token is not available - so we cannot use it
            -   if: github.actor == 'dependabot[bot]'
                name: "Checkout"
                uses: "actions/checkout@v4"
                with:
                    ref: "${{ github.head_ref }}"

            -
                name: "Install PHP with extensions"
                uses: "shivammathur/[email protected]"
                with:
                    coverage: "none"
                    extensions: "${{ env.REQUIRED_PHP_EXTENSIONS }}"
                    php-version: "${{ matrix.php-version }}"
                    ini-values: "${{ env.PHP_INI_VALUES }}"
                    tools: composer:v2

            -
                name: "Validate composer.json"
                run: "composer validate"

            -
                name: "Composer install"
                uses: "ramsey/[email protected]"
                with:
                    composer-options: "--no-scripts"

            -
                name: "Run ergebnis/composer-normalize"
                run: "composer normalize"

            -
                name: "Commit files normalized with ergebnis/composer-normalize"
                uses: "stefanzweifel/[email protected]"
                with:
                    branch: "${{ github.head_ref }}"
                    commit_author: "${{ env.DATANA_BOT_NAME }} <${{ env.DATANA_BOT_EMAIL }}>"
                    commit_message: "Fix: Run 'composer normalize'"
                    commit_user_email: "${{ env.DATANA_BOT_EMAIL }}"
                    commit_user_name: "${{ env.DATANA_BOT_NAME }}"

            -
                name: "Create cache directory for friendsofphp/php-cs-fixer"
                run: "mkdir -p .build/php-cs-fixer"

            -
                name: "Cache cache directory for friendsofphp/php-cs-fixer"
                uses: "actions/cache@v4"
                with:
                    path: ".build/php-cs-fixer"
                    key: "php-${{ matrix.php-version }}-php-cs-fixer-${{ github.sha }}"
                    restore-keys: "php-${{ matrix.php-version }}-php-cs-fixer-"

            -
                name: "Run friendsofphp/php-cs-fixer"
                run: "vendor/bin/php-cs-fixer fix --diff --verbose"

            -
                name: "Commit files fixed with friendsofphp/php-cs-fixer"
                uses: "stefanzweifel/[email protected]"
                with:
                    branch: "${{ github.head_ref }}"
                    commit_author: "${{ env.DATANA_BOT_NAME }} <${{ env.DATANA_BOT_EMAIL }}>"
                    commit_message: "Fix: Run 'php-cs-fixer fix'"
                    commit_user_email: "${{ env.DATANA_BOT_EMAIL }}"
                    commit_user_name: "${{ env.DATANA_BOT_NAME }}"

[mpdude]

I took a look at this issue and it seems that Docker images would already be tagged with PHP-CS-Fixer versions if the action in this repo were tagged and/or released after updates.

In fact, the workflows try to do so, but there was a failure the last time an update was performed:

https://github.com/OskarStark/php-cs-fixer-ga/actions/runs/9541990890/job/26296038990

Maybe if we get this fixed, we'd get the required tagging.