feat: full quality gate v2 — PHPStan, Pint, Rector, Publish Guard

action.yml

@@ -39,6 +39,10 @@ inputs:
     description: 'Directory to scan for coverage (auto-detects app/ or src/ if not specified)'
     required: false
     default: ''
+  phpstan-level:
+    description: 'PHPStan analysis level (0-9). Set to -1 to skip.'
+    required: false
+    default: '5'
   compact:
     description: 'Use compact single-line output instead of verbose'
     required: false
@@ -122,6 +126,7 @@ runs:
           certify|*)
             php ${{ github.action_path }}/gate certify \
               --coverage=${{ inputs.coverage-threshold }} \
+              --phpstan-level=${{ inputs.phpstan-level }} \
               --token=${{ inputs.github-token }} \
               ${{ inputs.compact == 'true' && '--compact' || '' }}
             ;;

app/Checks/PhpStanAnalyzer.php

@@ -0,0 +1,72 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Checks;
+
+use App\Contracts\ProcessRunner;
+use App\Services\SymfonyProcessRunner;
+
+final class PhpStanAnalyzer implements CheckInterface
+{
+    public function __construct(
+        private readonly int $level = 5,
+        private readonly ProcessRunner $processRunner = new SymfonyProcessRunner,
+    ) {}
+
+    public function name(): string
+    {
+        return 'PHPStan';
+    }
+
+    public function run(string $workingDirectory): CheckResult
+    {
+        $binary = $workingDirectory.'/vendor/bin/phpstan';
+
+        if (! file_exists($binary)) {
+            return CheckResult::pass('PHPStan not installed — skipped');
+        }
+
+        $result = $this->processRunner->run(
+            [$binary, 'analyse', '--no-progress', '--error-format=json', "--level={$this->level}", '--memory-limit=512M'],
+            $workingDirectory,
+            timeout: 300,
+        );
+
+        $data = json_decode($result->output, true);
+
+        if ($data === null) {
+            // Fall back to exit code if JSON parsing fails
+            if ($result->exitCode === 0) {
+                return CheckResult::pass('PHPStan passed (level '.$this->level.')');
+            }
+
+            return CheckResult::fail(
+                'PHPStan failed',
+                [substr($result->output, 0, 500)],
+                $result->output,
+            );
+        }
+
+        $errorCount = $data['totals']['errors'] ?? 0;
+        $fileErrors = $data['totals']['file_errors'] ?? 0;
+        $totalErrors = $errorCount + $fileErrors;
+
+        if ($totalErrors === 0) {
+            return CheckResult::pass('PHPStan passed (level '.$this->level.', 0 errors)');
+        }
+
+        $details = [];
+        foreach ($data['files'] ?? [] as $file => $fileData) {
+            foreach ($fileData['messages'] ?? [] as $msg) {
+                $details[] = basename($file).':'.$msg['line'].' — '.$msg['message'];
+            }
+        }
+
+        return CheckResult::fail(
+            "PHPStan found {$totalErrors} error(s) at level {$this->level}",
+            array_slice($details, 0, 20),
+            $result->output,
+        );
+    }
+}

app/Checks/PintFormatter.php

@@ -0,0 +1,70 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Checks;
+
+use App\Contracts\ProcessRunner;
+use App\Services\SymfonyProcessRunner;
+
+final class PintFormatter implements CheckInterface
+{
+    public function __construct(
+        private readonly ProcessRunner $processRunner = new SymfonyProcessRunner,
+    ) {}
+
+    public function name(): string
+    {
+        return 'Pint Style';
+    }
+
+    public function run(string $workingDirectory): CheckResult
+    {
+        $binary = $workingDirectory.'/vendor/bin/pint';
+
+        if (! file_exists($binary)) {
+            return CheckResult::pass('Pint not installed — skipped');
+        }
+
+        $result = $this->processRunner->run(
+            [$binary, '--test', '--format=json'],
+            $workingDirectory,
+            timeout: 120,
+        );
+
+        $data = json_decode($result->output, true);
+
+        if ($data === null) {
+            if ($result->exitCode === 0) {
+                return CheckResult::pass('Code style is clean');
+            }
+
+            return CheckResult::fail(
+                'Pint check failed',
+                [substr($result->output, 0, 500)],
+                $result->output,
+            );
+        }
+
+        if (($data['result'] ?? '') === 'pass') {
+            return CheckResult::pass('Code style is clean');
+        }
+
+        $files = $data['files'] ?? [];
+        $details = [];
+
+        foreach (array_slice($files, 0, 20) as $f) {
+            if (is_array($f) && isset($f['path'])) {
+                $details[] = $f['path'].' ('.implode(', ', $f['fixers'] ?? []).')';
+            } elseif (is_string($f)) {
+                $details[] = $f;
+            }
+        }
+
+        return CheckResult::fail(
+            count($files).' file(s) need formatting',
+            $details,
+            $result->output,
+        );
+    }
+}

app/Checks/PublishGuard.php

@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Checks;
+
+use App\Contracts\ProcessRunner;
+use App\Services\SymfonyProcessRunner;
+
+final class PublishGuard implements CheckInterface
+{
+    public function __construct(
+        private readonly ProcessRunner $processRunner = new SymfonyProcessRunner,
+    ) {}
+
+    public function name(): string
+    {
+        return 'Publish Guard';
+    }
+
+    public function run(string $workingDirectory): CheckResult
+    {
+        $violations = [];
+
+        // Check for .env files (excluding .env.testing and .env.example)
+        $envResult = $this->processRunner->run(
+            ['git', 'ls-files', '*.env', '.env*'],
+            $workingDirectory,
+            timeout: 10,
+        );
+
+        foreach (array_filter(explode("\n", trim($envResult->output))) as $file) {
+            if (! str_ends_with($file, '.env.testing') && ! str_ends_with($file, '.env.example')) {
+                $violations[] = "Tracked .env file: {$file}";
+            }
+        }
+
+        // Check for source map files
+        $mapResult = $this->processRunner->run(
+            ['git', 'ls-files', '*.map'],
+            $workingDirectory,
+            timeout: 10,
+        );
+
+        foreach (array_filter(explode("\n", trim($mapResult->output))) as $file) {
+            $violations[] = "Tracked .map file: {$file}";
+        }
+
+        // Check for large files (> 1MB)
+        $lsResult = $this->processRunner->run(
+            ['git', 'ls-files'],
+            $workingDirectory,
+            timeout: 10,
+        );
+
+        foreach (array_filter(explode("\n", trim($lsResult->output))) as $file) {
+            $path = $workingDirectory.'/'.$file;
+            if (file_exists($path) && filesize($path) > 1_048_576) {
+                $size = round(filesize($path) / 1_048_576, 1);
+                $violations[] = "Large file ({$size}MB): {$file}";
+            }
+        }
+
+        if ($violations === []) {
+            return CheckResult::pass('No disallowed artifacts found');
+        }
+
+        return CheckResult::fail(
+            count($violations).' publish violation(s) found',
+            $violations,
+            implode("\n", $violations),
+        );
+    }
+}

app/Checks/RectorAnalyzer.php

@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Checks;
+
+use App\Contracts\ProcessRunner;
+use App\Services\SymfonyProcessRunner;
+
+final class RectorAnalyzer implements CheckInterface
+{
+    public function __construct(
+        private readonly ProcessRunner $processRunner = new SymfonyProcessRunner,
+    ) {}
+
+    public function name(): string
+    {
+        return 'Rector';
+    }
+
+    public function run(string $workingDirectory): CheckResult
+    {
+        $binary = $workingDirectory.'/vendor/bin/rector';
+
+        if (! file_exists($binary)) {
+            return CheckResult::pass('Rector not installed — skipped');
+        }
+
+        if (! file_exists($workingDirectory.'/rector.php')) {
+            return CheckResult::pass('No rector.php config — skipped');
+        }
+
+        $result = $this->processRunner->run(
+            [$binary, 'process', '--dry-run', '--no-progress-bar'],
+            $workingDirectory,
+            timeout: 300,
+        );
+
+        if ($result->exitCode === 0) {
+            return CheckResult::pass('Rector found no issues');
+        }
+
+        // Count suggested changes from output
+        $lines = explode("\n", trim($result->output));
+        $changeCount = 0;
+        $details = [];
+
+        foreach ($lines as $line) {
+            if (str_contains($line, 'diff')) {
+                $changeCount++;
+            }
+            if (str_starts_with(trim($line), '---') || str_starts_with(trim($line), '+++')) {
+                $details[] = trim($line);
+            }
+        }
+
+        return CheckResult::fail(
+            'Rector found '.max($changeCount, 1).' file(s) needing refactoring',
+            array_slice($details, 0, 20),
+            $result->output,
+        );
+    }
+}

app/Checks/TestRunner.php

@@ -5,16 +5,18 @@
 namespace App\Checks;
 
 use App\Contracts\ProcessRunner;
+use App\GitHub\CommentsClient;
+use App\Services\CoverageReporter;
 use App\Services\PestOutputParser;
 use App\Services\SymfonyProcessRunner;
 
 final class TestRunner implements CheckInterface
 {
-    /** @var \App\GitHub\CommentsClient|null For testing */
-    private ?\App\GitHub\CommentsClient $commentsClient = null;
+    /** @var CommentsClient|null For testing */
+    private ?CommentsClient $commentsClient = null;
 
-    /** @var \App\Services\CoverageReporter|null For testing */
-    private ?\App\Services\CoverageReporter $coverageReporter = null;
+    /** @var CoverageReporter|null For testing */
+    private ?CoverageReporter $coverageReporter = null;
 
     public function __construct(
         private readonly int $coverageThreshold = 100,
@@ -24,8 +26,8 @@ public function __construct(
 
     /** @internal For testing only */
     public function withCommentDependencies(
-        \App\GitHub\CommentsClient $commentsClient,
-        \App\Services\CoverageReporter $coverageReporter,
+        CommentsClient $commentsClient,
+        CoverageReporter $coverageReporter,
     ): self {
         $this->commentsClient = $commentsClient;
         $this->coverageReporter = $coverageReporter;
@@ -75,8 +77,8 @@ private function postCoverageComment(string $cloverPath): void
             return;
         }
 
-        $commentsClient = $this->commentsClient ?? new \App\GitHub\CommentsClient($token);
-        $reporter = $this->coverageReporter ?? new \App\Services\CoverageReporter($this->coverageThreshold);
+        $commentsClient = $this->commentsClient ?? new CommentsClient($token);
+        $reporter = $this->coverageReporter ?? new CoverageReporter($this->coverageThreshold);
 
         if ($commentsClient->isAvailable()) {
             try {