Repository navigation
chore(scaffold): community health files, engine dev-stamp alignment - #37
Merged
Merged
Conversation
…ith adapters - security policy, contributing guide, code of conduct, funding, pull request template, and issue template set (fastapi-guard baseline) - ecosystem-gate ci-only engine stamp 4.1.99 -> 4.2.99 to match the 4.2.99 stamp every adapter ci/drift/scheduled workflow applies
rennf93
force-pushed
the
ci/scaffold-baseline
branch
from
September 28, 2026 21:40
c387f9e to
05e7e2b
Compare
rennf93
changed the title
slim-guard 1.2.0 added the rennf93/psr15-guard path repository and its composer.lock pins psr15-guard at the CI-only 1.2.99 path version, which Packagist cannot satisfy, so the consumer-test install fails with 'Source path ../psr15-guard is not found' on every run that checks the consumer out at its current default branch (the failure first surfaced on this PR's ecosystem gate; master last passed before the 1.2.0 lock landed). Check the sibling out next to slim-guard and version-stamp it 1.2.99 in the CI-only patch step, mirroring slim-guard's own ci.yml pattern; verified locally: composer install + update resolve both path packages and bin/test_slim.php passes 81/81.
3 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Delivers issue: none (repo chore, carries the
no-issuelabel)Description
Process scaffold roll-out to the PHP family, modeled on the Go family and the fastapi-guard baseline. Additive only: no existing workflow trigger is touched, no composer requirement or version changes.
Added
SECURITY.md: supported versions 4.2.x / 4.0.x (v4.1.0 was yanked, so 4.0 is the previous published minor), reporting via GitHub security advisories.CONTRIBUTING.md: php ^8.2, composer install,composer conformance/composer lint/make test, PR rules (issue orno-issuelabel, lowercase conventional commits, no attribution trailers).CODE_OF_CONDUCT.md: verbatim from fastapi-guard..github/FUNDING.yml:github: rennf93, paypal custom link, tidelift commented out..github/PULL_REQUEST_TEMPLATE.md: verbatim from fastapi-guard..github/ISSUE_TEMPLATE/{bug,feature,docs,config}.yml: adapted (product name, docs URL https://rennf93.github.io/guard-core-php/, php config render).Fixed
.github/workflows/ecosystem-gate.yml: the CI-only engine composer stamp was4.1.99while every adapter's ci / upstream-drift / scheduled-lint workflow stamps4.2.99; the engine stamp now matches (4.2.99), with the directly tied comment updated to^4.2.0. Only the version string and that comment changed.Skipped
code-ql.yml): drafted as directed, but the first run proved it cannot pass. GitHub CodeQL no longer supports PHP:github/codeql-action/init@2892aa5(v4.38.2, the Go family pin) fails in Initialize CodeQL withDid not recognize the following languages: php. The file was dropped from this PR to keep CI green. Added instead:.github/workflows/semgrep.yml(the PHP-capable substitute), running the pinnedsemgrep/semgrep:1.177.0container with thep/security-auditandp/secretsrulesets oversrc/(--error), path-filtered push/PR triggers plus a weekly Monday cron; SEMGREP_SEND_METRICS off.CHANGELOG.md: already exists.Verification