From 48338f39e579e398dc961b193422c0d05e7ae828 Mon Sep 17 00:00:00 2001 From: Renn F Date: Thu, 1 Oct 2026 22:13:07 +0200 Subject: [PATCH] release(1.3.0): floor guard-core-php to ^4.3.0, the safety-corpus release - the process scaffold and the 100% line coverage gate ride along --- .github/workflows/ci.yml | 6 +++--- .github/workflows/release.yml | 4 ++-- .github/workflows/scheduled-lint.yml | 2 +- .github/workflows/static-analysis.yml | 2 +- .github/workflows/upstream-drift.yml | 4 ++-- CHANGELOG.md | 18 ++++++++++++++++ composer.json | 2 +- composer.lock | 31 +++++++++++++++++++++------ 8 files changed, 52 insertions(+), 17 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b1526a3..bcfbdc3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -62,7 +62,7 @@ jobs: engine = "../guard-core-php/composer.json" with open(engine) as f: d = json.load(f) - d["version"] = "4.2.99" + d["version"] = "4.3.99" with open(engine, "w") as f: json.dump(d, f, indent=4) f.write("\n") @@ -132,7 +132,7 @@ jobs: engine = "../guard-core-php/composer.json" with open(engine) as f: d = json.load(f) - d["version"] = "4.2.99" + d["version"] = "4.3.99" with open(engine, "w") as f: json.dump(d, f, indent=4) f.write("\n") @@ -195,7 +195,7 @@ jobs: engine = "../guard-core-php/composer.json" with open(engine) as f: d = json.load(f) - d["version"] = "4.2.99" + d["version"] = "4.3.99" with open(engine, "w") as f: json.dump(d, f, indent=4) f.write("\n") diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0952167..57180e7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -52,7 +52,7 @@ jobs: engine = "../guard-core-php/composer.json" with open(engine) as f: d = json.load(f) - d["version"] = "4.2.99" + d["version"] = "4.3.99" with open(engine, "w") as f: json.dump(d, f, indent=4) f.write("\n") @@ -122,7 +122,7 @@ jobs: engine = "../guard-core-php/composer.json" with open(engine) as f: d = json.load(f) - d["version"] = "4.2.99" + d["version"] = "4.3.99" with open(engine, "w") as f: json.dump(d, f, indent=4) f.write("\n") diff --git a/.github/workflows/scheduled-lint.yml b/.github/workflows/scheduled-lint.yml index 12c3dac..c8b3ac6 100644 --- a/.github/workflows/scheduled-lint.yml +++ b/.github/workflows/scheduled-lint.yml @@ -38,7 +38,7 @@ jobs: engine = "../guard-core-php/composer.json" with open(engine) as f: d = json.load(f) - d["version"] = "4.2.99" + d["version"] = "4.3.99" with open(engine, "w") as f: json.dump(d, f, indent=4) f.write("\n") diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml index b2a02aa..8eb418b 100644 --- a/.github/workflows/static-analysis.yml +++ b/.github/workflows/static-analysis.yml @@ -53,7 +53,7 @@ jobs: engine = "../guard-core-php/composer.json" with open(engine) as f: d = json.load(f) - d["version"] = "4.2.99" + d["version"] = "4.3.99" with open(engine, "w") as f: json.dump(d, f, indent=4) f.write("\n") diff --git a/.github/workflows/upstream-drift.yml b/.github/workflows/upstream-drift.yml index 58c4bec..8218dc8 100644 --- a/.github/workflows/upstream-drift.yml +++ b/.github/workflows/upstream-drift.yml @@ -51,7 +51,7 @@ jobs: engine = "core-upstream/composer.json" with open(engine) as f: d = json.load(f) - d["version"] = "4.2.99" + d["version"] = "4.3.99" with open(engine, "w") as f: json.dump(d, f, indent=4) f.write("\n") @@ -79,7 +79,7 @@ jobs: -e REDIS_HOST=127.0.0.1 \ composer:2 sh -c ' set -e - composer require --no-update --no-interaction "rennf93/guard-core-php:4.2.99" + composer require --no-update --no-interaction "rennf93/guard-core-php:4.3.99" composer update --no-interaction --no-progress "rennf93/guard-core-php" composer lint php bin/test_symfony.php diff --git a/CHANGELOG.md b/CHANGELOG.md index 0a6f11f..638a11d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,24 @@ Release Notes ___ +v1.3.0 (2026-10-01) +------------------- + +### Changed + +- **Engine floor raised to guard-core-php ^4.3.0, the safety-corpus release.** 1.3.0 floors `rennf93/guard-core-php` to ^4.3.0 and picks up the 4.3.0 engine train: the spec 12 event bus with dynamic rules and Redis-backed metrics persistence, the spec 10 geo download and refresh lifecycle, the spec 04 ReDoS safety gates over PCRE plus the performance monitor, and the pattern_safety / events / redis_interop conformance runners. Nothing in the Symfony surface changes: the middleware is a thin adapter, so the new engine surfaces ride config through the unchanged option map. The CI engine checkout stamps the mounted sibling path checkout at 4.3.99 (ci.yml, release.yml, static-analysis.yml, upstream-drift.yml, scheduled-lint.yml) so the floor resolves against the engine master while keeping the published constraint ^4.3.0, and `composer.lock` resolves the engine at the released v4.3.0. + +### Added + +- **Process scaffold (PR #16).** `SECURITY.md` (supported versions, advisory reporting), `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, `.github/FUNDING.yml`, the PR template and the issue templates, modeled on the Go family and the fastapi-guard baseline. `.github/workflows/static-analysis.yml`: phpstan via the docker pattern these repos already use (composer:2 install with the same ci-only path-repository patch as ci.yml, then `ghcr.io/phpstan/phpstan:latest analyse src --level=3`), on push/pr to master plus the weekly Monday cron; level 3 is the highest level with zero findings on master. `.github/workflows/live-smoke.yml` gains the `live-smoke-advanced` job (the existing simple_app job untouched): a dockerized run of `examples/advanced_app` on host port 8081 asserting `GET /` and `GET /health` 200 plus one blocked-request check (`GET /admin/check?ip=203.0.113.9` without `X-Admin-Token` returns the admin gate's 400 "Missing required header: X-Admin-Token"). CodeQL was drafted and dropped after the first run proved GitHub CodeQL no longer supports PHP (`Did not recognize the following languages: php`); `.github/workflows/semgrep.yml` is the substitute, running the pinned semgrep/semgrep:1.177.0 container with the p/security-audit and p/secrets rulesets over src/ (path-filtered push/PR triggers plus a weekly Monday cron, metrics off). +- **100% line coverage gate (PR #17, following the psr15-guard pilot).** The bespoke `bin/test_symfony.php` suite stays as it is; `.github/coverage-runner.php` (phpunit/php-code-coverage ^11 + pcov) executes the suite under coverage and the new CI coverage job gates on 100.00% measured lines in src/. The suite already measured 100.00% lines locally (pcov, php 8.3), with and without a reachable redis, so no test changes were needed; the job mirrors ci.yml's path-repo sibling pattern (php 8.3, coverage: pcov) and suite pass/fail stays gated by the existing test job. + +### Verification + +- `make lint` exit 0 and `make test` exit 0 on php 8.5.11 (host Redis on 6379, 120/120 checks green), with `composer.lock` resolving guard-core-php v4.3.0. + +___ + v1.2.0 (2026-09-27) ------------------- diff --git a/composer.json b/composer.json index cb31200..c6203cf 100644 --- a/composer.json +++ b/composer.json @@ -5,7 +5,7 @@ "license": "MIT", "require": { "php": "^8.2", - "rennf93/guard-core-php": "^4.2.0", + "rennf93/guard-core-php": "^4.3.0", "symfony/http-foundation": "^6.4|^7.0", "symfony/http-kernel": "^6.4|^7.0" }, diff --git a/composer.lock b/composer.lock index 5378752..89f47d9 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "880374a8d90ad541322214d13ecaade1", + "content-hash": "0dc44271c8712ade4201d3b3da96f3cb", "packages": [ { "name": "psr/event-dispatcher", @@ -108,16 +108,16 @@ }, { "name": "rennf93/guard-core-php", - "version": "v4.2.0", + "version": "v4.3.0", "source": { "type": "git", - "url": "git@github.com:rennf93/guard-core-php.git", - "reference": "388d4d1e134b71062b6a18a86a46ba5bdd789571" + "url": "https://github.com/rennf93/guard-core-php.git", + "reference": "fe1b6ba14f091397d5588d335be1a59194b8b971" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/rennf93/guard-core-php/zipball/388d4d1e134b71062b6a18a86a46ba5bdd789571", - "reference": "388d4d1e134b71062b6a18a86a46ba5bdd789571", + "url": "https://api.github.com/repos/rennf93/guard-core-php/zipball/fe1b6ba14f091397d5588d335be1a59194b8b971", + "reference": "fe1b6ba14f091397d5588d335be1a59194b8b971", "shasum": "" }, "require": { @@ -126,6 +126,9 @@ "ext-pcre": "*", "php": "^8.2" }, + "require-dev": { + "phpunit/php-code-coverage": "^11.0" + }, "type": "library", "autoload": { "psr-4": { @@ -144,7 +147,21 @@ "MIT" ], "description": "PHP port of guard-core: behavioral WAF engine (detection engine conformance milestone)", - "time": "2026-09-27T18:43:50+00:00" + "support": { + "source": "https://github.com/rennf93/guard-core-php/tree/v4.3.0", + "issues": "https://github.com/rennf93/guard-core-php/issues" + }, + "funding": [ + { + "type": "github", + "url": "https://github.com/rennf93" + }, + { + "type": "custom", + "url": "https://paypal.me/renzof93" + } + ], + "time": "2026-10-01T20:08:35+00:00" }, { "name": "symfony/deprecation-contracts",