graphify-php 0.0.5__tar.gz

graphify_php-0.0.5/.github/workflows/ci.yml

@@ -0,0 +1,40 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  # pip-audit answers a question no push can ask: a CVE gets published against
+  # a dependency tree that has not changed. The nightly run keeps that check
+  # alive on a repository that stands still.
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# A newer push to the same branch or pull request makes the run in flight
+# pointless, so cancel it.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+# Three stages in order: security, tests, build. Jobs inside a stage run in
+# parallel; the stages are sequential, so a leaked secret stops the run before
+# anything is tested and a failing test stops it before anything is built.
+#
+# No smoke stage: tests/test_cli_end_to_end.py already runs the real graphify
+# in-process against a generated PHP project, so a separate end-to-end job
+# would repeat what the test matrix proves on every Python version.
+jobs:
+  security:
+    uses: ./.github/workflows/stage-security.yml
+
+  tests:
+    needs: security
+    uses: ./.github/workflows/stage-tests.yml
+
+  build:
+    needs: tests
+    uses: ./.github/workflows/stage-build.yml

graphify_php-0.0.5/.github/workflows/pages.yml

@@ -0,0 +1,62 @@
+name: Pages
+
+# The site is the Jekyll build of docs/ alone. Only changes to docs/ or to this
+# workflow can change it, so other pushes skip the deploy.
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - "docs/**"
+      - ".github/workflows/pages.yml"
+  workflow_dispatch:
+
+# Default deny; each job below requests only what it needs.
+permissions: {}
+
+# One deployment at a time, and never cancel one in flight: a cancelled deploy
+# can leave the site half-published. Queued runs still collapse.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      # Always master: a manual dispatch from another branch would otherwise
+      # publish unreviewed docs to the public site.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: master
+          persist-credentials: false
+
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
+      - name: Build the site
+        # docs/kb is a symlink to a private vault; _config.yml excludes it so
+        # the build cannot publish it even if the link is ever committed.
+        uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697 # v1.0.13
+        with:
+          source: ./docs
+          destination: ./_site
+
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: ./_site
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+      contents: read
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

graphify_php-0.0.5/.github/workflows/release.yml

@@ -0,0 +1,72 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+# Default deny; each job below requests only what it needs.
+permissions: {}
+
+# No `concurrency` block, unlike ci.yml: cancelling a publish half-way is worse
+# than paying for the runner.
+
+# The same three stage workflows ci.yml runs, with the publish on top, so a
+# release passes exactly the checks a pull request does.
+jobs:
+  security:
+    permissions:
+      contents: read
+    uses: ./.github/workflows/stage-security.yml
+
+  tests:
+    needs: security
+    permissions:
+      contents: read
+    uses: ./.github/workflows/stage-tests.yml
+
+  # stage-build takes a bare PEP 440 version, not a tag, so that it stays usable
+  # from ci.yml where no tag exists. Stripping the leading "v" needs a shell:
+  # GitHub's expression syntax has no substring operator.
+  version:
+    runs-on: ubuntu-latest
+    permissions: {}
+    outputs:
+      value: ${{ steps.strip.outputs.value }}
+    steps:
+      - id: strip
+        env:
+          TAG: ${{ github.ref_name }}
+        run: echo "value=${TAG#v}" >> "$GITHUB_OUTPUT"
+
+  build:
+    needs: [tests, version]
+    permissions:
+      contents: read
+    uses: ./.github/workflows/stage-build.yml
+    with:
+      # Turns on the check that the version hatch-vcs computed from git history
+      # equals the tag being released.
+      expected_version: ${{ needs.version.outputs.value }}
+
+  # Trusted publishing: PyPI trusts this workflow and the `pypi` environment
+  # through OIDC, so no API token is stored in the repository.
+  pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      # The files stage-build produced and installed from a clean venv. Nothing
+      # is rebuilt here: a second build could differ from the one the gates ran.
+      - name: Download dist artifacts
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist
+
+      - name: Publish to PyPI
+        run: |
+          python3 -m pip install "uv==0.12.5"
+          python3 -m uv publish --trusted-publishing always dist/*

graphify_php-0.0.5/.github/workflows/stage-build.yml

@@ -0,0 +1,99 @@
+name: stage-build
+
+on:
+  workflow_call:
+    inputs:
+      expected_version:
+        description: >
+          PEP 440 version the built wheel must carry, without a leading "v".
+          Empty (the default) skips the check: a pull request has no tag.
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  # Every other job installs with `pip install -e .`, which imports straight
+  # from src/ and never builds anything. A package left out of
+  # [tool.hatch.build.targets.wheel] or a console script removed from
+  # [project.scripts] produces a wheel that installs cleanly and does nothing.
+  # This job is the gate for that.
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # hatch-vcs derives the version from `git describe`. A shallow clone
+          # has no tags and would build the fallback version instead.
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Build sdist + wheel
+        run: |
+          python -m pip install --upgrade build
+          python -m build
+
+      - name: Built version matches the release tag
+        # PyPI never accepts the same version twice, so a wheel that does not
+        # carry the tag's version must stop here, before anything ships.
+        if: inputs.expected_version != ''
+        env:
+          EXPECTED: ${{ inputs.expected_version }}
+        run: |
+          built=$(ls dist/*.whl | grep -oP 'graphify_php-\K[^-]+(?=-py3)')
+          echo "expected=${EXPECTED} built=${built}"
+          if [ "$built" != "$EXPECTED" ]; then
+            echo "::error::Built version '${built}' does not match the tag version '${EXPECTED}'."
+            exit 1
+          fi
+
+      - name: Install the built wheel into a clean venv and run the entry point
+        # A fresh venv outside the checkout has no src/ on sys.path, so the
+        # import and the console script can only resolve against what the wheel
+        # shipped. Run from $RUNNER_TEMP for the same reason.
+        #
+        # The wheel is installed alone, without graphify, so `--help` proves
+        # the console script and the package import stand on their own. A real
+        # build still needs graphify, which the test matrix covers.
+        run: |
+          set -euo pipefail
+          python -m venv "$RUNNER_TEMP/wheelenv"
+          "$RUNNER_TEMP/wheelenv/bin/pip" install --upgrade pip
+          "$RUNNER_TEMP/wheelenv/bin/pip" install dist/*.whl
+          cd "$RUNNER_TEMP"
+          "$RUNNER_TEMP/wheelenv/bin/python" -c "import graphify_php; print(graphify_php.__name__)"
+          "$RUNNER_TEMP/wheelenv/bin/graphify-php-build" --help
+
+      - name: The wheel carries the PHPStan extension
+        # Without php/ in the wheel the PHPStan source finds no autoload file and
+        # drops out quietly, leaving tree-sitter alone. The lookup must resolve
+        # inside the installed package, not in this checkout.
+        run: |
+          set -euo pipefail
+          cd "$RUNNER_TEMP"
+          "$RUNNER_TEMP/wheelenv/bin/python" - <<'PY'
+          from graphify_php.sources.phpstan_source import extension_autoload_file
+
+          path = extension_autoload_file()
+          assert path is not None, "php/autoload.php is missing from the wheel"
+          assert "site-packages" in str(path), path
+          assert (path.parent / "src" / "CallGraph").is_dir(), path
+          print(path)
+          PY
+
+      - name: Upload dist artifacts
+        # release.yml publishes these files rather than building its own copy,
+        # so what a release ships is the artifact this job just proved
+        # installable.
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error

graphify_php-0.0.5/.github/workflows/stage-security.yml

@@ -0,0 +1,146 @@
+name: stage-security
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: gitleaks — scan git history for hardcoded secrets
+        # Plain OSS gitleaks CLI, not gitleaks/gitleaks-action: that Action now
+        # requires a paid GITLEAKS_LICENSE for GitHub Organizations. The CLI
+        # itself stays free/open-source.
+        # The sha256 below is pinned from the official release checksums file:
+        # https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_checksums.txt
+        # .gitleaks.toml at the repository root extends the default rules with
+        # a path allowlist for the planted canaries (see that file).
+        run: |
+          curl -sSfL -o gitleaks_8.30.1_linux_x64.tar.gz \
+            https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  gitleaks_8.30.1_linux_x64.tar.gz" | sha256sum -c -
+          tar -xzf gitleaks_8.30.1_linux_x64.tar.gz gitleaks
+          ./gitleaks detect --source . --no-banner --redact
+
+  trufflehog:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      # The pull-request scan reports the `unknown` result class, the history
+      # scan does not. An `unknown` result is a string that looks like a
+      # credential and cannot be verified. On a pull request it is in the diff
+      # under review and can still be changed; in old history it can only be
+      # silenced by rewriting the commits that contain it, which would fail this
+      # job on every future run of a repository that leaks nothing.
+      #
+      # Both scans report every verified result, from every detector. A real
+      # leak fails this job wherever it lands.
+      - name: trufflehog — scan PR commits for verified and unknown secrets (pull_request)
+        if: github.event_name == 'pull_request'
+        uses: trufflesecurity/trufflehog@363923b901c911a9164f50b6c423f47c15372b1c # v3.97.4
+        with:
+          path: ./
+          base: ${{ github.event.pull_request.base.sha }}
+          head: ${{ github.event.pull_request.head.sha }}
+          # --exclude-paths names the two files that plant fake credentials on
+          # purpose; .trufflehog-exclude.txt explains which and why. Excluding
+          # those paths is what keeps the `unknown` class switched on for every
+          # other file in the diff.
+          extra_args: --results=verified,unknown --exclude-paths=.trufflehog-exclude.txt
+
+      # Runs on push, and on the nightly schedule and manual dispatch too.
+      - name: trufflehog — scan full git history for verified secrets
+        if: github.event_name != 'pull_request'
+        uses: trufflesecurity/trufflehog@363923b901c911a9164f50b6c423f47c15372b1c # v3.97.4
+        with:
+          path: ./
+          base: ""
+          head: ${{ github.ref_name }}
+          # No --exclude-paths here: this scan reports only verified results,
+          # and a verified credential must fail the job whatever file it sits
+          # in, canary fixture included.
+          extra_args: --results=verified
+
+  pip-audit:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+          cache: "pip"
+
+      - name: Install graphify-php with test and lint extras
+        # The package has no runtime dependencies; the test extra is what pulls
+        # graphifyy and its tree-sitter grammars, so this is the tree worth
+        # auditing.
+        run: pip install -e ".[test,lint]"
+
+      - name: pip-audit — audit installed Python dependencies for known CVEs
+        # pip-audit exits 1 when it finds known vulnerabilities — that MUST
+        # fail the job. Only other nonzero exit codes (infra/network errors,
+        # e.g. the PyPI advisory DB being unreachable) are downgraded to a
+        # logged warning so a transient hiccup doesn't block the pipeline.
+        run: |
+          pip install pip-audit
+          set +e
+          pip-audit
+          code=$?
+          set -e
+          case "$code" in
+            0)
+              echo "pip-audit: no known vulnerabilities found."
+              ;;
+            1)
+              echo "::error::pip-audit found known vulnerabilities in installed dependencies."
+              exit 1
+              ;;
+            *)
+              echo "::warning::pip-audit exited with code $code (infra/network error, not a vulnerability finding); not failing the job."
+              ;;
+          esac
+
+  php-lint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up PHP
+        # The SHA is the one symfony/symfony's own workflows pin for 2.37.2; it
+        # was copied from a local checkout, not verified against the release
+        # page from this machine.
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        with:
+          # php/README.md verifies the collector against PHP 8.4.
+          php-version: "8.4"
+          coverage: none
+          tools: none
+
+      - name: php -l — syntax-check the PHPStan collector
+        # The Python suite only exercises php/ through PHPStan, which CI does
+        # not have (see stage-tests.yml), so this is the one check that runs
+        # against the PHP files on every push.
+        run: |
+          set -euo pipefail
+          find php/src -name '*.php' -print0 | xargs -0 -n1 php -l
+          php -l php/autoload.php

graphify_php-0.0.5/.github/workflows/stage-tests.yml

@@ -0,0 +1,65 @@
+name: stage-tests
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+          cache: "pip"
+
+      - name: Install graphify-php with lint extras
+        run: pip install -e ".[lint]"
+
+      - name: ruff — lint
+        run: ruff check .
+
+      - name: ruff — format check
+        run: ruff format --check .
+
+  test:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      # One Python version failing must not hide the state of the others.
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: "pip"
+
+      - name: Install graphify-php with test extras
+        # graphifyy brings tree-sitter and tree-sitter-php with it; without
+        # them syntax/nodes.py sets the parser modules to None and the
+        # tree-sitter tests fail rather than skip.
+        run: pip install -e ".[test]"
+
+      - name: Run the test suite
+        # Two files skip themselves here because GRAPHIFY_PHP_REFERENCE_PROJECT
+        # is unset: tests/test_phpstan_integration.py needs
+        # <project>/vendor/bin/phpstan plus php on PATH, and
+        # tests/test_container_integration.py needs that project's compiled
+        # container at <project>/var/cache/dev/App_KernelDevDebugContainer.xml.
+        # Running them in CI would need a checked-out Symfony project with a
+        # composer-installed PHPStan to point the variable at.
+        run: python -m pytest -rs

graphify_php-0.0.5/.gitignore

@@ -0,0 +1,17 @@
+__pycache__/
+*.py[cod]
+.pytest_cache/
+*.egg-info/
+build/
+dist/
+
+# Written by the resolver during a build and read by the wrapper's publish gate.
+# It is per-build state, not source: committing it would let yesterday's record
+# satisfy today's gate, which is the failure the gate exists to catch.
+.graphify-php-status.json
+php-call-graph.jsonl
+graphify-out
+graphify-out/
+docs/kb
+.serena
+CLAUDE.md

graphify_php-0.0.5/.gitleaks.toml

@@ -0,0 +1,14 @@
+# Keeps gitleaks' default rule set and allowlists the two files that plant fake
+# credentials on purpose: eval/fixtures/secrets.php and eval/canaries.py (see
+# .trufflehog-exclude.txt for what they hold and why). Allowlisting by path
+# rather than by .gitleaksignore fingerprint, because a fingerprint names one
+# commit and one line, and every edit to those files would mint a new one.
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "Planted CANARY values that tests/test_eval_canaries.py checks never leak"
+paths = [
+  '''^eval/fixtures/secrets\.php$''',
+  '''^eval/canaries\.py$''',
+]

graphify_php-0.0.5/.graphifyignore

@@ -0,0 +1,29 @@
+.idea/
+.claude/
+.github/
+.git/
+.cache/
+.pytest_cache/
+.serena/
+
+docs/
+eval/fixtures/
+build/
+dist/
+
+graphify-out
+graphify-out/
+
+*.png
+*.jpg
+*.jpeg
+*.gif
+*.svg
+*.generated.py
+*.min.js
+*.pem
+.env
+.env.*
+.npmrc
+auth.json
+LICENSE

graphify_php-0.0.5/.trufflehog-exclude.txt

@@ -0,0 +1,19 @@
+# Paths the pull-request trufflehog scan must not read. One Go regex per line,
+# matched against the file path relative to the repository root. Only the
+# pull-request scan uses this file; the full-history scan reports verified
+# results from every path, these two included.
+#
+# eval/fixtures/secrets.php plants fake credentials — an API token constant, a
+# DSN with an inline password, an environment-variable fallback and an
+# attribute argument — and eval/canaries.py lists the same values so that
+# tests/test_eval_canaries.py can prove none of them ever reaches a graph, a
+# status record or a log. Every value carries the marker CANARY, points at a
+# host that does not exist and opens nothing. Without this exclusion trufflehog
+# reports them as unknown-class results and fails the job on a repository that
+# leaks nothing. The values are deliberately not repeated here, so that
+# excluding them does not turn this file into the next finding.
+#
+# Only these two paths are excluded, and only for the unknown class. Every
+# other file in a pull request keeps both the verified and the unknown class.
+(^|/)eval/fixtures/secrets\.php$
+(^|/)eval/canaries\.py$