Version 5.0

.editorconfig

@@ -5,7 +5,7 @@ end_of_line = lf
 insert_final_newline = true
 trim_trailing_whitespace = true
 
-[*.{json,yaml,yml,tf}]
+[*.{json,yaml,neon,yml,tf}]
 indent_size = 2
 
 [*.php]

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,11 +1,25 @@
-<!-- If no issue remove this section         -->
+<!-- REMOVE THIS PART! -->
+### 💡 Read our [guidelines](https://github.com/kununu/code-tools/blob/main/CONTRIBUTING.md#pull-requests) before opening the PR! 💡
+<!-- --------------------------------------- -->
+
+<!-- If no JIRA issue remove this section -->
 ### JIRA issue
-[KUNSOMETHING-NNNN](https://new-work.atlassian.net/browse/KUNSOMETHING-NNNN)
+
+[KUNSOMETHING-NNNN](https://kununu-team.atlassian.net/browse/KUNSOMETHING-NNNN)
+<!-- If applicable to GitHub bug/enhancement issue(s) use this section to add link(s), otherwise remove it -->
+## Issues
+
+- https://github.com/kununu/code-tools/issues/NNN
+
 <!-- --------------------------------------- -->
+<!-- Describe what you are trying to achieve with this PR -->
 # Description
 
-The objective of this PR is to...
+The objective of this PR is to ...
 
-<!-- If applicable (e.g. describing commands, etc.) use this section, otherwise remove it -->
+<!--
+Add more details on your implementation.
+When listing the changes, lead each item with the area/file it affects and nest the
+explanation beneath it (sub-bullets). Do not bury it in one long inline sentence.
+-->
 ## Details
-<!-- --------------------------------------- -->

.github/dependabot.yml

@@ -1,7 +1,7 @@
 version: 2
 updates:
   - package-ecosystem: "composer"
-    directory: "/services"
+    directory: "/"
     schedule:
       interval: "weekly"
       day: "saturday"
@@ -10,6 +10,16 @@ updates:
     # Disable automatic rebasing to prevent overloading our CICD system
     rebase-strategy: "disabled"
     versioning-strategy: auto
-    # By default Dependabot has a limit of the number of open PR for version updates
+    # By default, Dependabot has a limit of the number of open PR for version updates
     # and security updates.
     # See other defaults in here: https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates
+  # Keeps the action versions pinned in .github/workflows/ up to date
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "saturday"
+    labels:
+      - "dependencies"
+    # Disable automatic rebasing to prevent overloading our CICD system
+    rebase-strategy: "disabled"

.github/workflows/branch-name-validator.yml

@@ -0,0 +1,41 @@
+name: Branch Name Validator
+
+on:
+  pull_request:
+    types: [ opened, synchronize, reopened ]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Validate Branch Name
+    runs-on: ubuntu-latest
+    # Bots do not follow the naming convention (e.g. dependabot/composer/...)
+    if: github.event.pull_request.user.type != 'Bot'
+
+    steps:
+      - name: Validate Branch Name
+        env:
+          # Never interpolate ${{ }} into the script: branch names are author-controlled
+          BRANCH_NAME: ${{ github.head_ref }}
+          # Keep in sync with the pattern documented in CONTRIBUTING.md
+          PATTERN: '^((KUN[A-Z][A-Z0-9]*-[0-9]+(-[a-z0-9]+)*)|([a-z]{2}[-a-z0-9]*[a-z0-9]))$'
+        run: |
+          if [[ "$BRANCH_NAME" =~ $PATTERN ]]; then
+            echo "✅ Branch name '$BRANCH_NAME' is valid."
+            exit 0
+          fi
+
+          echo "❌ Branch name '$BRANCH_NAME' does not follow the naming convention."
+          echo
+          echo "Expected either:"
+          echo "  - a JIRA issue branch, e.g. KUNSOMETHING-9999 or KUNSOMETHING-9999-my-feature"
+          echo "    (the KUN prefix and issue key stay uppercase, any suffix is kebab case)"
+          echo "  - a meaningful kebab case name of at least three characters, e.g. implement-my-feature"
+          echo
+          echo "Underscores are not allowed, and a name must not start with a digit."
+          echo "See the Branches section in CONTRIBUTING.md for the full rules."
+          echo
+          echo "Pattern: $PATTERN"
+          exit 1

.github/workflows/continuous-integration.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -26,38 +26,46 @@ jobs:
         with:
           php-version: 8.4
           coverage: none
-          tools: composer-dependency-analyser, composer-normalize, composer-require-checker
+          tools: cs2pr
 
       - name: Install Composer Dependencies
-        uses: ramsey/composer-install@v3
+        uses: ramsey/composer-install@v4
         with:
           dependency-versions: "highest"
           composer-options: "--prefer-stable --optimize-autoloader --no-progress --no-interaction"
 
+      - name: Run Composer Audit
+        run: composer audit --abandoned=report
+
       - name: Run Composer Dependency Analyser
-        run: composer-dependency-analyser
+        run: vendor/bin/composer-dependency-analyser
 
       - name: Run Composer Require Checker
-        run: composer-require-checker
+        run: vendor/bin/composer-require-checker
 
       - name: Run Composer Normalize
-        run: composer-normalize --dry-run --indent-size 2 --indent-style space --no-check-lock --no-update-lock
-
-      - name: Run code style sniffer
-        run: vendor/bin/phpcs --standard=phpcs.xml Kununu/ tests/
+        run: composer normalize --dry-run --indent-size 2 --indent-style space --no-check-lock --no-update-lock
 
       - name: Run PHP CS Fixer
-        run: vendor/bin/php-cs-fixer check --using-cache=no --config php-cs-fixer.php
+        run: vendor/bin/php-cs-fixer check --using-cache=no --config php-cs-fixer.php.dist
+
+      - name: Run PHP_CodeSniffer
+        id: php-code-sniffer
+        run: vendor/bin/phpcs --standard=phpcs.xml.dist --report-checkstyle=./phpcs-report.xml --colors src/ tests/
+
+      - name: Show PHP_CodeSniffer results in PR
+        if: ${{ always() && steps.php-code-sniffer.outcome == 'failure' }}
+        run: cs2pr ./phpcs-report.xml
+
+      - name: Run Rector
+        run: vendor/bin/rector process --ansi --dry-run --config rector-ci.php src/ tests/
 
       - name: Run PHPStan
         run: vendor/bin/phpstan analyse
 
       - name: Run Psalm
         run: vendor/bin/psalm --no-cache
 
-      - name: Run Rector
-        run: vendor/bin/rector process --ansi --dry-run --config rector.php Kununu/ tests/
-
   build:
     needs: checks
     name: PHPUnit
@@ -69,8 +77,8 @@ jobs:
           - highest
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - name: Checkout Code
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -81,19 +89,23 @@ jobs:
           coverage: pcov
 
       - name: Install Composer Dependencies
-        uses: ramsey/composer-install@v3
+        uses: ramsey/composer-install@v4
         with:
           dependency-versions: ${{ matrix.dependencies }}
           composer-options: "--prefer-stable --optimize-autoloader --no-progress --no-interaction"
 
       - name: Run PHPUnit
         run: |
-          vendor/bin/phpunit --colors=always --testdox \
+          php -d zend.assertions=1 \
+          vendor/bin/phpunit \
+            --colors=always \
+            --testdox \
+            --testdox-summary \
             --log-junit tests/.results/tests-junit.xml \
             --coverage-clover tests/.results/tests-clover.xml
 
       - name: Upload coverage files
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ github.job }}-8.4-${{ matrix.dependencies }}-coverage
           include-hidden-files: true
@@ -104,11 +116,13 @@ jobs:
     name: SonarCloud Checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout Code
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
-      - uses: actions/download-artifact@v4
+      - name: Download coverage files
+        uses: actions/download-artifact@v8
         with:
           name: build-8.4-highest-coverage
           path: tests/.results/
@@ -120,7 +134,7 @@ jobs:
           sed -i 's@'$GITHUB_WORKSPACE'@/github/workspace/@g' tests-junit.xml
 
       - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@v7.0.0
+        uses: SonarSource/sonarqube-scan-action@v8.1.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.gitignore

@@ -1,12 +1,17 @@
-.idea/
-vendor/
-composer.lock
-composer.phar
-.phpunit.result.cache
-.phpunit.cache
-/tests/.results/
-.DS_Store
 *.local
-
+.DS_Store
 .claude
 .cursor
+.idea/
+.php-cs-fixer.cache
+.phpunit.cache
+.phpunit.result.cache
+/phpcs.xml
+/phpstan.neon
+/phpunit.xml
+/psalm.xml
+/rector.php
+/tests/.results/
+composer.lock
+composer.phar
+vendor/