diff --git a/.github/workflows/axolotl-compatibility.yml b/.github/workflows/axolotl-compatibility.yml index e19f5f1..5a7fa30 100644 --- a/.github/workflows/axolotl-compatibility.yml +++ b/.github/workflows/axolotl-compatibility.yml @@ -103,7 +103,7 @@ jobs: - name: Build and analyze DevTools-owned example PHAR with the pinned stable builder if: steps.release.outputs.candidate == 'true' id: build - uses: AxolotlBucketLabs/DevTools@559f744a156a9e8e9c845c72ff4ad08e133bdaa7 # v4.0.0 + uses: AxolotlBucketLabs/DevTools@281364d985c8366ac06756c6270489d097561628 # v4.0.1 with: project: examples/HelloShared virions: examples diff --git a/docs/ecosystem.json b/docs/ecosystem.json index c44d82b..194e214 100644 --- a/docs/ecosystem.json +++ b/docs/ecosystem.json @@ -34,9 +34,9 @@ ] }, "devtools": { - "stable_version": "v4.0.0", - "stable_commit": "559f744a156a9e8e9c845c72ff4ad08e133bdaa7", - "reference_policy": "AxolotlBucketLabs repositories use @v4.0.0. External consumers may use @latest or an exact release commit." + "stable_version": "v4.0.1", + "stable_commit": "281364d985c8366ac06756c6270489d097561628", + "reference_policy": "AxolotlBucketLabs repositories use @v4.0.1. External consumers may use @latest or an exact release commit." }, "summary": { "total_repositories": 143, diff --git a/docs/ecosystem.md b/docs/ecosystem.md index f5b2723..da26ea2 100644 --- a/docs/ecosystem.md +++ b/docs/ecosystem.md @@ -2,7 +2,7 @@ This page gives a short human-readable summary of public projects whose default-branch workflows reference DevTools. The complete inventory and its counts are stored in [`ecosystem.json`](ecosystem.json). The data contract is described by [`ecosystem.schema.json`](ecosystem.schema.json). -The stable release represented by this inventory is DevTools `v4.0.0`. Repositories in AxolotlBucketLabs use the `v4.0.0` release. External consumers may use the maintained `@latest` channel or an exact release commit according to their compatibility policy. +The stable release represented by this inventory is DevTools `v4.0.1`. Repositories in AxolotlBucketLabs use the `v4.0.1` release. External consumers may use the maintained `@latest` channel or an exact release commit according to their compatibility policy. ## Inventory diff --git a/docs/github-actions.md b/docs/github-actions.md index eeae303..0ab12fd 100644 --- a/docs/github-actions.md +++ b/docs/github-actions.md @@ -2,7 +2,7 @@ The composite action calls `bin/devtools.php build --json`, using the same builder as the CLI and server command. It accepts `type: plugin` (default) or `type: virion`, verifies the reported PHAR SHA-256 and exposes the actual path from that result. PHPStan and Composer dependency preparation are opt-in for plugin builds. Virion builds use `phpstan: off` because the action's PHPStan helper is plugin-oriented. A successful build verifies packaging. It does not prove an Axolotl-PM runtime boot. -These interfaces are available in the `v4.0.0` release. Most repositories should use the maintained `v4` channel: `AxolotlBucketLabs/DevTools@v4` for the composite action and `AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4` or `build-virion.yml@v4` for reusable workflows. The `latest` channel is also available for repositories that intentionally want every stable release, including future major versions. Use `AxolotlBucketLabs/DevTools@latest` or the corresponding reusable workflow reference. Use `@v4.0.0` when a repository should stay on one release, or a full commit SHA for a strict reproducible pin. The called workflow checks out its builder from the resolved reference using the current job's workflow identity. Installing DevTools does not publish a release. +These interfaces are available in the `v4.0.1` release. Most repositories should use the maintained `v4` channel: `AxolotlBucketLabs/DevTools@v4` for the composite action and `AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4` or `build-virion.yml@v4` for reusable workflows. The `latest` channel is also available for repositories that intentionally want every stable release, including future major versions. Use `AxolotlBucketLabs/DevTools@latest` or the corresponding reusable workflow reference. Use `@v4.0.1` when a repository should stay on one release, or a full commit SHA for a strict reproducible pin. The called workflow checks out its builder from the resolved reference using the current job's workflow identity. Installing DevTools does not publish a release. ## Short build workflow @@ -185,24 +185,24 @@ DevTools moves `latest` only to a validated stable release. It may move from v4 Use an exact release when a repository needs controlled upgrades. ```yaml -uses: AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4.0.0 +uses: AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4.0.1 ``` Use a full commit SHA for strict reproducibility or a supply-chain policy. Resolve the commit behind the reviewed release tag and keep the version in a comment. ```sh -git ls-remote https://github.com/AxolotlBucketLabs/DevTools.git 'refs/tags/v4.0.0^{}' +git ls-remote https://github.com/AxolotlBucketLabs/DevTools.git 'refs/tags/v4.0.1^{}' ``` ```yaml -uses: AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@ # v4.0.0 +uses: AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@ # v4.0.1 ``` The called job reads its own `workflow_sha` and `workflow_repository`, checks out that revision, and verifies the checked-out HEAD and CLI contract before building. The same rule applies to release verification. The workflow contract no longer accepts the removed `devtools-ref` input. Remove it when migrating a v1 caller. GitHub's workflow identity context is available on GitHub.com. These reusable workflows are not supported on GitHub Enterprise Server without that context. ## Migrate from v1 -Update the reusable workflow reference to `@v4` and remove legacy inputs that the current workflow does not declare. Use `@latest` only if the repository intentionally accepts major upgrades. Use `@v4.0.0` or a full SHA when the repository requires a controlled or strict pin. +Update the reusable workflow reference to `@v4` and remove legacy inputs that the current workflow does not declare. Use `@latest` only if the repository intentionally accepts major upgrades. Use `@v4.0.1` or a full SHA when the repository requires a controlled or strict pin. ```diff with: diff --git a/examples/README.md b/examples/README.md index cce4f5b..9c49b7d 100644 --- a/examples/README.md +++ b/examples/README.md @@ -13,7 +13,7 @@ HelloShared and SharedGreeting are dedicated examples maintained by DevTools. Th This example also contains `.github/workflows/build.yml`. Extract the complete examples ZIP into an empty GitHub repository and push it. The public action builds `HelloShared.phar` on every push and pull request, then uploads it to that run's **Artifacts** section. -The bundled workflow uses the `AxolotlBucketLabs/DevTools@v4` action channel. For reusable workflows, use the corresponding `@v4` reference from the main GitHub Actions guide. Replace `@v4` with `@latest` only when the repository intentionally accepts stable major upgrades. Use `@v4.0.0` for a release-pinned workflow or a full commit SHA for strict reproducibility. The called workflow selects its builder from the same reference. The action step performs the build. The following `actions/upload-artifact` step makes the resulting PHAR downloadable. The PHAR is not committed back into the repository. New plugin repositories can use the reusable workflow described in the main guide instead. +The bundled workflow uses the `AxolotlBucketLabs/DevTools@v4` action channel. For reusable workflows, use the corresponding `@v4` reference from the main GitHub Actions guide. Replace `@v4` with `@latest` only when the repository intentionally accepts stable major upgrades. Use `@v4.0.1` for a release-pinned workflow or a full commit SHA for strict reproducibility. The called workflow selects its builder from the same reference. The action step performs the build. The following `actions/upload-artifact` step makes the resulting PHAR downloadable. The PHAR is not committed back into the repository. New plugin repositories can use the reusable workflow described in the main guide instead. The example intentionally omits `phpstan`, so analysis is off. The [GitHub Actions guide](https://github.com/AxolotlBucketLabs/DevTools/blob/v2/docs/github-actions.md) shows how to opt in with an explicitly pinned server source. diff --git a/examples/agent/AGENTS.md b/examples/agent/AGENTS.md index 9dd04fd..926c9a6 100644 --- a/examples/agent/AGENTS.md +++ b/examples/agent/AGENTS.md @@ -2,11 +2,11 @@ ## DevTools PHAR workflow -- For CLI, dependency and release interfaces, read `docs/cli.md`, `docs/dependencies.md`, and `docs/github-actions.md` from the exact DevTools revision used. The references below describe the `v4.0.0` release and its maintained channels. +- For CLI, dependency and release interfaces, read `docs/cli.md`, `docs/dependencies.md`, and `docs/github-actions.md` from the exact DevTools revision used. The references below describe the `v4.0.1` release and its maintained channels. - Use CLI `--json`, check the exit status and `success`, consume the returned artifact path and verify its SHA-256. Report runtime testing and static analysis separately from package validation. - Read `plugin.yml`, `devtools.yml`, Composer metadata, existing workflows, and referenced source before changing the build. -- Use `AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4` by default according to the versioned [GitHub Actions guide](https://github.com/AxolotlBucketLabs/DevTools/blob/v4/docs/github-actions.md). Use `@latest` only when the repository intentionally accepts stable major upgrades. Use `@v4.0.0` for a release-pinned build or the full commit SHA for strict reproducibility. The workflow checks out the builder from its own resolved reference. Use the step-level action when extra setup is required. +- Use `AxolotlBucketLabs/DevTools/.github/workflows/build-plugin.yml@v4` by default according to the versioned [GitHub Actions guide](https://github.com/AxolotlBucketLabs/DevTools/blob/v4/docs/github-actions.md). Use `@latest` only when the repository intentionally accepts stable major upgrades. Use `@v4.0.1` for a release-pinned build or the full commit SHA for strict reproducibility. The workflow checks out the builder from its own resolved reference. Use the step-level action when extra setup is required. - Run the PHAR workflow on `push`, `pull_request`, and `workflow_dispatch` with `contents: read` permission. - The reusable workflow owns the documented Node.js 24 compatible Axolotl-PM PHP setup. Use the step-level setup only when that workflow is selected. - Keep PHPStan off unless this repository explicitly enables it. When enabled, keep the requested level and pin Axolotl-PM source with `axolotl-ref`. Use `phpstan-server` only for additional source paths already checked out by the caller. diff --git a/tests/Validation/RepositoryMetadataTest.php b/tests/Validation/RepositoryMetadataTest.php index f6f4c6d..e1586b3 100644 --- a/tests/Validation/RepositoryMetadataTest.php +++ b/tests/Validation/RepositoryMetadataTest.php @@ -20,7 +20,7 @@ final class RepositoryMetadataTest extends TestCase { private const VERSION = '4.0.1'; - private const COMPATIBILITY_BUILDER_VERSION = '4.0.0'; + private const COMPATIBILITY_BUILDER_VERSION = '4.0.1'; private const PHP_ACTION_COMMIT = 'b8c3f9add4f2ad4a5e2624a1112aba899ee8db0e'; public function test_release_version_is_synchronized() : void