6896: Symfony 8 support, test coverage, CI restructure by turegjorup · Pull Request #27 · itk-dev/openid-connect-bundle

turegjorup · 2026-03-09T12:24:04Z

Ticket

Summary

Add Symfony 8 support to all dependency version constraints
Fix Symfony 8 breaking changes (Configuration node validation, kernel return types)
Increase test coverage from 27% to 100% with new test classes for all untested components
Set phpstan to max level and fix all type safety issues in source code
Upgrade to PHPUnit 12
Update docker compose to itk-version 3.2.4 (networks, COMPOSE_USER, markdownlint/prettier services)
Align all GitHub workflows with itkdev-docker templates
- Split monolithic pr.yaml into changelog.yaml, composer.yaml, php.yaml
- Add markdown.yaml and yaml.yaml workflows
- Use COMPOSE_USER: runner env and docker network create frontend steps
- Use docker compose services (phpfpm, phpfpm84, phpfpm85) instead of shivammathur/setup-php
- Add composer normalize and composer audit checks
Replace linting config with itkdev-docker templates
- Switch .php-cs-fixer.dist.php to standard @Symfony rules
- Replace .markdownlint.json with .markdownlint.jsonc and add .markdownlintignore
- Add .prettierrc.yaml for YAML formatting
- Remove package.json (markdownlint now via docker)
Remove unused dev dependencies (escapestudios/symfony2-coding-standard, kubawerlos/php-cs-fixer-custom-fixers)
Apply @Symfony coding standards to PHP files
Fix markdown and YAML formatting per linter rules
Add Taskfile.yml for local development (setup, lint, analyze, test, test:matrix, pr:actions)
Update README development section to document Taskfile workflow
Update README "Symfony Native OIDC Support" note: OIDC discovery shipped in 7.3, multiple providers now
supported natively, clarify this bundle is still needed for authorization code flow (browser login)

Test plan

Verify all CI workflows pass (changelog, composer, markdown, yaml, PHP coding standards, PHPStan, unit tests)
Verify unit tests pass on PHP 8.3, 8.4, and 8.5 (prefer-lowest and prefer-stable)
Verify bundle works with Symfony 6.4, 7.x, and 8.x applications
Run task pr:actions locally to validate full CI suite

🤖 Generated with Claude Code

Add ^8.0 version constraint to all symfony/* packages in require and require-dev. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add trailing commas to multiline constructor parameters as required by php-cs-fixer. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Remove all ignoreErrors and set level to max - Add PHPDoc array shapes for config parameters - Add is_string() guards for mixed values from cache and session - Add UserInterface generic to UserProviderInterface - Fix return type annotation on validateClaims() Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add new test classes: - CliLoginTokenAuthenticatorTest - OpenIdConfigurationProviderManagerTest - UserLoginCommandTest - ConfigurationTest - ItkDevOpenIdConnectExtensionTest - TestInvalidArgumentException helper Update existing tests: - Add empty nonce and missing code tests to OpenIdLoginAuthenticatorTest - Add cache exception path tests to CliLoginHelperTest - Add bundle method tests to ItkDevOpenIdConnectBundleTest - Use createStub() instead of createMock() where no expectations are set Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Update phpunit/phpunit constraint from ^11.0 to ^12.0 - Update phpunit.xml.dist schema to 12.5 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

codecov-commenter · 2026-03-09T12:26:39Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (de3ac74) to head (7e79e7e).
⚠️ Report is 4 commits behind head on develop.

Additional details and impacted files

@@               Coverage Diff               @@
##             develop       #27       +/-   ##
===============================================
+ Coverage      74.50%   100.00%   +25.49%     
- Complexity        54        56        +2     
===============================================
  Files              9         9               
  Lines            255       248        -7     
===============================================
+ Hits             190       248       +58     
+ Misses            65         0       -65

Flag	Coverage Δ
unittests	`100.00% <100.00%> (+25.49%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Split monolithic pr.yaml into separate workflow files following itk-dev/devops_itkdev-docker template pattern. Use docker compose services instead of shivammathur/setup-php. Add PHP 8.4 and 8.5 containers for testing. Fix Symfony 8 breaking changes in Configuration and test kernel. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

This is a library without a committed composer.lock, so composer install fails trying to create one with permission errors inside the docker container. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Run composer update as the host user to allow writing composer.lock in the mounted volume. Subsequent commands can run as the default container user since vendor/ and composer.lock are now writable. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Normalize composer.json version constraints (| to ||). Run all docker compose commands as host user to avoid file permission issues. Add XDEBUG_MODE=coverage for unit test coverage. Remove hardcoded build/ report paths from phpunit.xml.dist. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add prefer-stable and prefer-lowest matrix to unit tests and composer validate jobs. Rename all job names to match the required check names from branch protection rules. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Use template-style naming: no custom name on changelog job, consistent format for matrix job names. Update branch protection required checks to match. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add networks, COMPOSE_USER, extra_hosts, and markdownlint/prettier tooling services matching the itkdev-docker template. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace .markdownlint.json with .markdownlint.jsonc, add .markdownlintignore, .prettierrc.yaml, and simplify .php-cs-fixer.dist.php to standard @symfony rules. Remove package.json (markdownlint now via docker). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add COMPOSE_USER env, docker network creation steps, devops header comments. Add markdown.yaml and yaml.yaml workflows. Use composer install instead of update for deterministic CI builds. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove escapestudios/symfony2-coding-standard and kubawerlos/php-cs-fixer-custom-fixers. Rename composer scripts to match itkdev conventions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

@inheritdoc

Remove redundant {@inheritdoc} tags and superfluous phpdoc param annotations as required by the standard @symfony php-cs-fixer rules. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add blank lines around headings/lists in CHANGELOG.md, fix long line and heading level in README.md, normalize YAML quoting via prettier. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Provides setup, lint, analyze, test, and test:matrix tasks matching the CI workflow. Includes pr:actions to run all checks locally. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace manual docker compose commands with task-based workflow. Document setup, lint, analyze, test, test:matrix, and pr:actions tasks. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

OIDC discovery shipped in Symfony 7.3 and multiple providers are now supported natively. Clarify that Symfony's OIDC support covers bearer token validation only, not the authorization code flow (browser login) that this bundle provides. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/Command/UserLoginCommand.php

jekuaitk · 2026-03-10T11:27:00Z

src/DependencyInjection/Configuration.php

                    ->children()
                        ->scalarNode('cache_pool')
                            ->info('Method for caching')
-                            ->defaultValue('cache.app')


Why do we remove this default?

Newer version of Symfony does not allow defaults for required values

jekuaitk · 2026-03-10T11:28:46Z

src/DependencyInjection/ItkDevOpenIdConnectExtension.php

        $loader->load('services.yaml');

        $configuration = new Configuration();
+        /** @var array{cache_options: array{cache_pool: string}, cli_login_options: array{route: string}, user_provider: string|null, openid_providers: array<string, array{options: array<string, mixed>}>} $config */


This is not very readable, but i suppose this is generated by our coding standards?

It's for phpstan more than us. I'm no fan of the using array's like this, exactly because it can't be type safe except through obscure docblocks. But that's Symfony. They went back ta arrays recently: https://symfony.com/blog/new-in-symfony-7-4-better-php-configuration eventhough some of the community objected symfony/symfony#62092

Taskfile.yml

tests/ItkDevOpenIdConnectBundleTest.php

jekuaitk · 2026-03-10T12:56:48Z

src/Security/OpenIdConfigurationProviderManager.php

+     * @param array{
+     *     default_providers_options: array<string, mixed>,
+     *     providers: array<string, array{
+     *         metadata_url: string,
+     *         client_id: string,
+     *         client_secret: string,
+     *         redirect_uri?: string,
+     *         redirect_route?: string,
+     *         redirect_route_parameters?: array<string, string>,
+     *         leeway?: int,
+     *         allow_http?: bool
+     *     }>
+     * } $config


We've never added such in depth parameter docs before. Why now and which tool does it come from?

I wanted to get to max level in phpstan, that requires better documentation of array shapes. This matches what is defined in ItkDev\OpenIdConnectBundle\DependencyInjection\Configuration

@param

- Remove lone @param doc on UserLoginCommand constructor (inconsistent) - Remove @codeCoverageIgnore and unreachable is_string guard - Restore cache_pool defaultValue('cache.app') in Configuration - Remove verbose @param array shape on OpenIdConfigurationProviderManager - Remove @var type annotation on ItkDevOpenIdConnectExtension - Revert PHPStan from max to level 8 with targeted ignoreErrors - Remove overly deep testGetContainerExtension and testGetPath tests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Each PHP version × dependency set combination gets its own vendor volume, eliminating cross-contamination between lowest/stable runs. A shared composer-cache volume avoids re-downloading packages. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Derive the service name from PHP version and DEPS variables instead of a manual mapping. Cache the resolved composer.lock inside each vendor volume so repeat runs use composer install (no re-resolution). Add test:matrix:reset to wipe volumes and force a fresh resolve. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Remove redundant isRequired() on cache_pool (already has defaultValue). Replace verbose always/then validation with ifTrue/thenInvalid. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Composer validation/audit is not linting — move it out of the lint aggregate and into pr:actions as a standalone step. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

@var

- Fix @var annotation syntax for PHPStan (/* → /**) - Add phpfpm84 and phpfpm85 docker compose services for CI - Fix YAML formatting per prettier Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

jekuaitk · 2026-03-20T09:20:02Z

Taskfile.yml

+  test:run:
+    desc: "Run tests for a PHP version and dependency set (e.g. task test:run PHP=8.4 DEPS=lowest)"
+    vars:
+      PHP: '{{.PHP | default "8.3"}}'


task test:run will fail here. The default "8.3" will never kick in as the global PHP definition from line 7 will just be used.

Good catch 👍 Fixed 😄

…rs to prevent them from starting in default dev setup

…HP parameter The global PHP (docker compose exec command) was shadowing the test:run task's PHP parameter, so task test:run always used the global value and the default "8.3" never kicked in. Renaming to PHP_EXEC fixes task test:run and task test:run PHP=8.4 DEPS=lowest.

turegjorup and others added 7 commits March 9, 2026 12:49

6896: Add Symfony 8 support

3ae8ed1

Add ^8.0 version constraint to all symfony/* packages in require and require-dev. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

6896: Apply code style fixes

ec784df

Add trailing commas to multiline constructor parameters as required by php-cs-fixer. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

6896: Upgrade to PHPUnit 12

8f86075

- Update phpunit/phpunit constraint from ^11.0 to ^12.0 - Update phpunit.xml.dist schema to 12.5 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

6896: Update Changelog

6385d9f

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Merge branch 'develop' into feature/symfony-8

04477e4

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

turegjorup changed the title ~~6896: Symfony 8 support, test coverage, and tooling upgrades~~ 6896: Symfony 8 support, test coverage, CI restructure Mar 9, 2026

turegjorup and others added 15 commits March 9, 2026 13:46

6896: Use composer update in CI workflows

e4421b3

This is a library without a committed composer.lock, so composer install fails trying to create one with permission errors inside the docker container. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

6896: Limit composer validate to PHP 8.3 only

f8f88aa

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

6896: Align workflow naming with itkdev templates

c893a72

Use template-style naming: no custom name on changelog job, consistent format for matrix job names. Update branch protection required checks to match. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

6896: Update docker compose to itk-version 3.2.4

26b054c

Add networks, COMPOSE_USER, extra_hosts, and markdownlint/prettier tooling services matching the itkdev-docker template. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

6896: Remove unused coding standard deps and update scripts

aa2ba6d

Remove escapestudios/symfony2-coding-standard and kubawerlos/php-cs-fixer-custom-fixers. Rename composer scripts to match itkdev conventions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

6896: Apply @symfony coding standards to PHP files

a920427

Remove redundant {@inheritdoc} tags and superfluous phpdoc param annotations as required by the standard @symfony php-cs-fixer rules. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

6896: Fix markdown and YAML formatting per linter rules

1a5017c

Add blank lines around headings/lists in CHANGELOG.md, fix long line and heading level in README.md, normalize YAML quoting via prettier. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

6896: Add Taskfile for local development tasks

0db4c23

Provides setup, lint, analyze, test, and test:matrix tasks matching the CI workflow. Includes pr:actions to run all checks locally. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

6896: Update README development section for Taskfile and test matrix

37ecbde

Replace manual docker compose commands with task-based workflow. Document setup, lint, analyze, test, test:matrix, and pr:actions tasks. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

turegjorup self-assigned this Mar 10, 2026

turegjorup requested a review from jekuaitk March 10, 2026 10:08

jekuaitk requested changes Mar 10, 2026

View reviewed changes

turegjorup and others added 2 commits March 12, 2026 09:26

6896: Reset phpstan to max, refactor type checks

4123d52

turegjorup and others added 6 commits March 16, 2026 13:22

6896: Simplify Configuration tree builder

d67a7b7

Remove redundant isRequired() on cache_pool (already has defaultValue). Replace verbose always/then validation with ifTrue/thenInvalid. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

6896: Rename lint:composer to composer:check

160becf

Composer validation/audit is not linting — move it out of the lint aggregate and into pr:actions as a standalone step. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

6896: Fix CI failures — PHPStan, missing services, YAML formatting

40f2877

- Fix @var annotation syntax for PHPStan (/* → /**) - Add phpfpm84 and phpfpm85 docker compose services for CI - Fix YAML formatting per prettier Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

6896: Matrix services extend their base PHP version service

3e030bc

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

turegjorup requested a review from jekuaitk March 16, 2026 12:52

6896: Move composer:check above lint, rename analyze to analyze:php

5064e34

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

turegjorup mentioned this pull request Mar 19, 2026

Feature/6654 symfony upgrade itk-dev/devops_itksites#63

Merged

4 tasks

jekuaitk requested changes Mar 20, 2026

View reviewed changes

turegjorup added 2 commits March 20, 2026 11:27

6896: Update docker compose with "CI" profile for extra test containe…

67246c6

…rs to prevent them from starting in default dev setup

turegjorup requested a review from jekuaitk March 20, 2026 10:29

jekuaitk approved these changes Mar 20, 2026

View reviewed changes

turegjorup merged commit 2656790 into develop Mar 20, 2026
15 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

6896: Symfony 8 support, test coverage, CI restructure#27

6896: Symfony 8 support, test coverage, CI restructure#27
turegjorup merged 34 commits intodevelopfrom
feature/symfony-8

turegjorup commented Mar 9, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Mar 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

jekuaitk Mar 10, 2026

Uh oh!

turegjorup Mar 16, 2026

Uh oh!

jekuaitk Mar 10, 2026

Uh oh!

turegjorup Mar 18, 2026

Uh oh!

Uh oh!

Uh oh!

jekuaitk Mar 10, 2026 •

edited

Loading

Uh oh!

turegjorup Mar 16, 2026

Uh oh!

jekuaitk Mar 20, 2026

Uh oh!

turegjorup Mar 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

turegjorup commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Ticket

Summary

Test plan

Uh oh!

codecov-commenter commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

jekuaitk Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

turegjorup Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

jekuaitk Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

turegjorup Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

jekuaitk Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

turegjorup Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

jekuaitk Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

turegjorup Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

turegjorup commented Mar 9, 2026 •

edited

Loading

codecov-commenter commented Mar 9, 2026 •

edited

Loading

jekuaitk Mar 10, 2026 •

edited

Loading