Add automated quality and dependency controls

Author: Tsvetan Stoychev

.github/dependabot.yml

@@ -0,0 +1,20 @@
+version: 2
+
+updates:
+  - package-ecosystem: composer
+    directory: /plugins/basicrum
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:00"
+      timezone: Europe/Berlin
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:30"
+      timezone: Europe/Berlin
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -8,7 +8,41 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
+  quality:
+    name: Static and dependency analysis
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.2'
+          tools: composer:v2
+          coverage: none
+
+      - name: Validate Composer metadata
+        working-directory: plugins/basicrum
+        run: composer validate --strict
+
+      - name: Audit locked dependencies
+        working-directory: plugins/basicrum
+        run: composer audit --locked
+
+      - name: Install dependencies
+        working-directory: plugins/basicrum
+        run: composer install --no-interaction --prefer-dist
+
+      - name: Static analysis
+        working-directory: plugins/basicrum
+        run: composer analyse
+
   translations:
     name: Translation catalogs
     runs-on: ubuntu-latest
@@ -128,6 +162,7 @@ jobs:
     name: Release ZIP smoke test
     runs-on: ubuntu-latest
     needs:
+      - quality
       - translations
       - unit
       - integration

.github/workflows/prerelease.yml

@@ -4,6 +4,9 @@ on:
   release:
     types: [prereleased]
 
+permissions:
+  contents: write
+
 jobs:
   build:
     name: Build Plugin Artifact

.github/workflows/release.yml

@@ -4,6 +4,9 @@ on:
   release:
     types: [released]
 
+permissions:
+  contents: write
+
 jobs:
   build:
     name: Build Release Artifact

AGENTS.md

@@ -35,6 +35,10 @@ Run from the repository root:
 ```bash
 make composer-install
 make lint-php
+make lint
+make analyse
+make composer-validate
+make composer-audit
 make unit
 make integration-setup
 make integration

Makefile

@@ -12,7 +12,7 @@ TEST_DB_PASS = root
 TEST_DB_HOST = db
 WP_TEST_VERSION ?= latest
 
-.PHONY: help build up down restart logs shell composer-install wp-install lint lint-fix lint-php translations integration-setup integration test package package-verify package-smoke clean
+.PHONY: help build up down restart logs shell composer-install wp-install lint lint-fix lint-php analyse composer-validate composer-audit translations integration-setup integration test package package-verify package-smoke clean
 
 help:
 	@echo "Targets:"
@@ -27,6 +27,9 @@ help:
 	@echo "  lint-php           Run PHP syntax lint"
 	@echo "  lint               Run PHPCS"
 	@echo "  lint-fix           Run PHPCBF"
+	@echo "  analyse            Run PHPStan static analysis"
+	@echo "  composer-validate  Validate Composer metadata and lock file"
+	@echo "  composer-audit     Audit locked Composer dependencies"
 	@echo "  translations       Update POT, PO, and MO translation catalogs"
 	@echo "  unit               Run unit tests"
 	@echo "  integration-setup  Install WordPress test suite inside containers"
@@ -70,6 +73,15 @@ lint:
 lint-fix:
 	$(COMPOSE) run --rm -w $(PLUGIN_WORKDIR) $(PHP_SERVICE) composer lint:fix
 
+analyse:
+	$(COMPOSE) run --rm -w $(PLUGIN_WORKDIR) $(PHP_SERVICE) composer analyse
+
+composer-validate:
+	$(COMPOSE) run --rm -w $(PLUGIN_WORKDIR) $(PHP_SERVICE) composer validate --strict
+
+composer-audit:
+	$(COMPOSE) run --rm -w $(PLUGIN_WORKDIR) $(PHP_SERVICE) composer audit --locked
+
 translations:
 	$(COMPOSE) run --rm --no-deps --user "$$(id -u):$$(id -g)" -e HOME=/tmp -w $(WPCLI_PLUGIN_WORKDIR) $(WPCLI_SERVICE) sh /tools/update-translations.sh .
 

README.md

@@ -22,6 +22,9 @@ make unit
 make integration-setup
 make integration
 make lint
+make analyse
+make composer-validate
+make composer-audit
 make translations
 make package
 make package-smoke
@@ -66,3 +69,16 @@ WordPress logs contain PHP warnings or fatal errors.
 CI runs this same build and smoke-test path and retains both the ZIP and its
 SHA-256 checksum as workflow artifacts. Release and pre-release workflows attach
 both files to the GitHub release.
+
+## Automated Quality Controls
+
+`make analyse` runs PHPStan level 5 with WordPress-aware stubs. The enforced
+configuration is stored in `plugins/basicrum/phpstan.neon.dist`.
+
+`make composer-validate` checks Composer metadata and lock-file consistency in
+strict mode. `make composer-audit` checks the complete lock file against current
+security advisories. CI runs all three checks on every push and pull request.
+
+Dependabot checks Composer dependencies and GitHub Actions weekly. CI workflows
+use a read-only `GITHUB_TOKEN`; release and pre-release workflows receive only
+the `contents: write` permission required to attach release assets.

checklist.md

@@ -101,19 +101,19 @@ Acceptance criteria:
 
 ## 6. Add stronger automated analysis and dependency controls
 
-- [ ] Add PHPStan with WordPress stubs and select an initial enforced level.
-- [ ] Add `composer validate --strict` to CI.
-- [ ] Add `composer audit --locked` to CI.
-- [ ] Configure dependency update automation for Composer and GitHub Actions.
-- [ ] Set explicit minimal `GITHUB_TOKEN` permissions in every workflow.
-- [ ] Give release workflows only the additional permissions required to upload
+- [x] Add PHPStan with WordPress stubs and select an initial enforced level.
+- [x] Add `composer validate --strict` to CI.
+- [x] Add `composer audit --locked` to CI.
+- [x] Configure dependency update automation for Composer and GitHub Actions.
+- [x] Set explicit minimal `GITHUB_TOKEN` permissions in every workflow.
+- [x] Give release workflows only the additional permissions required to upload
   assets.
 - [ ] Pin third-party GitHub Actions to immutable commit SHAs.
 - [ ] Document how pinned actions are reviewed and updated.
 
 Acceptance criteria:
 
-- [ ] Type issues, invalid package metadata, known dependency advisories, and
+- [x] Type issues, invalid package metadata, known dependency advisories, and
   excessive workflow permissions are checked automatically.
 
 ## 7. Make JavaScript and translation artifacts reproducible
@@ -153,8 +153,8 @@ Acceptance criteria:
 - [ ] PHP unit tests pass across the supported PHP matrix.
 - [ ] WordPress integration tests pass across the supported WordPress matrix.
 - [ ] JavaScript tests pass.
-- [ ] Static analysis passes.
-- [ ] Composer validation and audit pass.
+- [x] Static analysis passes.
+- [x] Composer validation and audit pass.
 - [ ] Generated asset checks pass.
 - [x] The packaged ZIP smoke test passes.
 - [ ] Version and repository convention checks pass.

plugins/basicrum/composer.json

@@ -14,11 +14,13 @@
         "composer/installers": "^1.0 || ^2.0"
     },
     "require-dev": {
+        "php-parallel-lint/php-parallel-lint": "^1.3",
+        "phpcompatibility/phpcompatibility-wp": "^2.1",
+        "phpstan/phpstan": "^2.1",
         "squizlabs/php_codesniffer": "^3.7",
+        "szepeviktor/phpstan-wordpress": "^2.0",
         "wp-coding-standards/wpcs": "^3.0",
-        "phpcompatibility/phpcompatibility-wp": "^2.1",
-        "yoast/wp-test-utils": "^1.2",
-        "php-parallel-lint/php-parallel-lint": "^1.3"
+        "yoast/wp-test-utils": "^1.2"
     },
     "autoload": {
         "psr-4": {
@@ -31,6 +33,7 @@
         }
     },
     "scripts": {
+        "analyse": "phpstan analyse --configuration=phpstan.neon.dist --no-progress --memory-limit=512M",
         "lint": "phpcs --standard=phpcs.ruleset.xml",
         "lint:fix": "phpcbf --standard=phpcs.ruleset.xml",
         "lint:php": "parallel-lint --exclude vendor --exclude node_modules .",