From f77719f5bd2916dd66aa287ac011fd90a157c074 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Felipe=20Say=C3=A3o=20Lobato=20Abreu?= Date: Fri, 9 Oct 2026 20:44:33 -0300 Subject: [PATCH 1/4] ci: adopt native Pages reports with template 2.1 --- .github/workflows/reports.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/reports.yml b/.github/workflows/reports.yml index 993a891..1fd230f 100644 --- a/.github/workflows/reports.yml +++ b/.github/workflows/reports.yml @@ -2,16 +2,16 @@ name: "Fast Forward Reports" on: push: - branches: - - main + branches: [main] + pull_request: workflow_dispatch: +# Caller permissions cap the callee; only its isolated deploy job writes Pages. permissions: - contents: write + contents: read pages: write id-token: write jobs: reports: - uses: php-fast-forward/dev-tools/.github/workflows/reports.yml@main - secrets: inherit + uses: php-fast-forward/dev-tools/.github/workflows/reports-native.yml@main From 98fa3c67a99eceb0354135a7ecc7050fe3db88c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Felipe=20Say=C3=A3o=20Lobato=20Abreu?= Date: Fri, 9 Oct 2026 20:58:38 -0300 Subject: [PATCH 2/4] ci: supply isolated test publisher permissions --- .github/workflows/tests.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 83ea015..92999fa 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -5,11 +5,13 @@ on: workflow_dispatch: permissions: - contents: write - pages: write - id-token: write + contents: read + actions: read + statuses: write jobs: tests: uses: php-fast-forward/dev-tools/.github/workflows/tests.yml@main + with: + publish-required-statuses: ${{ github.actor != 'dependabot[bot]' }} secrets: inherit From 1c01533d44bd020cd9676eadbc80d4432d5c145a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Felipe=20Say=C3=A3o=20Lobato=20Abreu?= Date: Fri, 9 Oct 2026 21:49:17 -0300 Subject: [PATCH 3/4] fix(ci): correct worker coverage metadata and portable errno lookup --- .github/workflows/tests.yml | 2 +- src/Worker/Worker.php | 3 +-- tests/Manager/ForkManagerTest.php | 10 +++++++++- tests/Worker/WorkerStateTest.php | 4 +++- tests/Worker/WorkerTest.php | 6 +++++- 5 files changed, 19 insertions(+), 6 deletions(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 92999fa..450fa4d 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -5,6 +5,7 @@ on: workflow_dispatch: permissions: + # Ceiling for the checkout-free status publisher; test jobs retain read-only tokens. contents: read actions: read statuses: write @@ -14,4 +15,3 @@ jobs: uses: php-fast-forward/dev-tools/.github/workflows/tests.yml@main with: publish-required-statuses: ${{ github.actor != 'dependabot[bot]' }} - secrets: inherit diff --git a/src/Worker/Worker.php b/src/Worker/Worker.php index ade710a..663c4f2 100644 --- a/src/Worker/Worker.php +++ b/src/Worker/Worker.php @@ -25,7 +25,6 @@ use FastForward\Fork\Signal\Signal; use Psr\Log\LoggerInterface; use Throwable; - use function error_reporting; use function getmypid; use function max; @@ -446,6 +445,6 @@ private function isNoChildError(int $error): bool */ private function isNoSuchProcessError(int $error): bool { - return (\defined('POSIX_ESRCH') ? \POSIX_ESRCH : self::NO_SUCH_PROCESS_ERROR) === $error; + return (\defined('POSIX_ESRCH') ? \constant('POSIX_ESRCH') : self::NO_SUCH_PROCESS_ERROR) === $error; } } diff --git a/tests/Manager/ForkManagerTest.php b/tests/Manager/ForkManagerTest.php index 9f912e6..1b71f75 100644 --- a/tests/Manager/ForkManagerTest.php +++ b/tests/Manager/ForkManagerTest.php @@ -30,10 +30,12 @@ use FastForward\Fork\Worker\Worker; use FastForward\Fork\Worker\WorkerInterface; use FastForward\Fork\Worker\WorkerState; +use FastForward\Fork\Worker\WorkerGroup; +use FastForward\Fork\Worker\WorkerOutputTransport; use PHPUnit\Framework\Attributes\CoversClass; +use PHPUnit\Framework\Attributes\UsesClass; use PHPUnit\Framework\Attributes\Test; use PHPUnit\Framework\TestCase; - use function getmypid; use function pcntl_fork; use function posix_getpid; @@ -41,6 +43,12 @@ use function usleep; #[CoversClass(ForkManager::class)] +#[UsesClass(InvalidArgumentException::class)] +#[UsesClass(LogicException::class)] +#[UsesClass(Worker::class)] +#[UsesClass(WorkerGroup::class)] +#[UsesClass(WorkerState::class)] +#[UsesClass(WorkerOutputTransport::class)] final class ForkManagerTest extends TestCase { use ReflectsNonPublicMembers; diff --git a/tests/Worker/WorkerStateTest.php b/tests/Worker/WorkerStateTest.php index 900603e..63d5d13 100644 --- a/tests/Worker/WorkerStateTest.php +++ b/tests/Worker/WorkerStateTest.php @@ -22,16 +22,18 @@ use FastForward\Fork\Tests\Support\ReflectsNonPublicMembers; use FastForward\Fork\Tests\Support\SpyLogger; use FastForward\Fork\Worker\WorkerState; +use FastForward\Fork\Worker\WorkerOutputTransport; use PHPUnit\Framework\Attributes\CoversClass; +use PHPUnit\Framework\Attributes\UsesClass; use PHPUnit\Framework\Attributes\Test; use PHPUnit\Framework\TestCase; - use function pcntl_fork; use function pcntl_waitpid; use function posix_kill; use function usleep; #[CoversClass(WorkerState::class)] +#[UsesClass(WorkerOutputTransport::class)] final class WorkerStateTest extends TestCase { use ReflectsNonPublicMembers; diff --git a/tests/Worker/WorkerTest.php b/tests/Worker/WorkerTest.php index 98c578b..afed3e3 100644 --- a/tests/Worker/WorkerTest.php +++ b/tests/Worker/WorkerTest.php @@ -30,14 +30,15 @@ use FastForward\Fork\Worker\WorkerGroupInterface; use FastForward\Fork\Worker\WorkerInterface; use FastForward\Fork\Worker\WorkerState; +use FastForward\Fork\Worker\WorkerOutputTransport; use PHPUnit\Framework\Attributes\CoversClass; +use PHPUnit\Framework\Attributes\UsesClass; use PHPUnit\Framework\Attributes\DataProvider; use PHPUnit\Framework\Attributes\Test; use PHPUnit\Framework\TestCase; use Prophecy\Argument; use Prophecy\PhpUnit\ProphecyTrait; use Psr\Log\LoggerInterface; - use function getmypid; use function pcntl_fork; use function pcntl_waitpid; @@ -46,6 +47,9 @@ use function usleep; #[CoversClass(Worker::class)] +#[UsesClass(LogicException::class)] +#[UsesClass(WorkerState::class)] +#[UsesClass(WorkerOutputTransport::class)] final class WorkerTest extends TestCase { use ProphecyTrait; From 8b83ff5fb1de7738984513f317f7467049c215da Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Felipe=20Say=C3=A3o=20Lobato=20Abreu?= Date: Fri, 9 Oct 2026 21:50:55 -0300 Subject: [PATCH 4/4] docs(ci): explain each reusable workflow permission --- .github/workflows/tests.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 450fa4d..9c844e5 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -5,10 +5,9 @@ on: workflow_dispatch: permissions: - # Ceiling for the checkout-free status publisher; test jobs retain read-only tokens. - contents: read - actions: read - statuses: write + contents: read # Read source; matrix jobs retain read-only tokens. + actions: read # Allow the checkout-free publisher to inspect matrix job results. + statuses: write # Caller ceiling; only isolated callee publishers request this permission. jobs: tests: