ci: adopt native Pages reports with template 2.1

[coisa]

Routes Reports through the shared native Pages workflow so API documentation uses the PHP Fast Forward template design system. Pull requests build a preview artifact; pushes to main and manual runs retain their existing entry points. Caller permissions cap the callee at contents: read, with Pages and OIDC writes reserved for its isolated deployment job, and no inherited secrets.

Uses the shared workflow introduced by the merged php-fast-forward/dev-tools#363, now available at .github/workflows/reports-native.yml@main. The callee checks that fast-forward/phpdoc-bootstrap-template is at least 2.1.0, records its installed version and reference, and compares the generated identity assets with the selected template using SHA-256.

Validation: actionlint .github/workflows/reports.yml .github/workflows/tests.yml and git diff --check passed after fetching the explicit main refspec and merging the GitHub-confirmed current base. The diff contains only the Reports caller. Feature-branch Reports builds exercise the shared workflow; the isolated deployment job runs only for main.

[coderabbitai]

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated report automation to run for pushes to the main branch, pull requests, and manual runs.
  • Adjusted automated test status reporting for dependency update changes.
  • Revised access permissions used by report and test automation.

Walkthrough

The reports workflow adds a pull request trigger and changes its reusable workflow call and permissions. The tests workflow changes its permissions and sets a required-status input based on the actor.

Changes

Reports workflow

Layer / File(s)	Summary
Reports workflow triggers and call .github/workflows/reports.yml	The workflow adds a pull request trigger, changes caller permissions, calls reports-native.yml@main, and removes inherited secrets.

Tests workflow

Layer / File(s)	Summary
Tests workflow permissions and input .github/workflows/tests.yml	The workflow changes its permissions and sets publish-required-statuses to false for dependabot[bot] and true for other actors.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

---

Merge Risk: 🔵 Low · up to eda4c

Later Reports runs may use changed upstream workflow code. This warrants awareness but does not currently block merging.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description directly explains the Reports workflow migration, permission changes, template version, and validation performed.
Title check		The title clearly identifies the CI change: adopting native Pages reports with template version 2.1.

---

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{A rabbit reads the workflow lines
New triggers hop across the signs
Read permissions guard the way
Status checks know when to stay
The rabbit thumps, then bounds away}

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T00:15:06.723458Z	eda4c58	New commits
🔒 Security Review	✅ Completed 2026-10-10T00:16:15.316007Z	eda4c58	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4634d96a3f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

🔇 Additional comments (3)

.github/workflows/tests.yml (1)

16-16: 🩺 Stability & Availability

The concern is refuted. .github/workflows/tests.yml triggers only on push and workflow_dispatch; it has no pull_request or pull_request_target trigger. Therefore, fork pull-request runs do not reach this caller, so the proposed status-write failure is not applicable.

.github/workflows/reports.yml (1)

5-6: LGTM!

Also applies to: 11-11

.github/workflows/reports.yml-17-17 (1)

17-17: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

⚠️ Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Pin the reusable workflow to a commit SHA.

@main can resolve to different workflow code on later runs. The caller permits pages: write and id-token: write, so an upstream change can alter code running with those permissions. Pin the reviewed commit SHA and update it deliberately. GitHub identifies a commit SHA as the safest reference for stability and security. (docs.github.com)

Source: Linters/SAST tools

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: bbf5f2ba-2f21-430e-beba-5843b0dd8944

📥 Commits

Reviewing files that changed from the base of the PR and between 627be1c and 4634d96.

📒 Files selected for processing (2)

• .github/workflows/reports.yml
• .github/workflows/tests.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.