Require PHP >=8.1 and migrate tooling from Psalm to PHPStan#43
Merged
Conversation
- Bump the PHP requirement from >=7.4 to >=8.1 - Replace Psalm with PHPStan (level 8, analysing src/ as the old Psalm config did); remove psalm.xml and psalm-baseline.xml - Inline the dev tooling that setono/code-quality-pack used to bundle (PHPStan + extensions, PHPUnit 10, Rector, Infection, ECS via sylius-labs/coding-standard, shipmonk/composer-dependency-analyser) directly into require-dev, and drop roave/security-advisories and setono/code-quality-pack - Add phpstan.neon.dist, rector.php and infection.json.dist; port ecs.php and phpunit.xml.dist to the current config formats - Fix the type issues PHPStan surfaced in src/ (iterable value types, dynamic-property hydration in QuickPayModel) - Make the test suite run on PHPUnit 10: replace the assertion helpers removed in PHPUnit 9 in QuickPayGatewayFactoryTest, and read the QuickPay error body from the response instead of the (now reformatted) HttpException message in CaptureActionTest - Update CI to run on PHP 8.1-8.4 and swap composer-require-checker / composer-unused for shipmonk/composer-dependency-analyser
Two failures surfaced once CI ran on Composer 2.10 (which excludes advisory-affected packages from resolution): - guzzlehttp/guzzle ^6 + php-http/guzzle6-adapter can no longer be installed: every guzzle 6.x release is flagged by security advisories (and guzzle6-adapter is abandoned). Migrate the test HTTP client to guzzle 7 via php-http/guzzle7-adapter; guzzle 7 resolves to a non-advisory version on its own, so no advisory ignores are needed. Add php-http/message for the legacy MessageFactory that Payum's discovery still relies on, and bump guzzlehttp/psr7 to ^2. - The action tests borrow Payum\Core\Tests\GenericActionTest, which is export-ignored from payum/core's dist archive, so a default --prefer-dist install (what CI does) doesn't ship it. Pin payum/core to a source install so the class is present.
…ource Replaces the previous preferred-install=source workaround (which made CI clone payum/core on every job and flaked on the network) with a local copy of the base test class. - Add tests/GenericActionTestCase.php: a trimmed copy of Payum\Core\Tests\GenericActionTest (which payum/core export-ignores from its dist, so it is absent on a --prefer-dist install). Test doubles use Prophecy (phpspec/prophecy-phpunit) instead of PHPUnit's mock builder; the abstract Generic in the data provider is an anonymous subclass since Prophecy cannot run inside a data provider. - ActionTestAbstract now extends our GenericActionTestCase; drop the tests/bootstrap.php hack that aliased payum's test namespace and point phpunit at vendor/autoload.php. - Fix QuickPayPayment::createFromResponse implicit-nullable $url (?string), which PHPStan flags as an error on PHP 8.4+. - Remove the now-unused config.preferred-install and the stale extra.branch-alias (dev-master) block.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## 1.x #43 +/- ##
======================================
Coverage ? 89.50%
Complexity ? 122
======================================
Files ? 16
Lines ? 362
Branches ? 0
======================================
Hits ? 324
Misses ? 38
Partials ? 0 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
The action/model tests used to drive real payments against api.quickpay.net with shared test credentials, which made the unit-test jobs slow and flaky (async settlement timing + shared account state). - Add tests/StubHttpClient.php: a Payum HttpClientInterface that returns pre-queued PSR-7 responses in FIFO order, so Api::doRequest() never reaches the network. - ApiTestTrait now builds the Api around the stub (and a minimal gateway sharing it, for NotifyAction's ConfirmPayment sub-request), and exposes helpers to queue canned QuickPay payment JSON. - Rewrite the action tests and QuickpayModelTest to queue the responses each flow expects; AuthorizeActionTest's token factory is now a Prophecy double. Drop the sleep() calls that waited on the real API. The full suite now runs in ~50ms with no network access and is deterministic across runs.
QuickPayGatewayFactoryTest builds a real gateway, and payum/core eagerly resolves httplug.client via Http\Discovery\HttpClientDiscovery. With the lowest dependency set, old payum/core does not pull php-http/discovery in, so the discovery class is missing and gateway construction fails. Depend on php-http/discovery directly (it already ships with the highest set) so guzzle7-adapter is discoverable across all dependency ranges.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #5
What
Modernises the package toolchain and makes the test suite self-contained:
>=7.4→>=8.1(composer.json+ CI matrix).psalm.xml/psalm-baseline.xml, addsphpstan.neon.dist.composer analysenow runsphpstan analyse.setono/code-quality-packbundles directly intorequire-dev(PHPStan + extensions, PHPUnit 10, Rector, Infection, ECS viasylius-labs/coding-standard,shipmonk/composer-dependency-analyser).roave/security-advisoriesandsetono/code-quality-packfromrequire-dev, and the staleextra.branch-alias.Offline test suite (Closes #5)
The action/model tests used to drive real payments against
api.quickpay.netwith shared test credentials, which made the unit-test jobs slow and flaky (async settlement timing + shared account state).tests/StubHttpClient.php— a PayumHttpClientInterfacethat returns pre-queued PSR-7 responses in FIFO order, soApi::doRequest()never reaches the network.ApiTestTraitnow builds theApiaround the stub (and a minimal gateway sharing it, forNotifyAction'sConfirmPaymentsub-request) and exposes helpers to queue canned QuickPay payment JSON.QuickpayModelTestqueue the responses each flow expects;AuthorizeActionTest's token factory is a Prophecy double; thesleep()waits are gone.PHPStan
src/— matching what the old Psalm config analysed. Level 9/max is impractical here because Payum'sArrayObject-based request model makes everythingmixedat the API boundary.QuickPayModelnow usesReflectionProperty::setValue;QuickPayPayment::createFromResponseno longer has an implicit-nullable$url, which PHPStan flags on PHP 8.4+). No baseline, no ignores.PHPUnit / test infrastructure
The suite couldn't even run on PHP 8.1 before (PHPUnit 7.5 fatals). On PHPUnit 10:
QuickPayGatewayFactoryTestno longer uses assertion helpers removed in PHPUnit 9 (assertAttributeInstanceOf,readAttribute, …).tests/GenericActionTestCase.php— a local copy of Payum'sGenericActionTest(which payum/coreexport-ignores from its dist, so it is absent on a--prefer-distinstall). Test doubles use Prophecy.Dependencies / CI
php-http/guzzle7-adapter): guzzle 6 is EOL and excluded from resolution by Composer 2.10's advisory blocker, so it can no longer be installed. guzzle 7 resolves to a non-advisory version on its own — no advisory ignores needed. Addsphp-http/message(legacyMessageFactoryfor Payum's discovery),guzzlehttp/psr7 ^2, andphp-http/discovery(so the gateway builds across the lowest dependency set too).ecs.phpandphpunit.xml.distported to current config formats; addsrector.phpandinfection.json.dist.composer-require-checker/composer-unusedforshipmonk/composer-dependency-analyser; coverage upload moved tocodecov-action@v5.Full gate is green on both lowest and highest:
composer validate --strict,normalize,check-style,analyse,composer-dependency-analyser, andphpunit(138 tests, offline).