Sync 6.x with current 5.next

.github/SECURITY.md

@@ -0,0 +1,24 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are applied to all active versions listed in the
+[version map](https://github.com/cakephp/migrations/wiki#version-map).
+Versions marked as EOL no longer receive fixes.
+
+## Reporting a Vulnerability
+
+If you've found a security issue in CakePHP Migrations, please use the following procedure
+instead of the normal bug reporting system. Instead of using the bug tracker,
+or one of the support forums please send an email to security [at] cakephp.org. Emails
+sent to this address go to the CakePHP core team on a private mailing list.
+
+For each report, we try to first confirm the vulnerability. Once confirmed,
+the CakePHP team will take the following actions:
+
+* Acknowledge to the reporter that we've received the issue, and are
+  working on a fix. We ask that the reporter keep the issue confidential until we announce it.
+* Get a fix/patch prepared.
+* Prepare a post describing the vulnerability, and the possible exploits.
+* Release new versions of all affected versions.
+* Prominently feature the problem in the release announcement

.github/workflows/ci.yml

@@ -3,13 +3,17 @@ name: CI
 on:
   push:
     branches:
-      - 3.x
       - 4.x
       - 4.next
       - 5.x
+      - 5.next
+    paths-ignore:
+      - docs/**
   pull_request:
     branches:
       - '*'
+    paths-ignore:
+      - docs/**
   workflow_dispatch:
 
 permissions:
@@ -54,7 +58,7 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -114,7 +118,7 @@ jobs:
         run: echo "date=$(date +'%Y-%m')" >> $GITHUB_OUTPUT
 
       - name: Cache composer dependencies
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ steps.key-date.outputs.date }}-${{ hashFiles('composer.json') }}-${{ matrix.prefer-lowest }}
@@ -162,7 +166,7 @@ jobs:
 
       - name: Code Coverage Report
         if: success() && matrix.php-version == '8.1' && matrix.db-type == 'mysql'
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
 
   testsuite-windows:
     runs-on: windows-2022
@@ -173,7 +177,7 @@ jobs:
       PHP_VERSION: '8.2'
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         persist-credentials: false
 
@@ -191,7 +195,7 @@ jobs:
         key: ${{ steps.key-date.outputs.date }}
 
     - name: Cache PHP extensions
-      uses: actions/cache@v5
+      uses: actions/cache@v6
       with:
         path: ${{ steps.php-ext-cache.outputs.dir }}
         key: ${{ runner.os }}-php-ext-${{ steps.php-ext-cache.outputs.key }}
@@ -219,7 +223,7 @@ jobs:
       run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
     - name: Cache composer dependencies
-      uses: actions/cache@v5
+      uses: actions/cache@v6
       with:
         path: ${{ steps.composer-cache.outputs.dir }}
         key: ${{ runner.os }}-composer-${{ steps.key-date.outputs.date }}-${{ hashFiles('composer.json') }}-${{ matrix.prefer-lowest }}
@@ -236,7 +240,7 @@ jobs:
           vendor/bin/phpunit --coverage-clover=coverage.xml
 
     - name: Submit code coverage
-      uses: codecov/codecov-action@v5
+      uses: codecov/codecov-action@v7
 
   cs-stan:
     uses: cakephp/.github/.github/workflows/cs-stan.yml@5.x

.github/workflows/deploy_docs_3x.yml

@@ -7,17 +7,20 @@ on:
       - 3.x
   workflow_dispatch:
 
+permissions:
+    contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
       - name: Cloning repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Push to dokku
-        uses: dokku/github-action@master
+        uses: dokku/github-action@cc7dec1d2b9fed249a14ae462bc953bba436f78c # v1.10.0
         with:
           git_remote_url: 'ssh://dokku@apps.cakephp.org:22/migrations-docs-3'
           ssh_private_key: ${{ secrets.DOKKU_SSH_PRIVATE_KEY }}

.github/workflows/deploy_docs_4x.yml

@@ -7,17 +7,20 @@ on:
       - 4.x
   workflow_dispatch:
 
+permissions:
+    contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
       - name: Cloning repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Push to dokku
-        uses: dokku/github-action@master
+        uses: dokku/github-action@cc7dec1d2b9fed249a14ae462bc953bba436f78c # v1.10.0
         with:
           git_remote_url: 'ssh://dokku@apps.cakephp.org:22/migrations-docs-4'
           ssh_private_key: ${{ secrets.DOKKU_SSH_PRIVATE_KEY }}

.github/workflows/deploy_docs_5x.yml

@@ -7,17 +7,21 @@ on:
       - 5.x
   workflow_dispatch:
 
+permissions:
+    contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
       - name: Cloning repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Push to dokku
-        uses: dokku/github-action@master
+        uses: dokku/github-action@cc7dec1d2b9fed249a14ae462bc953bba436f78c # v1.10.0
         with:
           git_remote_url: 'ssh://dokku@apps.cakephp.org:22/migrations-docs-5'
           ssh_private_key: ${{ secrets.DOKKU_SSH_PRIVATE_KEY }}
+          branch: '5.x'

.github/workflows/docs-validation.yml

@@ -0,0 +1,27 @@
+name: Documentation Validation
+
+on:
+    push:
+        branches:
+            - 5.x
+        paths:
+            - 'docs/**'
+            - '.github/**'
+    pull_request:
+        paths:
+            - 'docs/**'
+            - '.github/**'
+
+jobs:
+    validate:
+        uses: cakephp/.github/.github/workflows/docs-validation.yml@5.x
+        with:
+            docs-path: 'docs'
+            vitepress-path: 'docs/.vitepress'
+            enable-config-js-check: true
+            enable-json-lint: true
+            enable-toc-check: true
+            enable-spell-check: true
+            enable-markdown-lint: true
+            enable-link-check: true
+            tools-ref: '5.x'

.gitignore

@@ -16,6 +16,7 @@ error.log
 /tests/test_app/config/TestsMigrations/schema-dump-test.lock
 /tests/test_app/Plugin/TestBlog/config/Migrations/*
 .phpunit.cache
+.phpcs.cache
 .ddev
 
 # IDE and editor specific files #

.phive/phars.xml

@@ -1,4 +1,4 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <phive xmlns="https://phar.io/phive">
-  <phar name="phpstan" version="2.1.33" installed="2.1.33" location="./tools/phpstan" copy="false"/>
+  <phar name="phpstan" version="2.3.0" installed="2.3.0" location="./tools/phpstan" copy="false"/>
 </phive>

Dockerfile

@@ -1,25 +1,36 @@
-# Basic docker based environment
-# Necessary to trick dokku into building the documentation
-# using dockerfile instead of herokuish
-FROM ubuntu:22.04
-
-# Add basic tools
-RUN apt-get update && \
-  apt-get install -y build-essential \
-    software-properties-common \
-    curl \
-    git \
-    libxml2 \
-    libffi-dev \
-    libssl-dev && \
-  LC_ALL=C.UTF-8 add-apt-repository ppa:ondrej/php && \
-  apt-get update && \
-  apt-get install -y php8.1-cli php8.1-mbstring php8.1-xml php8.1-zip php8.1-intl php8.1-opcache php8.1-sqlite &&\
-  apt-get clean &&\
-  rm -rf /var/lib/apt/lists/*
-
-WORKDIR /code
-
-VOLUME ["/code"]
-
-CMD [ '/bin/bash' ]
+# ----------------------
+# 1. Build stage
+# ----------------------
+FROM node:24-alpine AS builder
+
+# Git is required because docs/package.json pulls a dependency from GitHub.
+RUN apk add --no-cache git openssh-client
+
+WORKDIR /app/docs
+
+# Copy dependency manifests first to preserve Docker layer caching.
+COPY docs/ ./
+RUN npm ci
+
+# Increase max-old-space-size to avoid memory issues during build
+#ENV NODE_OPTIONS="--max-old-space-size=8192"
+
+# Build the site.
+RUN npm run docs:build
+
+# ----------------------
+# 2. Runtime stage (angie)
+# ----------------------
+FROM docker.angie.software/angie:latest AS runner
+
+# Copy built files
+COPY --from=builder /app/docs/.vitepress/dist /usr/share/angie/html
+
+# Expose port
+EXPOSE 80
+
+# Health check (optional)
+HEALTHCHECK CMD wget --quiet --tries=1 --spider http://localhost:80/ || exit 1
+
+# Start angie
+CMD ["angie", "-g", "daemon off;"]

composer.json

@@ -24,20 +24,20 @@
     "require": {
         "php": ">=8.2",
         "cakephp/cache": "^5.3.0",
-        "cakephp/database": "^5.3.0",
+        "cakephp/database": "^5.3.2",
         "cakephp/orm": "^5.3.0"
     },
     "require-dev": {
         "cakephp/bake": "^3.3",
         "cakephp/cakephp": "^5.3.2",
         "cakephp/cakephp-codesniffer": "^5.0",
-        "phpunit/phpunit": "^11.5.3 || ^12.1.3"
+        "phpunit/phpunit": "^11.5.3 || ^12.1.3 || ^13.0"
     },
     "suggest": {
         "cakephp/bake": "If you want to generate migrations.",
         "dereuromark/cakephp-ide-helper": "If you want to have IDE suggest/autocomplete when creating migrations."
     },
-    "minimum-stability": "dev",
+    "minimum-stability": "stable",
     "prefer-stable": true,
     "autoload": {
         "psr-4": {
@@ -68,14 +68,17 @@
             "@stan",
             "@test"
         ],
-        "cs-check": "phpcs --parallel=16 -p",
-        "cs-fix": "phpcbf --parallel=16 -p",
+        "cs-check": "phpcs",
+        "cs-fix": "phpcbf",
         "phpstan": "tools/phpstan analyse",
         "stan": "@phpstan",
         "stan-baseline": "tools/phpstan --generate-baseline",
         "stan-setup": "phive install",
         "lowest": "validate-prefer-lowest",
         "lowest-setup": "composer update --prefer-lowest --prefer-stable --prefer-dist --no-interaction && cp composer.json composer.backup && composer require --dev dereuromark/composer-prefer-lowest && mv composer.backup composer.json",
+        "rector-setup": "cp composer.json composer.backup && composer require --dev rector/rector:\"~2.3.1\" phpstan/phpstan:\"~2.1.40\" && mv composer.backup composer.json",
+        "rector-check": "vendor/bin/rector process --dry-run",
+        "rector-fix": "vendor/bin/rector process",
         "test": "phpunit",
         "test-coverage": "phpunit --coverage-clover=clover.xml"
     }

docs/.gitignore

@@ -0,0 +1,3 @@
+node_modules
+*/public/
+.vitepress/cache