Testing SARIF exact report 2

.dockerignore

@@ -1,6 +1,8 @@
 ### User-specific stuff:
 /.git*
-/.idea/workspace.xml
+.DS_Store
+.vscode/
+/.idea/
 .dockerignore
 
 ###> composer dependencies ###

.editorconfig

@@ -15,5 +15,5 @@ trim_trailing_whitespace = false
 [*.yml]
 indent_size = 2
 
-[{composer.json,Makefile}]
+[Makefile]
 indent_style = tab

.env

@@ -6,5 +6,5 @@ COMPOSE_PROJECT_NAME=phpcpd
 # XDEBUG_CONFIG possible values: main|osx. Use main value for Linux and Windows, osx value for MacOS.
 XDEBUG_CONFIG=main
 # Sometimes we need to use different xdebug versions, list of versions can be found here - https://pecl.php.net/package/xdebug
-XDEBUG_VERSION=3.5.0
+XDEBUG_VERSION=3.5.3
 ###< XDebug docker configuration ###

.gitattributes

@@ -1,8 +1,15 @@
 * text=auto
-/.github                export-ignore
+
+### Enforce LF for infrastructure (CRITICAL for Docker on Windows)
+Makefile text eol=lf
+Dockerfile text eol=lf
+docker/** text eol=lf
+*.sh text eol=lf
+
+### Hide generated files in PRs but prevent text auto-merging
 /.phive                 export-ignore
 /build                  export-ignore
-tools/**/composer.lock  binary
-composer.lock           binary
+tools/**/composer.lock linguist-generated=true -merge
+composer.lock linguist-generated=true -merge
 phpab                   binary
 *.php diff=php

.github/workflows/ci.yml

@@ -44,6 +44,10 @@ jobs:
 
   tests:
     runs-on: ${{ matrix.operating-system }}
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
     strategy:
       matrix:
         operating-system: [ 'ubuntu-latest' ]
@@ -58,4 +62,10 @@ jobs:
       - name: Check php version
         run: php -v
       - name: Test latest PHPCPD release
-        run: php ./releases/phpcpd-latest.phar src
+        run: php ./releases/phpcpd-9.1.0.phar --log-sarif=reports/phpcpd/phpcpd-report.sarif src tests
+      - name: Upload SARIF report to GitHub
+        uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: reports/phpcpd/phpcpd-report.sarif
+          category: phpcpd-${{ matrix.php-versions }}

.gitignore

@@ -1,11 +1,38 @@
+### User-specific stuff & OS ###
+.DS_Store
+npm-debug.log
+yarn-error.log
+
+### PhpStorm / IntelliJ IDEA Shared Configs ###
+# 1. Personal editor state (changes frequently, causes merge conflicts)
+.idea/workspace.xml
+.idea/tasks.xml
+.idea/shelf/
+.idea/usage.statistics.xml
+.idea/caches/
+# 2. Local history (may contain session cookies and tokens from REST Client)
+.idea/httpRequests/
+# 3. Databases (MUST be ignored to prevent leaking passwords and local ports)
+.idea/dataSources/
+.idea/dataSources.xml
+.idea/dataSources.local.xml
+.idea/sqldialects.xml
+.idea/queries/
+# 4. Local dictionaries (to avoid sharing personal typos with the team)
+.idea/dictionaries/
+
+### Docker local overrides ###
+compose.override.yaml
+docker-compose.override.yaml
+
 reports/*
 !reports/.gitkeep
 !reports/phpcpd/.gitkeep
 
 /.env.local
 /build/phar
 /build/*.phar*
-/vendor
+/vendor/
 /tools/**/vendor
 
 ###> phpunit ###

Dockerfile

@@ -12,7 +12,7 @@ ARG INSIDE_DOCKER_CONTAINER=1
 ENV INSIDE_DOCKER_CONTAINER=$INSIDE_DOCKER_CONTAINER
 ARG XDEBUG_CONFIG=main
 ENV XDEBUG_CONFIG=$XDEBUG_CONFIG
-ARG XDEBUG_VERSION=3.5.0
+ARG XDEBUG_VERSION=3.5.3
 ENV XDEBUG_VERSION=$XDEBUG_VERSION
 
 # check environment
@@ -46,10 +46,8 @@ RUN apt-get update && apt-get upgrade -y && apt-get install -y \
       zip \
     && apt-get install --no-install-recommends -y \
         $(debsecan --suite bookworm --format packages --only-fixed) \
-    && rm -rf /tmp/* \
-    && rm -rf /var/list/apt/* \
-    && rm -rf /var/lib/apt/lists/* \
-    && apt-get clean
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
 # Pull the PHP extension installer from the official image
 COPY --from=mlocati/php-extension-installer:latest /usr/bin/install-php-extensions /usr/local/bin/