Lint PHP and report Composer package changes in CI

.github/hmlinter.yml

@@ -0,0 +1,9 @@
+# The Linting workflow runs phpcs instead of hm-linter.
+phpcs:
+    enabled: false
+
+eslint:
+    enabled: false
+
+stylelint:
+    enabled: false

.github/workflows/composer-diff.yml

@@ -0,0 +1,53 @@
+name: Composer Diff
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    paths:
+      - 'composer.lock'
+jobs:
+  composer-diff:
+    name: Composer Diff
+    runs-on: ubuntu-24.04
+
+    permissions:
+      pull-requests: write
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+        with:
+          fetch-depth: 0 # Required to make it possible to compare with PR base branch
+
+      - name: Generate composer diff
+        id: composer_diff # To reference the output in comment
+        uses: IonBazan/composer-diff-action@e2022e8718d05cc6e4e5990a06fc928c75837f76 #v2.0.0
+        with:
+          format: mdlist
+          with-links: true
+          with-platform: true
+
+
+      # Fork PRs get a read-only token, so the comment steps would fail there.
+      - uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 #v3.0.5
+        # An empty diff result will break this action.
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository && steps.composer_diff.outputs.composer_diff_exit_code != 0 }}
+        with:
+          header: composer-diff # Creates a collapsed comment with the report
+          message: |
+            <details>
+            <summary>Composer package changes</summary>
+
+            ${{ steps.composer_diff.outputs.composer_diff }}
+
+            </details>
+
+      # Remove the report once a later push leaves no package changes.
+      - uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 #v3.0.5
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository && steps.composer_diff.outputs.composer_diff_exit_code == 0 }}
+        with:
+          header: composer-diff
+          delete: true

.github/workflows/linting.yml

@@ -0,0 +1,46 @@
+name: Linting
+
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  php:
+    name: PHP
+    runs-on: ubuntu-24.04
+    permissions:
+      checks: write
+      contents: read
+      pull-requests: read
+    steps:
+      - name: Setup PHP
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 #2.40.0
+        with:
+          php-version: '8.2'
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+      - name: Validate Composer config
+        run: composer validate --no-check-all --no-check-publish
+      - name: Install dependencies
+        run: composer install --no-progress --no-interaction --no-ansi
+      # lint-action runs a bare `phpcs`, so it must be on PATH.
+      - name: Add Composer binaries to PATH
+        run: echo "$GITHUB_WORKSPACE/vendor/bin" >> "$GITHUB_PATH"
+      - name: Lint code
+        # Fork PRs get a read-only token, so lint-action can't create its check run there.
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: wearerequired/lint-action@124229c6e2974984ba137c67a499ba28bfc33e33 #v3.0.2
+        with:
+          continue_on_error: false
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          php_codesniffer: true
+          php_codesniffer_args: --standard=phpcs.ruleset.xml
+      - name: Lint code (fork)
+        if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
+        run: composer lint