Skip to content

Add a Roave backward compatibility check - #134

Merged
shadetheory merged 1 commit into
masterfrom
ci/bc-check
Nov 6, 2026
Merged

shadetheory merged 1 commit into
masterfrom
ci/bc-check

Conversation

@shadetheory

Copy link
Copy Markdown
Owner

Adds a GitHub Actions workflow that runs roave/backward-compatibility-check (MIT) to catch public API changes before they ship.

When it runs

  • On pull requests: compares HEAD against the latest vX.Y.Z tag.
  • On v* tag pushes: compares the new tag against the previous release tag. A new major version is skipped, since breaking changes are expected there.
  • If there is no earlier release tag to compare against, the job skips.

How it is installed
The tool is installed with composer global require into a job-local COMPOSER_HOME under the runner temp dir, so composer.json is unchanged. That job-local config also sets audit.block-insecure to false so older tagged releases can install their pinned dependencies for the comparison. Nothing else in the repo uses that setting.

Baseline
.roave-backward-compatibility-check.xml ignores only changes reported on the Symfony and Laravel console base classes that the package commands extend (getDefaultName()/getDefaultDescription() removed upstream, and configure()/initialize()/interact() gaining a void return type). The file is export-ignored in .gitattributes so it stays out of the dist archive.

Changes to the package's own API are still reported. For example, comparing v3.0.0 to v3.1.0 goes from 9 reported changes to these 4:

  • GithubOAuth::$clientId, $clientSecret and $redirectUrl changed from string to ?string
  • GithubOAuth::getAuthorizationUrl() gained a $state parameter

Checked locally

  • v3.0.0 to v3.1.0: 9 changes without the baseline, 4 with it (the GithubOAuth ones above)
  • v3.1.0 to HEAD: no backward incompatible changes
  • pint --test, phpstan, pest (238 passed), actionlint, and the lean package validator all pass

@shadetheory shadetheory added the risk:high Needs a human review before merge label Nov 4, 2026

@lexi-chief-of-staff lexi-chief-of-staff Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ship it.

  • Local verification covers v3.0.0..v3.1.0 (baseline reduces noise to the four GithubOAuth changes) and v3.1.0..HEAD (clean).
  • Workflow skips on first release and on major bumps, as documented.
  • Baseline and export-ignore are correctly scoped; no changes to package API are suppressed.

@shadetheory

Copy link
Copy Markdown
Owner Author

Quality Gate: success

All quality checks passed.

Quality Check Results

All tools passed without violations.

@shadetheory
shadetheory merged commit 717882f into master Nov 6, 2026
21 of 22 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

risk:high Needs a human review before merge

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant