update scrutinizer and readme badges #104
Conversation
WalkthroughCI configuration was migrated and modernized: GitHub Actions workflow expanded PHP versions (8.2–8.5), updated action versions and composer cache handling, enabled xdebug coverage and Codecov upload; Scrutinizer build node override added and analysis tools removed; README badges updated; added codecov.yml to disable PR comments. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.github/workflows/continuous-integration.yml:
- Around line 51-54: Update the GitHub Action step named "Upload coverage
report" to use the modern Codecov action by changing uses: from
codecov/codecov-action@v2 to the v5 release (e.g., codecov/codecov-action@v5)
and add the required token input (token: ${{ secrets.CODECOV_TOKEN }}) for
private repos (recommended for public repos as well); keep or translate the fail
behavior as appropriate for the v5 action and ensure the step still references
the same step name "Upload coverage report" and the action identifier
codecov/codecov-action so the workflow runs with the latest stable Codecov
action.
🧹 Nitpick comments (1)
.github/workflows/continuous-integration.yml (1)
30-30: Consider limiting coverage collection to a single PHP version.Enabling xdebug coverage on all PHP version matrix entries (7.2, 7.3, 7.4, 8.0, 8.1) adds overhead to every build. You could optimize CI time by collecting coverage only on one version (e.g., the latest PHP 8.1) and keeping
coverage: "none"for others.♻️ Optional optimization using matrix include
strategy: matrix: php-version: - "7.2" - "7.3" - "7.4" - "8.0" - "8.1" coverage: ["none"] include: - php-version: "8.1" coverage: "xdebug"Then use
coverage: "${{ matrix.coverage }}"in the setup-php step and conditionally run the upload step.
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.github/workflows/continuous-integration.yml.scrutinizer.ymlREADME.mdcodecov.yml
🧰 Additional context used
🪛 actionlint (1.7.10)
.github/workflows/continuous-integration.yml
52-52: the runner of "codecov/codecov-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🔇 Additional comments (4)
codecov.yml (1)
1-1: LGTM!The Codecov configuration is minimal and valid. Disabling PR comments is a reasonable choice to reduce noise in pull requests while still collecting coverage data.
.scrutinizer.yml (1)
1-8: LGTM!The Scrutinizer configuration has been simplified to focus on code analysis via
php-scrutinizer-run, with coverage reporting now delegated to Codecov. This aligns with the PR's objective to consolidate coverage reporting through GitHub Actions..github/workflows/continuous-integration.yml (1)
48-49: LGTM!The phpunit command correctly enables xdebug coverage mode and outputs a Clover XML report for Codecov consumption.
README.md (1)
25-27: LGTM!The badges are correctly updated to reflect the new CI/CD configuration:
- Scrutinizer badge now points to the 4.x branch
- Coverage badge switched from Scrutinizer to Codecov
- Build status badge switched from Travis CI to GitHub Actions
The token in the Codecov badge URL is a public graph token (safe to expose), not the upload token.
✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.
| - name: Upload coverage report | ||
| uses: codecov/codecov-action@v2 | ||
| with: | ||
| fail_ci_if_error: false |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
codecov-action GitHub latest version 2025 2026
💡 Result:
As of Jan 16, 2026 the latest released tag for codecov/codecov-action is v5.5.2 (release published Dec 9, 2025). [1][2]
Sources:
- codecov/codecov-action releases (v5.5.2). [1]
- Codecov GitHub Marketplace (recommends
@v5). [2]
🌐 Web query:
codecov-action v4 v5 token parameter required private repository
💡 Result:
Short answer: Yes — for private repositories you must provide a Codecov upload token when using either codecov-action v4 or v5. v5 adds tokenless upload options for public repos (global upload token opt-out and OIDC), but private repos still require a token. [1][2][3]
Sources:
- codecov/codecov-action README (v4/v5 notes). [1]
- Codecov Tokens docs — "For private repositories, all uploads require a token." [2]
- Codecov Uploader docs — upload token notes and public-vs-private behavior. [3]
Update codecov-action to v5.
The codecov/codecov-action@v2 is outdated. The current stable version is v5 (latest v5.5.2 as of December 2025), which is the recommended version on GitHub Marketplace.
🔧 Suggested fix
- name: Upload coverage report
- uses: codecov/codecov-action@v2
+ uses: codecov/codecov-action@v5
with:
fail_ci_if_error: false
+ token: ${{ secrets.CODECOV_TOKEN }}Note: The token parameter is required for private repositories and recommended for public repositories to avoid rate limiting. Store your token in repository secrets.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Upload coverage report | |
| uses: codecov/codecov-action@v2 | |
| with: | |
| fail_ci_if_error: false | |
| - name: Upload coverage report | |
| uses: codecov/codecov-action@v5 | |
| with: | |
| fail_ci_if_error: false | |
| token: ${{ secrets.CODECOV_TOKEN }} |
🧰 Tools
🪛 actionlint (1.7.10)
52-52: the runner of "codecov/codecov-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🤖 Prompt for AI Agents
In @.github/workflows/continuous-integration.yml around lines 51 - 54, Update
the GitHub Action step named "Upload coverage report" to use the modern Codecov
action by changing uses: from codecov/codecov-action@v2 to the v5 release (e.g.,
codecov/codecov-action@v5) and add the required token input (token: ${{
secrets.CODECOV_TOKEN }}) for private repos (recommended for public repos as
well); keep or translate the fail behavior as appropriate for the v5 action and
ensure the step still references the same step name "Upload coverage report" and
the action identifier codecov/codecov-action so the workflow runs with the
latest stable Codecov action.
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/continuous-integration.yml (2)
81-83: Update deprecatedset-outputsyntax.Line 83 uses the deprecated
::set-outputworkflow command, while the unit-tests job (line 41) correctly usesGITHUB_OUTPUT. This syntax was deprecated in October 2022 and will eventually stop working.🔧 Suggested fix
- name: "Determine composer cache directory" id: "determine-composer-cache-directory" - run: "echo \"::set-output name=directory::$(composer config cache-dir)\"" + run: echo "directory=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
93-93: Remove deprecated--no-suggestflag.The
--no-suggestoption was deprecated in Composer 2.2 and removed in later versions. It will cause warnings or errors with modern Composer versions.🔧 Suggested fix
- name: "Install dependencies with composer" - run: "composer install --no-interaction --no-progress --no-suggest" + run: "composer install --no-interaction --no-progress"
🧹 Nitpick comments (1)
.github/workflows/continuous-integration.yml (1)
56-59: Consider adding the Codecov token.While
codecov-action@v5supports tokenless uploads for public repositories via OIDC, adding the token is recommended to avoid rate limiting issues. For private repositories, the token is required.🔧 Suggested fix
- name: Upload coverage report uses: codecov/codecov-action@v5 with: fail_ci_if_error: false + token: ${{ secrets.CODECOV_TOKEN }}
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/continuous-integration.yml
🔇 Additional comments (3)
.github/workflows/continuous-integration.yml (3)
28-37: LGTM!The action version updates and PHP setup configuration are appropriate. Enabling xdebug coverage and assertions aligns with testing best practices.
39-48: LGTM!The composer cache handling uses the modern
GITHUB_OUTPUTsyntax andactions/cache@v4. The cache key based oncomposer.lockis appropriate for dependency caching.
22-25: PHP 8.5 is a stable, officially released version (as of November 20, 2025) with active support through 2027 and security support through 2029. Including it in the CI matrix is appropriate.
✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.
1 participant
Summary by CodeRabbit
Chores
Documentation
✏️ Tip: You can customize this high-level summary in your review settings.