Update PHPStan baseline with new types rules

The PHPStan baseline is updated to include newly identified type issues concerning return value types in iterable arrays for getSupportedTypes() method in both JWESerializer and JWSSerializer classes. Also, remove irrelevant default property type issues of various command classes thus reducing noise in the baseline file.

Author: Spomky

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,19 +1,20 @@
-| Q             | A
-| ------------- | ---
-| Branch?       | <!-- see below -->
-| Bug fix?      | yes/no
-| New feature?  | yes/no <!-- please update src/**/CHANGELOG.md files -->
-| Deprecations? | yes/no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
-| Tickets       | Fix #... <!-- prefix each issue number with "Fix #", no need to create an issue if none exist, explain below instead -->
-| License       | MIT
+Target branch:
+Resolves issue # <!-- #-prefixed issue number(s), if any -->
+
+<!-- replace space with "x" in square brackets: [x] -->
+- [ ] It is a Bug fix
+- [ ] It is a New feature
+- [ ] It is related to dependencies
+
+Includes:
+- [ ] Breaks BC
+- [ ] Deprecations
+
 <!--
-Replace this notice by a short README for your feature/bugfix. This will help people
-understand your PR and can be used as a start for the documentation.
+Fill in this template according to the PR you're about to submit.
+Replace this comment by a description of what your PR is solving.
 
-Additionally:
-- Always add tests and ensure they pass.
-- Never break backward compatibility (unless you are working on the next major release branch).
-- Bug fixes must be submitted against the lowest maintained branch where they apply
-    (lowest branches are regularly merged to upper ones so they get the fixes too.)
-- Features and deprecations must be submitted against the last major branch (e.g. 1.x).
+Please consider the following requirement:
+* Modification of existing tests should be avoided unless deemed necessary.
+* You MUST never open a PR related to a security issue. Contact Spomky in private at https://gitter.im/Spomky/
 -->

.github/workflows/dependency-review.yml

@@ -0,0 +1,14 @@
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout Repository'
+        uses: actions/checkout@v4
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@v4

.github/workflows/infection.yml

@@ -1,5 +1,3 @@
-# yaml-language-server: $schema=https://json.schemastore.org/github-workflow
-
 name: "Integrate"
 
 on:
@@ -15,7 +13,7 @@ jobs:
       - name: "Set up PHP"
         uses: "shivammathur/setup-php@v2"
         with:
-          php-version: "8.1"
+          php-version: "8.3"
           extensions: "json, mbstring, openssl, sqlite3, curl, uuid"
 
       - name: "Checkout code"

.github/workflows/integrate.yml

@@ -1,5 +1,3 @@
-# yaml-language-server: $schema=https://json.schemastore.org/github-workflow
-
 name: "Integrate"
 
 on:
@@ -31,7 +29,7 @@ jobs:
       - name: "Set up PHP"
         uses: "shivammathur/setup-php@v2"
         with:
-          php-version: "8.1"
+          php-version: "8.3"
 
       - name: "Checkout code"
         uses: "actions/checkout@v4"
@@ -54,8 +52,6 @@ jobs:
         operating-system:
           - "ubuntu-latest"
         php-version:
-          - "8.1"
-          - "8.2"
           - "8.3"
         dependencies:
           - "lowest"
@@ -81,14 +77,6 @@ jobs:
       - name: "Execute unit tests"
         run: "make ci-cc"
 
-  #      - name: Send coverage to Coveralls
-  #        if: "matrix.php-version == '8.1' && matrix.dependencies == 'highest'"
-  #        env:
-  #          COVERALLS_REPO_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-  #        run: |
-  #          wget "https://github.com/php-coveralls/php-coveralls/releases/download/v2.5.2/php-coveralls.phar"
-  #          php ./php-coveralls.phar -v
-
   static_analysis:
     name: "3️⃣ Static Analysis"
     needs:
@@ -99,7 +87,7 @@ jobs:
       - name: "Set up PHP"
         uses: "shivammathur/setup-php@v2"
         with:
-          php-version: "8.1"
+          php-version: "8.3"
           extensions: "json, mbstring, openssl, sqlite3, curl, uuid"
 
       - name: "Checkout code"
@@ -127,7 +115,7 @@ jobs:
       - name: "Set up PHP"
         uses: "shivammathur/setup-php@v2"
         with:
-          php-version: "8.1"
+          php-version: "8.3"
           extensions: "json, mbstring, openssl, sqlite3, curl, uuid"
 
       - name: "Checkout code"
@@ -155,7 +143,7 @@ jobs:
       - name: "Set up PHP"
         uses: "shivammathur/setup-php@v2"
         with:
-          php-version: "8.1"
+          php-version: "8.3"
           extensions: "json, mbstring, openssl, sqlite3, curl, uuid"
           coverage: "xdebug"
 

.github/workflows/lock-closed-issues.yml

@@ -0,0 +1,23 @@
+name: 'Lock Issues'
+
+on:
+  schedule:
+    - cron: '28 4 * * *'
+
+jobs:
+  lock:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: dessant/lock-threads@v5
+        with:
+          github-token: ${{ github.token }}
+          issue-inactive-days: '31'
+          exclude-issue-created-before: ''
+          exclude-any-issue-labels: ''
+          add-issue-labels: ''
+          issue-comment: >
+            This thread has been automatically locked since there has not been
+            any recent activity after it was closed. Please open a new issue for
+            related bugs.
+          issue-lock-reason: 'resolved'
+          process-only: 'issues'

.github/workflows/release-on-milestone-closed.yml

@@ -1,5 +1,3 @@
-# https://help.github.com/en/categories/automating-your-workflow-with-github-actions
-
 name: "Automatic Releases"
 
 on:

.github/workflows/scorecards.yml

@@ -0,0 +1,44 @@
+name: Scorecards supply-chain security
+
+on:
+  schedule:
+    - cron: '34 4 * * 6'
+  push:
+    branches: [ "*.*.x" ]
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecards analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@v2.3.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@v4.3.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif

.gitsplit.yml

@@ -5,56 +5,6 @@ splits:
     target: "https://${GH_TOKEN}@github.com/web-token/jwt-library.git"
   - prefix: "src/Experimental"
     target: "https://${GH_TOKEN}@github.com/web-token/jwt-experimental.git"
-  - prefix: "src/Deprecated/Signature"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-signature.git"
-  - prefix: "src/Deprecated/Checker"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-checker.git"
-  - prefix: "src/Deprecated/Console"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-console.git"
-  - prefix: "src/Deprecated/Core"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-core.git"
-  - prefix: "src/Deprecated/Ecc"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-util-ecc.git"
-  - prefix: "src/Deprecated/Encryption"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-encryption.git"
-  - prefix: "src/Deprecated/KeyManagement"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-key-mgmt.git"
-  - prefix: "src/Deprecated/NestedToken"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-nested-token.git"
-  - prefix: "src/Deprecated/EncryptionAlgorithm/ContentEncryption/AESCBC"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-encryption-algorithm-aescbc.git"
-  - prefix: "src/Deprecated/EncryptionAlgorithm/ContentEncryption/AESGCM"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-encryption-algorithm-aesgcm.git"
-  - prefix: "src/Deprecated/EncryptionAlgorithm/KeyEncryption/AESGCMKW"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-encryption-algorithm-aesgcmkw.git"
-  - prefix: "src/Deprecated/EncryptionAlgorithm/KeyEncryption/AESKW"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-encryption-algorithm-aeskw.git"
-  - prefix: "src/Deprecated/EncryptionAlgorithm/KeyEncryption/Direct"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-encryption-algorithm-dir.git"
-  - prefix: "src/Deprecated/EncryptionAlgorithm/KeyEncryption/ECDHES"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-encryption-algorithm-ecdh-es.git"
-  - prefix: "src/Deprecated/EncryptionAlgorithm/KeyEncryption/PBES2"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-encryption-algorithm-pbes2.git"
-  - prefix: "src/Deprecated/EncryptionAlgorithm/KeyEncryption/RSA"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-encryption-algorithm-rsa.git"
-  - prefix: "src/Deprecated/SignatureAlgorithm/ECDSA"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-signature-algorithm-ecdsa.git"
-  - prefix: "src/Deprecated/SignatureAlgorithm/EdDSA"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-signature-algorithm-eddsa.git"
-  - prefix: "src/Deprecated/SignatureAlgorithm/None"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-signature-algorithm-none.git"
-  - prefix: "src/Deprecated/SignatureAlgorithm/HMAC"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-signature-algorithm-hmac.git"
-  - prefix: "src/Deprecated/SignatureAlgorithm/RSA"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-signature-algorithm-rsa.git"
-  - prefix: "src/Deprecated/SignatureAlgorithm/Experimental"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-signature-algorithm-experimental.git"
-  - prefix: "src/Deprecated/EncryptionAlgorithm/Experimental"
-    target: "https://${GH_TOKEN}@github.com/web-token/jwt-encryption-algorithm-experimental.git"
-  - prefix: "src/Deprecated/Pack/Encryption"
-    target: "https://${GH_TOKEN}@github.com/web-token/encryption-pack.git"
-  - prefix: "rc/Deprecated/Pack/Signature"
-    target: "https://${GH_TOKEN}@github.com/web-token/signature-pack.git"
 
 origins:
   - ^\d+\.\d+\.x$