feat: lint the whole project using Super-Linter

.editorconfig

@@ -5,53 +5,18 @@
 root = true
 
 [*]
-# Change these settings to your own preference
-indent_style = space
-indent_size = 4
-
-# We recommend you to keep these unchanged
-end_of_line = lf
 charset = utf-8
-trim_trailing_whitespace = true
 insert_final_newline = true
-
-[*.{js,html,ts,tsx}]
-indent_size = 2
-
-[*.json]
-indent_size = 2
-
-[*.md]
-trim_trailing_whitespace = false
-
-[*.sh]
-indent_style = tab
-
-[*.xml.dist]
+end_of_line = lf
 indent_style = space
 indent_size = 4
 
-[*.{yaml,yml}]
-trim_trailing_whitespace = false
-
-[.github/workflows/*.yml]
-indent_size = 2
-
-[.gitmodules]
+[**/{Dockerfile,Caddyfile,*.sh}]
 indent_style = tab
 
-[.php_cs.dist]
-indent_style = space
-indent_size = 4
-
-[composer.json]
-indent_size = 4
-
-[{compose,docker-compose}.{*.yaml,*.yml,yaml,yml}]
+[{compose.*yaml,.github/**/*.yaml}]
 indent_size = 2
 
-[*.*Dockerfile]
-indent_style = tab
-
-[{Caddyfile,*.*Caddyfile}]
-indent_style = tab
+[**.md]
+indent_size = unset
+indent_style = unset

.github/linters/zizmor.yaml

@@ -0,0 +1,6 @@
+---
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "*": ref-pin

.github/workflows/ci.yml → .github/workflows/ci.yaml

@@ -1,3 +1,4 @@
+---
 name: CI
 
 on:
@@ -7,6 +8,9 @@ on:
   pull_request: ~
   workflow_dispatch: ~
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
@@ -16,14 +20,13 @@ jobs:
     name: Tests
     runs-on: ubuntu-latest
     steps:
-      -
-        name: Checkout
+      - name: Checkout code
         uses: actions/checkout@v5
-      -
-        name: Set up Docker Buildx
+        with:
+          persist-credentials: false
+      - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-      -
-        name: Build Docker images
+      - name: Build Docker images
         uses: docker/bake-action@v6
         with:
           pull: true
@@ -35,42 +38,43 @@ jobs:
             *.cache-from=type=gha,scope=${{github.ref}}
             *.cache-from=type=gha,scope=refs/heads/main
             *.cache-to=type=gha,scope=${{github.ref}},mode=max
-      -
-        name: Start services
+      - name: Start services
         run: docker compose up --wait --no-build
-      -
-        name: Check HTTP reachability
+      - name: Check HTTP reachability
         run: curl -v --fail-with-body http://localhost
-      -
-        name: Check HTTPS reachability
+      - name: Check HTTPS reachability
         if: false # Remove this line when the homepage is configured, or change the path to check
         run: curl -v --insecure --fail-with-body https://localhost
-      -
-        name: Check Mercure reachability
+      - name: Check Mercure reachability
         run: curl -vI --insecure --fail-with-body https://localhost/.well-known/mercure?topic=test
-      -
-        name: Create test database
+      - name: Create test database
         if: false # Remove this line if Doctrine ORM is installed
         run: docker compose exec -T php bin/console -e test doctrine:database:create
-      -
-        name: Run migrations
+      - name: Run migrations
         if: false # Remove this line if Doctrine Migrations is installed
         run: docker compose exec -T php bin/console -e test doctrine:migrations:migrate --no-interaction
-      -
-        name: Run PHPUnit
+      - name: Run PHPUnit
         if: false # Remove this line if PHPUnit is installed
         run: docker compose exec -T php bin/phpunit
-      -
-        name: Doctrine Schema Validator
+      - name: Doctrine Schema Validator
         if: false # Remove this line if Doctrine ORM is installed
         run: docker compose exec -T php bin/console -e test doctrine:schema:validate
   lint:
-    name: Docker Lint
+    name: Lint
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+      statuses: write
     steps:
-      -
-        name: Checkout
+      - name: Checkout
         uses: actions/checkout@v5
-      -
-        name: Lint Dockerfile
-        uses: hadolint/[email protected]
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Lint Code Base
+        uses: super-linter/super-linter/slim@v8
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VALIDATE_CHECKOV: false
+          VALIDATE_TRIVY: false

README.md

@@ -15,16 +15,16 @@ with [FrankenPHP](https://frankenphp.dev) and [Caddy](https://caddyserver.com/)
 
 ## Features
 
-* Production, development and CI ready
-* Just 1 service by default
-* Blazing-fast performance thanks to [the worker mode of FrankenPHP](https://github.com/dunglas/frankenphp/blob/main/docs/worker.md) (automatically enabled in prod mode)
-* [Installation of extra Docker Compose services](docs/extra-services.md) with Symfony Flex
-* Automatic HTTPS (in dev and prod)
-* HTTP/3 and [Early Hints](https://symfony.com/blog/new-in-symfony-6-3-early-hints) support
-* Real-time messaging thanks to a built-in [Mercure hub](https://symfony.com/doc/current/mercure.html)
-* [Vulcain](https://vulcain.rocks) support
-* Native [XDebug](docs/xdebug.md) integration
-* Super-readable configuration
+- Production, development and CI ready
+- Just 1 service by default
+- Blazing-fast performance thanks to [the worker mode of FrankenPHP](https://github.com/dunglas/frankenphp/blob/main/docs/worker.md) (automatically enabled in prod mode)
+- [Installation of extra Docker Compose services](docs/extra-services.md) with Symfony Flex
+- Automatic HTTPS (in dev and prod)
+- HTTP/3 and [Early Hints](https://symfony.com/blog/new-in-symfony-6-3-early-hints) support
+- Real-time messaging thanks to a built-in [Mercure hub](https://symfony.com/doc/current/mercure.html)
+- [Vulcain](https://vulcain.rocks) support
+- Native [XDebug](docs/xdebug.md) integration
+- Super-readable configuration
 
 **Enjoy!**
 

compose.override.yaml

@@ -1,3 +1,4 @@
+---
 # Development environment override
 services:
   php:
@@ -21,6 +22,5 @@ services:
       # Ensure that host.docker.internal is correctly defined on Linux
       - host.docker.internal:host-gateway
     tty: true
-
 ###> symfony/mercure-bundle ###
 ###< symfony/mercure-bundle ###

compose.prod.yaml

@@ -1,3 +1,4 @@
+---
 # Production environment override
 services:
   php:

compose.yaml

@@ -1,3 +1,4 @@
+---
 services:
   php:
     image: ${IMAGES_PREFIX:-}app-php

docs/alpine.md

@@ -8,9 +8,11 @@ are known to be slower, and have several known issues.
 
 To switch to Alpine-based images, apply the following changes to the `Dockerfile`:
 
+<!-- markdownlint-disable MD010 -->
+
 ```patch
--FROM dunglas/frankenphp:1-php8.3 AS frankenphp_upstream
-+FROM dunglas/frankenphp:1-php8.3-alpine AS frankenphp_upstream
+-FROM dunglas/frankenphp:1-php8.4 AS frankenphp_upstream
++FROM dunglas/frankenphp:1-php8.4-alpine AS frankenphp_upstream
 
 -# hadolint ignore=DL3008
 -RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -21,9 +23,10 @@ To switch to Alpine-based images, apply the following changes to the `Dockerfile
 -	&& rm -rf /var/lib/apt/lists/*
 +# hadolint ignore=DL3018
 +RUN apk add --no-cache \
-+		acl \
-+		file \
-+		gettext \
-+		git \
-+	;
++	acl \
++	file \
++	gettext \
++	git
 ```
+
+<!-- markdownlint-enable MD010 -->

docs/existing-project.md

@@ -4,46 +4,72 @@ It's also possible to use Symfony Docker with existing projects!
 
 First, [download this skeleton](https://github.com/dunglas/symfony-docker).
 
-If you cloned the Git repository, be sure to not copy the `.git` directory to prevent conflicts with the `.git` directory already in your existing project.
-You can copy the contents of the repository using git and tar. This will not contain `.git` or any uncommited changes.
+If you cloned the Git repository, be sure to not copy the `.git` directory
+to prevent conflicts with the `.git` directory already in your existing project.
 
-    git archive --format=tar HEAD | tar -xC my-existing-project/
+You can copy the contents of the repository using Git and tar.
+This will not contain `.git` or any uncommited changes.
 
-If you downloaded the skeleton as a zip you can just copy the extracted files:
+```console
+git archive --format=tar HEAD | tar -xC my-existing-project/
+```
 
-    cp -Rp symfony-docker/. my-existing-project/
+If you downloaded the skeleton as a ZIP you can just copy the extracted files:
+
+```console
+cp -Rp symfony-docker/. my-existing-project/
+```
 
 Enable the Docker support of Symfony Flex:
 
-    composer config --json extra.symfony.docker 'true'
+```console
+composer config --json extra.symfony.docker 'true'
+```
+
+If you want to use the [worker mode of FrankenPHP](https://github.com/php/frankenphp/blob/main/docs/worker.md),
+add the FrankenPHP runtime for Symfony:
 
-If you want to use the [worker mode of FrankenPHP](https://github.com/php/frankenphp/blob/main/docs/worker.md), add the FrankenPHP runtime for Symfony:
-    
-    composer require runtime/frankenphp-symfony
+```console
+composer require runtime/frankenphp-symfony
+```
 
 > [!TIP]
-> With Symfony 7.4, the `runtime/frankenphp-symfony` package isn't required anymore, as Symfony Runtime natively supports FrankenPHP worker mode.
+>
+> With Symfony 7.4, the `runtime/frankenphp-symfony` package isn't required anymore,
+> as Symfony Runtime natively supports FrankenPHP worker mode.
 
-Re-execute the recipes to update the Docker-related files according to the packages you use:
+Re-execute the recipes to update the Docker-related files according to
+the packages you use:
 
-    rm symfony.lock
-    composer recipes:install --force --verbose
+```console
+rm symfony.lock
+composer recipes:install --force --verbose
+```
 
 Double-check the changes, revert the changes that you don't want to keep:
 
-    git diff
-    ...
+```console
+git diff
+```
 
 Build the Docker images:
 
-    docker compose build --pull --no-cache
+```console
+docker compose build --pull --no-cache
+```
 
 Start the project!
 
-    docker compose up --wait
+```console
+docker compose up --wait
+```
 
 Browse `https://localhost`, your Docker configuration is ready!
 
 > [!NOTE]
-> The worker mode of FrankenPHP is enabled by default in the Caddyfile. To disabled it, comment the `worker {}` section of this file.
-> You may also remove `runtime/frankenphp-symfony` if you never plan on using the worker mode.
+>
+> The worker mode of FrankenPHP is enabled by default in the Caddyfile.
+> To disabled it, comment the `worker {}` section of this file.
+>
+> You may also remove `runtime/frankenphp-symfony`
+> if you never plan on using the worker mode.

docs/extra-services.md

@@ -1,18 +1,25 @@
 # Support for Extra Services
 
-Symfony Docker is extensible. When you install a compatible Composer package using Symfony Flex,
-the recipe will automatically modify the `Dockerfile` and `compose.yaml` to fulfill the requirements of this package.
+Symfony Docker is extensible.
+When you install a compatible Composer package using Symfony Flex,
+the recipe will automatically modify the `Dockerfile` and `compose.yaml` files
+to fulfill the requirements of this package.
 
 The currently supported packages are:
 
-* `symfony/orm-pack`: install a PostgreSQL service
-* `symfony/mercure-bundle`: use the Mercure.rocks module shipped with Caddy
-* `symfony/panther`: install chromium and these drivers
-* `symfony/mailer`: install a Mailpit service
-* `blackfireio/blackfire-symfony-meta`: install a Blackfire service
+- `symfony/orm-pack`: install a PostgreSQL service
+- `symfony/mercure-bundle`: use the Mercure.rocks module shipped with Caddy
+- `symfony/panther`: install chromium and these drivers
+- `symfony/mailer`: install a Mailpit service
+- `blackfireio/blackfire-symfony-meta`: install a Blackfire service
 
 > [!NOTE]
+>
 > If a recipe modifies the Dockerfile, the container needs to be rebuilt.
 
+<!-- -->
+
 > [!WARNING]
-> We recommend that you use the `composer require` command inside the container in development mode so that recipes can be applied correctly
+>
+> We recommend that you use the `composer require` command inside the container
+> in development mode so that recipes can be applied correctly