From ab9afaadbdeb797bb88bbadca3f38ddb3d3fd066 Mon Sep 17 00:00:00 2001
From: Michael Beck <mambax7@gmail.com>
Date: Wed, 14 Oct 2026 02:16:42 -0400
Subject: [PATCH 1/3] Add Qodana scanning to pull requests and master

Mirror the XoopsCore26 setup: jetbrains/qodana-php 2026.2 with the qodana.recommended profile, bootstrapped from xoops_lib/composer.dist.lock, with vendor trees, the installer, xoops_data, extras and tests excluded. The scan runs only when the QODANA_TOKEN secret is set.
---
 .github/workflows/qodana.yml | 32 ++++++++++++++++++++++++++++++++
 docs/changelog.270.txt       |  3 +++
 qodana.yaml                  | 22 ++++++++++++++++++++++
 3 files changed, 57 insertions(+)
 create mode 100644 .github/workflows/qodana.yml
 create mode 100644 qodana.yaml

diff --git a/.github/workflows/qodana.yml b/.github/workflows/qodana.yml
new file mode 100644
index 000000000..5d42d207d
--- /dev/null
+++ b/.github/workflows/qodana.yml
@@ -0,0 +1,32 @@
+name: Qodana
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - master
+
+concurrency:
+  group: qodana-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  qodana:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    if: github.repository == 'XOOPS/XoopsCore27'
+    permissions:
+      contents: read
+      pull-requests: write
+      checks: write
+    env:
+      QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
+
+      - name: Qodana Scan
+        if: env.QODANA_TOKEN != ''
+        uses: JetBrains/qodana-action@3e8d76ff0e0241618abd808682f426afe84bab3f # v2026.2.2
diff --git a/docs/changelog.270.txt b/docs/changelog.270.txt
index 4bcc16aac..c226e552b 100644
--- a/docs/changelog.270.txt
+++ b/docs/changelog.270.txt
@@ -10,6 +10,9 @@ Libraries and assets:
 - update the bundled XMF library to 1.3.3: the proxy_env header is only honoured when the direct peer is listed in the new $xoopsConfig['proxy_trusted'] (addresses or CIDR ranges, documented in xoops_data/configs/xoopsconfig.dist.php) — sites that set proxy_env must add proxy_trusted, until then the peer address is used; Forwarded headers are parsed per RFC 7239; Xmf\Mail\SendmailRunner has a delivery timeout; Xmf\Database\Tables keeps CURRENT_TIMESTAMP defaults and refuses tables with functional index parts; Xmf\Security\Serializer accepts every legacy payload; Xmf\Jwt\TokenReader accepts Bearer tokens on custom headers again (xoops_lib/composer.dist.json, xoops_lib/vendor/xoops/xmf)
 - HTML Purifier 4.19.1, firebase/php-jwt 7.2.1, Monolog 3.12.1, Punic 3.8.2, Smarty 4.5.8, symfony/polyfill-mbstring 1.43.0, symfony/var-dumper 7.4.18, symfony/yaml 7.4.20, TCPDF 6.11.4, webmozart/assert 2.5.0 (xoops_lib/composer.dist.lock, xoops_lib/vendor) (#265)
 
+Tooling and CI:
+- Qodana (jetbrains/qodana-php 2026.2, qodana.recommended profile) scans pull requests and master again, as it does on XoopsCore26; the scan installs xoops_lib/composer.dist.lock inside the linter container and skips the vendor trees, the installer, xoops_data, extras and tests; it runs only when the QODANA_TOKEN repository secret is set (qodana.yaml, .github/workflows/qodana.yml) (mamba)
+
 ===================================
 2.7.4 RC 2                    2026-10
 ===================================
diff --git a/qodana.yaml b/qodana.yaml
new file mode 100644
index 000000000..4af53920d
--- /dev/null
+++ b/qodana.yaml
@@ -0,0 +1,22 @@
+version: "1.0"
+
+image: jetbrains/qodana-php:2026.2
+
+profile:
+  name: qodana.recommended
+
+php:
+  version: "8.4"
+
+bootstrap: cd htdocs/xoops_lib && cp composer.dist.json composer.json && cp composer.dist.lock composer.lock && composer install --no-interaction --prefer-dist '--ignore-platform-req=ext-*'
+
+exclude:
+  - name: All
+    paths:
+      - htdocs/xoops_lib/vendor
+      - htdocs/class/libraries/vendor
+      - htdocs/install
+      - htdocs/xoops_data
+      - extras
+      - tests
+      - build

From 8cb05b0c7e433b28e33f9b12bc9655ff2d96bc7d Mon Sep 17 00:00:00 2001
From: Michael Beck <mambax7@gmail.com>
Date: Wed, 14 Oct 2026 02:19:41 -0400
Subject: [PATCH 2/3] Enable CodeRabbit automatic reviews

auto_review was switched off in #97, so every pull request since has shown 'Review skipped'. XoopsCore26 has it on.
---
 .coderabbit.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.coderabbit.yaml b/.coderabbit.yaml
index 3c237cfde..4212bca12 100644
--- a/.coderabbit.yaml
+++ b/.coderabbit.yaml
@@ -14,7 +14,7 @@ reviews:
   review_status: true
   collapse_walkthrough: false
   auto_review:
-    enabled: false
+    enabled: true
     drafts: false
   path_filters:
     # Skip vendored third-party code and generated/lock files (e.g. the

From d5f8c0956f85a17d08c140776e47a181aebae816 Mon Sep 17 00:00:00 2001
From: Michael Beck <mambax7@gmail.com>
Date: Wed, 14 Oct 2026 02:35:06 -0400
Subject: [PATCH 3/3] Restrict default permissions in the Qodana workflow

Workflow-level permissions: {} so the job-level grants are the only ones (zizmor excessive-permissions).
---
 .github/workflows/qodana.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/qodana.yml b/.github/workflows/qodana.yml
index 5d42d207d..51bbee684 100644
--- a/.github/workflows/qodana.yml
+++ b/.github/workflows/qodana.yml
@@ -6,6 +6,8 @@ on:
     branches:
       - master
 
+permissions: {}
+
 concurrency:
   group: qodana-${{ github.ref }}
   cancel-in-progress: true