#CI/CD & Infrastructure

#GitHub Actions Workflows

#1. PHP Analysis (php.yml

)

Runs onmaster upon push or PR:

• PHP 8.3 syntax check of all.php files
• PHPStan Level 6 analysis (512 MB memory limit)
• Composer Audit (AC-3 vulnerability scanning)
• Gitleaks secret scanning

#2. Tests (tests.yml

)

Runs on push tomaster /dev and PRs onmaster :

• MySQL 8.0 service container with health checks
• Test config is generated inline
• Schema import fromadmin/create_sql.sql
• Unit and integration tests with PHPUnit (5-minute timeout)

#3. Docker Smoke Tests (docker-smoke.yml

)

Comprehensive integration tests:

• Build Docker image with cache
• HTTP smoke tests: 200 status codes on 12+ pages (/, /downloads, /events, /contact, /member, …)
• Content checks: OG tags, preload hints, CSRF meta tags on forms
• Social redirect validation: 8 platforms → 302 + Location header
• API structure checks: 13 JSON endpoints
• Admin asset check and 404 handling

#Apache .htaccess Security Headers

Content-Security-Policy: default-src 'self'; script-src 'self' (Admin)
Strict-Transport-Security: max-age=31536000
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin

#Session Hardening

• HttpOnly, SameSite=Lax, Secure -gc_maxlifetime : 3600s

#Caching

• Static Assets: 30 days (images, fonts, WOFF2), 7 days (CSS/JS)
• GZIP Deflate enabled

#Docker Setup

Three containers:

#Database Schema

13 tables (InnoDB, utf8mb4):

#Pretix Integration

-PretixAPI -class with 5-minute cache (SHA256-hashed JSON files incache/pretix/ )

• Endpoints: Quota availability and event list
• API server:https://pretix.eu/api/v1
• Token-based authentication