GitHub Actions Workflow Generator
Generates optimized GitHub Actions workflows for PHP projects.
When to Use
- Setting up CI/CD for a new PHP project
- Adding static analysis, testing, or deployment pipelines
- Migrating from other CI systems to GitHub Actions
- Optimizing existing workflow performance
Generated Files
.github/
└── workflows/
├── ci.yml # Main CI pipeline
├── security.yml # Security scanning
└── deploy.yml # Deployment workflow
Workflow Components
CI Pipeline (ci.yml)
4-stage pipeline with dependency caching and parallel execution:
| Stage |
Jobs |
Purpose |
| 1. Install |
install |
Composer install, upload vendor artifact |
| 2. Analysis |
phpstan, psalm, cs-fixer, deptrac |
Static analysis (parallel) |
| 3. Tests |
test-unit, test-integration |
PHPUnit with coverage upload |
| 4. Build |
build |
Docker image build and push (main/tags only) |
Key features:
- Concurrency control (cancel in-progress runs)
- Composer cache with
actions/cache@v4
- Vendor sharing via
actions/upload-artifact@v4
- Service containers for MySQL and Redis
- Coverage upload to Codecov
- Docker Buildx with GHCR push
Security Workflow (security.yml)
Triggers: push to main, PRs, weekly schedule (Monday).
| Job |
Tool |
Purpose |
dependency-audit |
composer audit |
Known vulnerability check |
psalm-security |
Psalm taint analysis |
Data flow security |
trivy |
Trivy + SARIF |
Container image scanning |
Deploy Workflow (deploy.yml)
Triggers: version tags (v*), manual workflow_dispatch.
| Job |
Condition |
Environment |
deploy-staging |
Push or manual staging |
staging |
deploy-production |
Tags or manual production |
production |
Features: environment protection rules, health checks, sequential staging-then-production.
Matrix Testing
Cross-version testing pattern for libraries:
| Dimension |
Values |
| PHP versions |
8.2, 8.3, 8.4 |
| Dependencies |
lowest, highest |
| Coverage |
Only on PHP 8.4 + highest |
Uses fail-fast: false to run all combinations.
Generation Process
Analyze project:
- Check
composer.json for tools (phpstan, psalm, php-cs-fixer, deptrac)
- Check existing
.github/workflows/ directory
- Identify testing framework (PHPUnit, Pest)
- Check for Docker/docker-compose
Generate appropriate workflows:
- Basic CI if minimal tools detected
- Full CI if all tools present
- Security workflow if sensitive project
- Deploy workflow if infrastructure detected
Customize based on:
- PHP version from
composer.json require.php
- Required services (MySQL, Redis, RabbitMQ)
- Coverage requirements and reporting
- Deployment targets and environments
File Placement
All workflows go in .github/workflows/:
| File |
When Generated |
ci.yml |
Always |
security.yml |
When security tools detected or requested |
deploy.yml |
When deployment infrastructure detected |
Naming Conventions
- Workflow files: lowercase, hyphenated (e.g.,
ci.yml, security.yml)
- Job names: lowercase, hyphenated (e.g.,
test-unit, deploy-staging)
- Step names: sentence case (e.g.,
Run PHPStan, Upload coverage)
- Environment variables: UPPER_SNAKE_CASE (e.g.,
PHP_VERSION, COMPOSER_ARGS)
Quick Template Reference
| Template |
Lines |
Key Actions Used |
| CI Pipeline |
~270 |
checkout@v4, setup-php@v2, cache@v4, upload-artifact@v4, codecov-action@v4, build-push-action@v5 |
| Security |
~70 |
checkout@v4, setup-php@v2, trivy-action, upload-sarif |
| Deploy |
~70 |
checkout@v4, environments, health checks |
| Matrix |
~30 |
setup-php@v2, strategy matrix |
Usage
Provide:
- Project path or
composer.json
- Required environments (staging, production)
- Custom requirements (specific services, notification channels)
The generator will:
- Analyze the project structure
- Generate optimized workflows
- Include caching and parallelization
- Add appropriate triggers and conditions
References
references/templates.md — Full YAML workflow templates (CI, Security, Deploy, Matrix)
references/examples.md — Concrete usage examples (minimal CI, multi-service, caching, artifacts, deployment)
Converted and distributed by TomeVault — claim your Tome and manage your conversions.
1---2name: create-github-actions3description: Generates GitHub Actions workflows for PHP projects. Creates CI/CD pipelines with PHPStan, PHPUnit, code coverage, Docker builds, and deployment stages.4---56# GitHub Actions Workflow Generator78Generates optimized GitHub Actions workflows for PHP projects.910## When to Use1112- Setting up CI/CD for a new PHP project13- Adding static analysis, testing, or deployment pipelines14- Migrating from other CI systems to GitHub Actions15- Optimizing existing workflow performance1617## Generated Files1819```20.github/21└── workflows/22 ├── ci.yml # Main CI pipeline23 ├── security.yml # Security scanning24 └── deploy.yml # Deployment workflow25```2627## Workflow Components2829### CI Pipeline (`ci.yml`)30314-stage pipeline with dependency caching and parallel execution:3233| Stage | Jobs | Purpose |34|-------|------|---------|35| 1. Install | `install` | Composer install, upload vendor artifact |36| 2. Analysis | `phpstan`, `psalm`, `cs-fixer`, `deptrac` | Static analysis (parallel) |37| 3. Tests | `test-unit`, `test-integration` | PHPUnit with coverage upload |38| 4. Build | `build` | Docker image build and push (main/tags only) |3940Key features:41- Concurrency control (cancel in-progress runs)42- Composer cache with `actions/cache@v4`43- Vendor sharing via `actions/upload-artifact@v4`44- Service containers for MySQL and Redis45- Coverage upload to Codecov46- Docker Buildx with GHCR push4748### Security Workflow (`security.yml`)4950Triggers: push to main, PRs, weekly schedule (Monday).5152| Job | Tool | Purpose |53|-----|------|---------|54| `dependency-audit` | `composer audit` | Known vulnerability check |55| `psalm-security` | Psalm taint analysis | Data flow security |56| `trivy` | Trivy + SARIF | Container image scanning |5758### Deploy Workflow (`deploy.yml`)5960Triggers: version tags (`v*`), manual `workflow_dispatch`.6162| Job | Condition | Environment |63|-----|-----------|-------------|64| `deploy-staging` | Push or manual staging | `staging` |65| `deploy-production` | Tags or manual production | `production` |6667Features: environment protection rules, health checks, sequential staging-then-production.6869### Matrix Testing7071Cross-version testing pattern for libraries:7273| Dimension | Values |74|-----------|--------|75| PHP versions | 8.2, 8.3, 8.4 |76| Dependencies | lowest, highest |77| Coverage | Only on PHP 8.4 + highest |7879Uses `fail-fast: false` to run all combinations.8081## Generation Process82831. **Analyze project:**84 - Check `composer.json` for tools (phpstan, psalm, php-cs-fixer, deptrac)85 - Check existing `.github/workflows/` directory86 - Identify testing framework (PHPUnit, Pest)87 - Check for Docker/docker-compose88892. **Generate appropriate workflows:**90 - Basic CI if minimal tools detected91 - Full CI if all tools present92 - Security workflow if sensitive project93 - Deploy workflow if infrastructure detected94953. **Customize based on:**96 - PHP version from `composer.json` `require.php`97 - Required services (MySQL, Redis, RabbitMQ)98 - Coverage requirements and reporting99 - Deployment targets and environments100101## File Placement102103All workflows go in `.github/workflows/`:104105| File | When Generated |106|------|---------------|107| `ci.yml` | Always |108| `security.yml` | When security tools detected or requested |109| `deploy.yml` | When deployment infrastructure detected |110111## Naming Conventions112113- Workflow files: lowercase, hyphenated (e.g., `ci.yml`, `security.yml`)114- Job names: lowercase, hyphenated (e.g., `test-unit`, `deploy-staging`)115- Step names: sentence case (e.g., `Run PHPStan`, `Upload coverage`)116- Environment variables: UPPER_SNAKE_CASE (e.g., `PHP_VERSION`, `COMPOSER_ARGS`)117118## Quick Template Reference119120| Template | Lines | Key Actions Used |121|----------|-------|-----------------|122| CI Pipeline | ~270 | `checkout@v4`, `setup-php@v2`, `cache@v4`, `upload-artifact@v4`, `codecov-action@v4`, `build-push-action@v5` |123| Security | ~70 | `checkout@v4`, `setup-php@v2`, `trivy-action`, `upload-sarif` |124| Deploy | ~70 | `checkout@v4`, environments, health checks |125| Matrix | ~30 | `setup-php@v2`, strategy matrix |126127## Usage128129Provide:130- Project path or `composer.json`131- Required environments (staging, production)132- Custom requirements (specific services, notification channels)133134The generator will:1351. Analyze the project structure1362. Generate optimized workflows1373. Include caching and parallelization1384. Add appropriate triggers and conditions139140## References141142- `references/templates.md` — Full YAML workflow templates (CI, Security, Deploy, Matrix)143- `references/examples.md` — Concrete usage examples (minimal CI, multi-service, caching, artifacts, deployment)144145---146> Converted and distributed by [TomeVault](https://tomevault.io/claim/dykyi-roman) — claim your Tome and manage your conversions.147<!-- tomevault:4.0:skill_md:2026-04-11 -->