.github/workflows/build-release.yml (1)

13-15: Use a branch/ref-based concurrency key for pushes.

On push events, github.head_ref is empty, so this falls back to github.run_id and never cancels older master runs. cancel-in-progress only works here for PRs.

Suggested change

 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/build-release.yml around lines 13 - 15, The concurrency
key currently uses github.head_ref || github.run_id which is empty on push
events so runs for the same branch won't cancel; change the group expression to
use the push/ref value (e.g. github.head_ref || github.ref || github.ref_name)
instead of falling back to run_id. Update the concurrency group line (the group:
expression) to something like ${{ github.workflow }}-${{ github.head_ref ||
github.ref || github.ref_name }} so branch-based runs cancel correctly while
keeping PR behavior intact.

.github/workflows/build-release.yml (1)

143-148: Artifact upload may silently succeed with empty or partial content.

If archive creation fails (currently masked by continue-on-error), this step still uploads whatever exists in dist/. Consider adding a verification step or removing continue-on-error from the previous step so failures are caught early.

Suggested verification before upload

+      - name: Verify distribution archives
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          SHORT_SHA="${{ steps.version.outputs.short-sha }}"
+          test -f "dist/opensourcepos.$VERSION.$SHORT_SHA.tgz" || { echo "Missing .tgz archive"; exit 1; }
+          test -f "dist/opensourcepos.$VERSION.$SHORT_SHA.zip" || { echo "Missing .zip archive"; exit 1; }
+
       - name: Upload build artifacts
         uses: actions/upload-artifact@v4

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/build-release.yml around lines 143 - 148, The upload step
using actions/upload-artifact@v4 ("Upload build artifacts") can silently upload
an empty/partial dist/ when the prior archive creation is allowed to fail;
either remove the prior step's continue-on-error so failures stop the workflow,
or add a verification step before the "Upload build artifacts" step that checks
dist/ exists and contains expected files (e.g., non-zero size, specific
filenames or a manifest) and fail the job if the check fails, ensuring the
"Upload build artifacts" step only runs when the verification passes.

.github/workflows/build-release.yml (3)

107-114: ⚠️ Potential issue | 🟠 Major

Fail the workflow when archive creation fails.

gulp compress, the renames, and the whole step are still allowed to fail silently here, but release assumes the ZIP exists. Packaging needs to stay in the success path.

Suggested change

       - name: Create distribution archives
         run: |
+          set -euo pipefail
           gulp compress
           VERSION="${{ steps.version.outputs.version }}"
           SHORT_SHA="${{ steps.version.outputs.short-sha }}"
-          mv dist/opensourcepos.tar.gz "dist/opensourcepos.$VERSION.$SHORT_SHA.tgz" || true
-          mv dist/opensourcepos.zip "dist/opensourcepos.$VERSION.$SHORT_SHA.zip" || true
-        continue-on-error: true
+          mv dist/opensourcepos.tar.gz "dist/opensourcepos.$VERSION.$SHORT_SHA.tgz"
+          mv dist/opensourcepos.zip "dist/opensourcepos.$VERSION.$SHORT_SHA.zip"

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/build-release.yml around lines 107 - 114, The "Create
distribution archives" step currently allows failures to be ignored
(continue-on-error: true) so missing archives won't block the release; change
this by removing continue-on-error and making the shell fail on any command
failure (e.g., enable "set -e" / bash -e behavior) so that "gulp compress", the
subsequent mv commands that use VERSION and SHORT_SHA, and any other errors
cause the job to fail; ensure the step name and commands referencing gulp
compress, VERSION/SHORT_SHA and the mv operations remain, but are executed with
strict failure handling so the workflow fails if archives aren't created or
renamed.

---

160-161: ⚠️ Potential issue | 🔴 Critical

Let schema import failures fail the test job.

Swallowing the SQL import exit code weakens the test gate: PHPUnit can run against a partially initialized database and still report green for unrelated tests.

Suggested change

-      - name: Initialize database
-        run: docker exec -i mysql mysql -u root -proot ospos < app/Database/database.sql || true
+      - name: Initialize database
+        run: docker exec -i mysql mysql -u root -proot ospos < app/Database/database.sql

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/build-release.yml around lines 160 - 161, The "Initialize
database" workflow step is currently swallowing SQL import failures by appending
"|| true" to the docker exec command; remove the "|| true" so the step returns a
non-zero exit code on failure (i.e., change the run command that executes
"docker exec -i mysql mysql -u root -proot ospos < app/Database/database.sql" to
no longer append "|| true") so schema import failures fail the job and surface
as CI errors.

---

230-231: ⚠️ Potential issue | 🟠 Major

Upgrade softprops/action-gh-release from @v1.

actionlint already flags this runner as too old for current GitHub Actions runners. Keeping @v1 will break the release job.

Suggested change

-      - name: Create/Update unstable release
-        uses: softprops/action-gh-release@v1
+      - name: Create/Update unstable release
+        uses: softprops/action-gh-release@v2

Is `softprops/action-gh-release@v1` still supported on GitHub-hosted runners, and what major version should be used instead?

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/build-release.yml around lines 230 - 231, The GitHub
Action usage "softprops/action-gh-release@v1" is pinned to an older major and
should be upgraded to the current major release; replace the usage string in the
workflow step that shows "uses: softprops/action-gh-release@v1" with the
maintained major tag (e.g., "uses: softprops/action-gh-release@v2") to ensure
compatibility with current GitHub-hosted runners and silence actionlint; update
any inputs if the action's v2 changed parameter names.

.github/workflows/build-release.yml (3)

155-168: ⚠️ Potential issue | 🟠 Major

Cap the MariaDB wait loop.

If docker run fails or MariaDB never becomes ready, this step waits until the job timeout. Bound the retries and dump container logs on failure so the job fails quickly and leaves a useful trace.

Suggested change

       - name: Start MariaDB
         run: |
           docker run -d --name mysql \
             -e MYSQL_ROOT_PASSWORD=root \
             -e MYSQL_DATABASE=ospos \
             -e MYSQL_USER=admin \
             -e MYSQL_PASSWORD=pointofsale \
             -p 3306:3306 \
             mariadb:10.5
           
-          until docker exec mysql mysqladmin ping -h 127.0.0.1 -u root -proot --silent; do
-            echo "Waiting for MariaDB..."
-            sleep 2
-          done
+          for i in {1..60}; do
+            if docker exec mysql mysqladmin ping -h 127.0.0.1 -u root -proot --silent; then
+              break
+            fi
+            echo "Waiting for MariaDB... ($i/60)"
+            sleep 2
+          done
+          docker exec mysql mysqladmin ping -h 127.0.0.1 -u root -proot --silent || {
+            echo "MariaDB failed to become ready"
+            docker logs mysql || true
+            exit 1
+          }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/build-release.yml around lines 155 - 168, The "Start
MariaDB" step uses an unbounded until loop (until docker exec mysql mysqladmin
ping ...) which can hang the job; modify that step to cap retries by adding a
counter and max attempts (e.g., MAX_RETRIES) and break with failure when
exceeded, and on failure run docker logs mysql to dump container output before
exiting non-zero so CI fails fast and provides diagnostics; keep the container
name "mysql" and the same mysqladmin check but wrap it in the bounded loop and
ensure the step exits with a non-zero status when max retries are reached.

---

17-20: ⚠️ Potential issue | 🟠 Major

Reduce the default token permissions.

packages: write is unused here, and repo-wide contents: write gives the build/test jobs mutation rights they do not need. Keep the workflow read-only by default and grant contents: write only in release.

Suggested change

 permissions:
-  contents: write
-  packages: write
+  contents: read

   release:
     name: Create Release
     needs: [build, test]
     runs-on: ubuntu-22.04
     if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    permissions:
+      contents: write

Also applies to: 216-220

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/build-release.yml around lines 17 - 20, Change the
workflow's default permissions to read-only by removing or changing "packages:
write" and changing "contents: write" to "contents: read" in the top-level
permissions block, and instead grant "contents: write" only inside the release
job/step that needs to publish (update the release job's permissions to include
contents: write); apply the same edits for the other permissions block instance
referenced (lines 216-220) so the build/test jobs run with least privilege.

---

205-214: ⚠️ Potential issue | 🟠 Major

Derive the Docker repository from configuration.

The job logs in with DOCKER_USERNAME but still pushes to jekkos/opensourcepos, so any other credentials will authenticate and then fail at push time. Pull the namespace from a variable or secret instead; that also keeps the workflow README aligned with the actual image name.

Suggested change

       - name: Build and push Docker images
         uses: docker/build-push-action@v5
+        env:
+          DOCKER_REPO: ${{ secrets.DOCKER_USERNAME }}/opensourcepos
         with:
           context: .
           target: ospos
           platforms: linux/amd64,linux/arm64
           push: true
           tags: |
-            jekkos/opensourcepos:${{ needs.build.outputs.version-tag }}
-            jekkos/opensourcepos:latest
+            ${{ env.DOCKER_REPO }}:${{ needs.build.outputs.version-tag }}
+            ${{ env.DOCKER_REPO }}:latest

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/build-release.yml around lines 205 - 214, Replace the
hardcoded Docker namespace in the "Build and push Docker images" step tags with
a repository namespace variable/secret (e.g., use an env or secret like
DOCKER_REPOSITORY/DOCKER_NAMESPACE) so the action pushes to the configured repo
rather than "jekkos/opensourcepos"; update the tags under the step (the lines
referencing jekkos/opensourcepos:${{ ... }} and jekkos/opensourcepos:latest) to
use that variable, ensure the workflow sets that variable/secret (and that it
aligns with DOCKER_USERNAME credentials used for login), and update any
README/workflow docs referencing the image name to use the same variable.

.github/workflows/build-release.yml (1)

13-15: Use a PR-scoped concurrency key.

For pull_request events, github.head_ref is only the source branch name, so two fork PRs with the same branch name can cancel each other. Prefer the PR number (or include the head repo) so cancellations stay scoped to one PR.

Suggested change

 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/build-release.yml around lines 13 - 15, The concurrency
group uses github.head_ref which can collide across forked PRs; update the
concurrency group expression (the concurrency: group: value) to include a
PR-scoped identifier such as github.event.pull_request.number or the head repo
(e.g., github.head_repository) so the key is unique per PR (for example combine
github.workflow, github.event.pull_request.number and github.head_ref or include
github.head_repository) to prevent different PRs with the same branch name from
cancelling each other.