From 109813cace45407af21e46a9605b67d826f5870c Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 20 Jun 2025 22:37:22 +0200
Subject: [PATCH] ci: improve tests workflow

- add bun audit step
- improve steps naming
- wait on composer validation, bun and composer audit before running the
  test suite
---
 .github/workflows/tests.yaml | 29 ++++++++++++++++++++++-------
 1 file changed, 22 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 85676ef83..75d5f9b87 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -21,8 +21,8 @@ jobs:
       - name: Validate composer.json
         run: composer validate --check-lock --strict
 
-  security-audit:
-    name: Composer Security Audit
+  composer-audit:
+    name: Composer Audit
     runs-on: ubuntu-latest
     needs: [composer-validate]
     steps:
@@ -38,20 +38,35 @@ jobs:
         id: composer-cache
         uses: actions/cache@v4
         with:
-          path: vendor
+          path: /vendor
           key: php-${{ hashFiles('composer.lock') }}
 
       - name: Install PHP dependencies
         if: steps.composer-cache.outputs.cache-hit != 'true'
         run: composer install --no-progress --no-interaction
 
-      - name: Run Composer Security Audit
+      - name: Run Composer audit
         run: composer audit --locked --abandoned=fail
 
+  bun-audit:
+    name: Bun Audit
+    runs-on: ubuntu-latest
+    needs: [composer-validate]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.2.16
+      - name: Run Bun audit
+        run: bun audit --frozen-lockfile
+
   test:
     name: Tests
     runs-on: ubuntu-latest
-    needs: [composer-validate]
+    needs: [composer-audit, bun-audit]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -69,12 +84,12 @@ jobs:
         id: composer-cache
         uses: actions/cache@v4
         with:
-          path: vendor
+          path: /vendor
           key: php-${{ hashFiles('composer.lock') }}
 
       - name: Install PHP dependencies
         if: steps.composer-cache.outputs.cache-hit != 'true'
         run: composer install --no-progress --no-interaction
 
-      - name: Tests
+      - name: Run tests
         run: composer test:all