[khvn26]

Runs the Flagsmith SDK behavioural spec against this SDK on every pull request and push to main, using the steps-file design from Flagsmith/sdk-spec#3.

// When the application gets the environment flags
function getEnvironmentFlags(Flagsmith $flagsmith): array
{
    return asSpecFlags($flagsmith->getEnvironmentFlags());
}

• sdk-spec/steps.php. One plain function per SDK step, marked with the Gherkin step text as a comment. It holds only SDK calls and the mapping to the spec's flag shape, so it doubles as a working usage example. The spec's PHP harness finds and runs the functions.
• sdk-spec/Dockerfile. Builds the SDK from source with Composer, with Guzzle as the PSR-18 client, and runs the harness on the steps file. No composer.json is needed in sdk-spec/. The directory is export-ignored, so it is not shipped in the package.
• .github/workflows/sdk-spec.yml. Calls the spec's reusable workflow with language: php. It is pinned to v0.3.0. renovate.json bumps the uses: ref and spec-ref together.

The spec currently covers getting environment flags and getting identity flags with traits.

[coderabbitai]

📝 Walkthrough

The change adds PHP helpers and a Docker container for running the SDK behavioural specification. A GitHub Actions workflow invokes the reusable specification workflow for pull requests and pushes to main. Renovate detects and groups updates to the specification version. The sdk-spec directory is excluded from exported archives.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~12 minutes

Merge Risk: 🟠 High · up to b50d6

Merge Risk: 🟠 High · up to b50d6

The new SDK spec workflow points at a spec version that does not appear to exist, so the job cannot run and the CI check the PR adds is nonfunctional. Publish the tag or switch to an existing ref before merging.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 4

🔇 Additional comments: 4

.gitattributes: 1

9-9: LGTM!

.php-cs-fixer.php: 1

7-7: LGTM!

spec-adapter/Dockerfile-17-19: 1

17-19: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

⚠️ Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Run the container as a non-root user.

The image has no USER instruction, so the adapter runs as root. Add a non-root user before CMD. The Composer install runs earlier as root, so the user needs only read access to /sdk.

Proposed fix

 ENV PORT=8080
 EXPOSE 8080
+USER www-data
 CMD ["php", "spec-adapter/adapter.php"]

spec-adapter/composer.json-12-15: 1

12-15: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

⚠️ Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Run composer audit for the new dependency set.

The change adds a new Composer project that requires guzzlehttp/guzzle. The supplied context shows no dependency vulnerability scan for it. Add a composer audit step to CI for spec-adapter. Run it after composer install.

Source: Learnings

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 33890b45-15e7-490c-a5aa-db4faaeb9a30

📥 Commits

Reviewing files that changed from the base of the PR and between fd4bcc9 and 5e28883.

📒 Files selected for processing: 7

• .gitattributes
• .github/workflows/sdk-spec.yml
• .php-cs-fixer.php
• renovate.json
• spec-adapter/Dockerfile
• spec-adapter/adapter.php
• spec-adapter/composer.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 7cdfac7e-19b7-448a-aded-211a351010bc

📥 Commits

Reviewing files that changed from the base of the PR and between 5e28883 and 81f37ee.

📒 Files selected for processing: 4

• .gitattributes
• .github/workflows/sdk-spec.yml
• sdk-spec/Dockerfile
• sdk-spec/steps.php

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.