docs: update README and add pre-commit hook (#173 )

* docs: replace requirements with developer and deployment guide * docs: add CI badge, disclaimer, contributing guide, and license * docs: fix and expand disclaimer based on legal review * docs: clarify test vs dev fixture commands in testing section * feat: add pre-commit hook for staged-file quality checks Adds a versioned .githooks/pre-commit script that runs Rector, PHP-CS-Fixer, and PHPStan on staged PHP files, and Twig-CS-Fixer on staged Twig files. Auto-fixes are re-staged before PHPStan runs. Falls back to docker compose run --rm when the PHP service is not up. Install with: just install-hooks * chore: switch pre-commit hook shebang from bash to zsh
ci: skip dev image build on tags, wait for in-progress CI runs, improve quality error output (#171 )
2026-07-05 15:10:16 +02:00 · 2026-07-03 15:05:29 +00:00 · 2026-07-03 12:28:01 +00:00 · 2026-07-03 12:14:30 +00:00 · 2026-07-03 12:08:58 +00:00 · 2026-07-03 11:54:52 +00:00
11 changed files with 546 additions and 149 deletions
@@ -0,0 +1,48 @@
+#!/usr/bin/env zsh
+setopt ERR_EXIT PIPE_FAIL NOUNSET
+
+# Collect staged PHP and Twig files
+STAGED_PHP=()
+while IFS= read -r file; do
+    [[ -n "$file" ]] && STAGED_PHP+=("$file")
+done < <(git diff --cached --name-only --diff-filter=ACMR | grep -E '\.php$' || true)
+
+STAGED_TWIG=()
+while IFS= read -r file; do
+    [[ -n "$file" ]] && STAGED_TWIG+=("$file")
+done < <(git diff --cached --name-only --diff-filter=ACMR | grep -E '\.twig$' || true)
+
+if [[ ${#STAGED_PHP[@]} -eq 0 && ${#STAGED_TWIG[@]} -eq 0 ]]; then
+    exit 0
+fi
+
+# Use exec if the service is up, otherwise spin up a one-off container
+if docker compose exec -T php true 2>/dev/null; then
+    DOCKER_CMD=(docker compose exec -T php)
+else
+    echo "PHP service not running — using docker compose run..."
+    DOCKER_CMD=(docker compose run --rm php)
+fi
+
+if [[ ${#STAGED_PHP[@]} -gt 0 ]]; then
+    echo "PHP (${#STAGED_PHP[@]} file(s)): Rector → CS-Fixer → PHPStan"
+
+    echo "  → Rector"
+    "${DOCKER_CMD[@]}" vendor/bin/rector process "${STAGED_PHP[@]}"
+    git add "${STAGED_PHP[@]}"
+
+    echo "  → PHP-CS-Fixer"
+    "${DOCKER_CMD[@]}" vendor/bin/php-cs-fixer fix --config=.php-cs-fixer.dist.php "${STAGED_PHP[@]}"
+    git add "${STAGED_PHP[@]}"
+
+    echo "  → PHPStan"
+    "${DOCKER_CMD[@]}" vendor/bin/phpstan analyse "${STAGED_PHP[@]}" --no-progress
+fi
+
+if [[ ${#STAGED_TWIG[@]} -gt 0 ]]; then
+    echo "Twig (${#STAGED_TWIG[@]} file(s)): Twig-CS-Fixer"
+
+    echo "  → Twig-CS-Fixer"
+    "${DOCKER_CMD[@]}" vendor/bin/twig-cs-fixer fix "${STAGED_TWIG[@]}"
+    git add "${STAGED_TWIG[@]}"
+fi
@@ -28,3 +28,7 @@ updates:
    directory: "/"
    schedule:
      interval: "daily"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
@@ -17,49 +17,130 @@ permissions:
  contents: read

 jobs:
+  build:
+    name: Build Dev Image
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    if: "!startsWith(github.ref, 'refs/tags/')"
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+      - name: Lint Dockerfile
+        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - name: Build Docker images
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
+        with:
+          pull: true
+          files: |
+            compose.yaml
+            compose.override.yaml
+          set: |
+            *.cache-from=type=gha,scope=${{github.ref}}-devbuild
+            *.cache-from=type=gha,scope=refs/heads/main-devbuild
+            *.cache-to=type=gha,scope=${{github.ref}}-devbuild,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }}
+
+  quality:
+    name: Code Quality
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    needs: build
+    if: "!startsWith(github.ref, 'refs/tags/')"
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - name: Load Docker images
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
+        with:
+          load: true
+          files: |
+            compose.yaml
+            compose.override.yaml
+          set: |
+            *.cache-from=type=gha,scope=${{github.ref}}-devbuild
+      - name: Start services
+        run: docker compose up php database --wait --no-build
+      - name: Warm up dev cache
+        run: docker compose exec -T php bin/console cache:warmup --env=dev
+      - name: Lint Twig templates
+        id: twig_lint
+        continue-on-error: true
+        run: docker compose exec -T php bin/console lint:twig --format=github templates
+      - name: Coding Style
+        id: cs
+        continue-on-error: true
+        run: docker compose exec -T php vendor/bin/php-cs-fixer check --diff --show-progress=none
+      - name: Twig Coding Style
+        id: twig_cs
+        continue-on-error: true
+        run: docker compose exec -T php vendor/bin/twig-cs-fixer check
+      - name: Static Analysis (PHPStan)
+        id: phpstan
+        continue-on-error: true
+        run: docker compose exec -T php vendor/bin/phpstan analyse --no-progress --no-ansi --error-format=github
+      - name: Rector
+        id: rector
+        continue-on-error: true
+        run: docker compose exec -T php vendor/bin/rector process --dry-run --no-progress-bar --output-format=github
+      - name: Check HTTP reachability
+        run: curl -v --fail-with-body http://localhost
+      - name: Assert all checks passed
+        if: always()
+        run: |
+          failed=0
+          check() {
+            local name="$1" outcome="$2"
+            if [[ "$outcome" == "failure" ]]; then
+              echo "::error::$name failed"
+              failed=1
+            fi
+          }
+          check "Twig Lint"        "${{ steps.twig_lint.outcome }}"
+          check "Coding Style"     "${{ steps.cs.outcome }}"
+          check "Twig Coding Style" "${{ steps.twig_cs.outcome }}"
+          check "PHPStan"          "${{ steps.phpstan.outcome }}"
+          check "Rector"           "${{ steps.rector.outcome }}"
+          exit $failed
+
  tests:
    name: Tests
    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    needs: build
+    if: "!startsWith(github.ref, 'refs/tags/')"
    permissions:
      checks: write
      pull-requests: write
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Lint Dockerfile
-        uses: hadolint/hadolint-action@v3.1.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Build Docker images
-        uses: docker/bake-action@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - name: Load Docker images
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
        with:
-          pull: true
          load: true
          files: |
            compose.yaml
            compose.override.yaml
          set: |
-            *.cache-from=type=gha,scope=${{github.ref}}
-            *.cache-from=type=gha,scope=refs/heads/main
-            *.cache-to=type=gha,scope=${{github.ref}},mode=max
+            *.cache-from=type=gha,scope=${{github.ref}}-devbuild
      - name: Start services
        run: docker compose up php database --wait --no-build
-      - name: Lint Twig templates
-        run: docker compose exec -T php bin/console lint:twig --format=github templates
-      - name: Coding Style
-        run: docker compose exec -T php vendor/bin/php-cs-fixer check --diff --show-progress=none
-      - name: Twig Coding Style
-        run: docker compose exec -T php vendor/bin/twig-cs-fixer check
-      - name: Static Analysis (PHPStan)
-        run: docker compose exec -T php vendor/bin/phpstan analyse --no-progress --no-ansi --error-format=github
-      - name: Rector
-        run: docker compose exec -T php vendor/bin/rector process --dry-run --no-progress-bar --output-format=github
-      - name: Check HTTP reachability
-        run: curl -v --fail-with-body http://localhost
-      - name: Check Mercure reachability
-        if: false
-        run: curl -vkI --fail-with-body https://localhost/.well-known/mercure?topic=test
      - name: Create test database
        run: docker compose exec -T php bin/console -e test doctrine:database:create
      - name: Run migrations
@@ -70,31 +151,78 @@ jobs:
        run: docker compose exec -T php vendor/bin/phpunit --log-junit var/phpunit/junit.xml
      - name: Publish PHPUnit test results
        if: always()
-        uses: mikepenz/action-junit-report@v5
+        uses: mikepenz/action-junit-report@d9f48fc87bc235f7e214acf696ca5abc0a986f16 # v6
        with:
          report_paths: var/phpunit/junit.xml
          check_name: PHPUnit
      - name: Doctrine Schema Validator
        run: docker compose exec -T php bin/console -e test doctrine:schema:validate

+  verify-prior-run:
+    name: Verify Prior CI Run
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    if: startsWith(github.ref, 'refs/tags/')
+    permissions:
+      actions: read
+    steps:
+      - name: Wait for and verify successful CI run on this commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          max_attempts=30
+          attempt=0
+          while [[ $attempt -lt $max_attempts ]]; do
+            attempt=$((attempt + 1))
+
+            success_count=$(gh api \
+              "repos/${{ github.repository }}/actions/workflows/ci.yml/runs?head_sha=${{ github.sha }}&status=success&per_page=5" \
+              --jq "[.workflow_runs[] | select(.id != ${{ github.run_id }})] | length")
+
+            if [[ "$success_count" -gt 0 ]]; then
+              echo "Found $success_count prior successful CI run(s) for ${{ github.sha }}."
+              exit 0
+            fi
+
+            in_progress_count=$(gh api \
+              "repos/${{ github.repository }}/actions/workflows/ci.yml/runs?head_sha=${{ github.sha }}&per_page=10" \
+              --jq "[.workflow_runs[] | select(.id != ${{ github.run_id }}) | select(.status == \"in_progress\" or .status == \"queued\" or .status == \"waiting\" or .status == \"requested\" or .status == \"pending\")] | length")
+
+            if [[ "$in_progress_count" -gt 0 ]]; then
+              echo "CI still in progress (attempt $attempt/$max_attempts), waiting 30s..."
+              sleep 30
+            else
+              echo "::error::No prior successful CI run found for ${{ github.sha }}. Only tag commits that have passed CI on main."
+              exit 1
+            fi
+          done
+
+          echo "::error::Timed out waiting for CI run to complete for ${{ github.sha }}."
+          exit 1
+
  build-deploy:
-    name: Build and deploy to ${{ startsWith(github.ref, 'refs/tags/') && 'production' || (github.ref == 'refs/heads/main' && 'acceptance' || '') }}
+    name: Build and Deploy
    permissions:
      contents: read
      packages: write
    environment:
-      name: ${{ startsWith(github.ref, 'refs/tags/') && 'production' || (github.ref == 'refs/heads/main' && 'acceptance' || '') }}
+      name: ${{ startsWith(github.ref, 'refs/tags/') && 'production' || 'acceptance' }}
      url: ${{ vars.URL }}
-    needs: tests
+    needs: [quality, tests, verify-prior-run]
    runs-on: ubuntu-latest
-    if: (github.ref == 'refs/heads/main' && false) || startsWith(github.ref, 'refs/tags/')
+    timeout-minutes: 15
+    if: >-
+      always() && !cancelled() && !failure() &&
+      ((github.ref == 'refs/heads/main' && false) || startsWith(github.ref, 'refs/tags/'))
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -106,20 +234,23 @@ jobs:
          REPO_LOWER=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
            TAG="${GITHUB_REF#refs/tags/}"
+            SENTRY_VERSION="${TAG#v}"
            {
              echo "tag=$TAG"
+              echo "sentry_version=$SENTRY_VERSION"
              echo "full_name=ghcr.io/${REPO_LOWER}:$TAG"
            } >> "$GITHUB_OUTPUT"
          else
            SHORT_SHA=$(git rev-parse --short HEAD)
            {
              echo "tag=$SHORT_SHA"
+              echo "sentry_version=$SHORT_SHA"
              echo "full_name=ghcr.io/${REPO_LOWER}:$SHORT_SHA"
            } >> "$GITHUB_OUTPUT"
          fi

      - name: Build and Push Docker images
-        uses: docker/bake-action@v5
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
        with:
          pull: true
          push: true
@@ -133,18 +264,20 @@ jobs:
            *.tags=${{ steps.meta.outputs.full_name }}

      - name: Create Sentry release
-        uses: getsentry/action-release@v3
+        uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
        with:
-          release: ${{steps.meta.outputs.tag}}
-          environment: ${{ startsWith(github.ref, 'refs/tags/') && 'production' || (github.ref == 'refs/heads/main' && 'acceptance' || '') }}
+          release: ${{steps.meta.outputs.sentry_version}}
+          environment: ${{ startsWith(github.ref, 'refs/tags/') && 'production' || 'acceptance' }}

      - name: Trigger Portainer Deployment
        shell: bash
        env:
          PORTAINER_WEBHOOK: ${{secrets.PORTAINER_WEBHOOK}}
+          IMAGE_TAG: ${{steps.meta.outputs.tag}}
+          SENTRY_RELEASE: ${{steps.meta.outputs.sentry_version}}
        run: |
-          curl -v -X POST "$PORTAINER_WEBHOOK"?IMAGE_TAG=${{steps.meta.outputs.tag}} --fail-with-body
+          curl -v -X POST "${PORTAINER_WEBHOOK}?IMAGE_TAG=${IMAGE_TAG}&SENTRY_RELEASE=${SENTRY_RELEASE}" --fail-with-body
@@ -12,7 +12,7 @@ jobs:
    steps:
      - name: Dependabot metadata
        id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@v3
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      - name: Enable auto-merge for Dependabot PRs
@@ -51,6 +51,11 @@ reload-tests:
    @docker compose exec php bin/console --env=test doctrine:migrations:migrate -n
    @docker compose exec php bin/console --env=test doctrine:fixtures:load -n --group=test

+install-hooks:
+    git config core.hooksPath .githooks
+    chmod +x .githooks/pre-commit
+    @echo "Pre-commit hook installed."
+
 trust-cert:
    sudo security add-trusted-cer -d \
    -r trustRoot \
@@ -1,39 +1,162 @@
 # Tijd voor de test

+![CI](https://github.com/MarijnDoeve/TijdVoorDeTest/actions/workflows/ci.yml/badge.svg)
+
+PHP/Symfony application for WIDM-style quiz management.
+Built with FrankenPHP, PostgreSQL, and Docker.
+
+> **Disclaimer:** This is an unofficial, non-commercial, open-source fan
+> project. It is not affiliated with, endorsed by, or associated with
+> *Wie is de Mol?* (produced by IDTV, broadcast by AVROTROS/NPO) or
+> *De Mol* (produced by Woestijnvis, broadcast by Play/De Vijver Media).
+> *Wie is de Mol?* and *De Mol* are trademarks of their respective rights
+> holders. No copyright infringement is intended.
+
 ## Requirements

-### Maken van de test
+- Docker
+- [Just](https://just.systems) (`brew install just`)

- WIDM-tests met een variabel aantal vragen.
- Vragen in een vaste volgorde zijn samen één test (een vraag kan niet bij
-  meerdere tests horen).
- Vragen hebben 2 of meer antwoordmogelijkheden. Slechts één antwoord is correct.
- Meerdere test samen vormen een seizoen.
- Een seizoen heeft één of geen actieve tests, als er een test actief is kan
-  uitsluitend die test gemaakt worden.
- Kandidaten kunnen een test maximaal 1 keer invullen.
- Vanaf het moment dat de kandidaat op start klikt na het intypen van hun naam
-  gaat de tijd lopen. Deze stopt na het aanklikken van een antwoord op de laatste
-  vraag van de test.
- Achtergrondmuziek
+## Local development

-### Schermen kijken
+```bash
+just up        # Start PHP + PostgreSQL containers
+just migrate   # Run pending database migrations
+just fixtures  # Load dev fixtures (truncates first)
+```

- Nadat een speler een test heeft gemaakt (of vooraf als de namen vooraf
-  ingevoerd zijn) kunnen jokers toegekend worden aan de test van kandidaat. Een
-  positief getal om antwoorden goed te rekenen, een negatief getal om
-  antwoorden fout te rekenen.
- Vooraf kan gekozen worden hoe veel afvallers er zijn.
- Bij het kijken naam rode en groene schermen wordt een naam ingevoerd. Er
-  wordt een rood of groen scherm getoond.
- Spelers kunnen geforceerd op groen of rood gezet worden, deze worden dan niet
-  meegenomen in de berekening van de slechtste speler.
+The app is available at **https://localhost** (self-signed cert — run
+`just trust-cert` on macOS to trust it).

-### Statistieken
+### Useful commands

-TBD
+```bash
+just shell              # Shell inside the running PHP container
+just shell-run          # Shell in a fresh one-off container
+just stop               # Stop containers (keep volumes)
+just down               # Stop and remove containers
+just clean              # Nuclear: remove containers + volumes + generated files
+just exec <cmd>         # Run any command inside the PHP container
+```

-## Nice to haves
+### Environment

- Optie voor antwoord geven in twee klikken (selecteren en volgende).
+Copy `.env` and override locally via `.env.local` (not committed):

+| Variable       | Description                         |
+|----------------|-------------------------------------|
+| `APP_SECRET`   | Symfony app secret                  |
+| `DATABASE_URL` | PostgreSQL DSN (auto-set in Docker) |
+| `SENTRY_DSN`   | Sentry error tracking               |
+| `DEFAULT_URI`  | Base URL for CLI-generated links    |
+
+## Testing
+
+```bash
+just test                                   # Full PHPUnit suite
+just test tests/Path/To/TestFile.php        # Single file
+just test --coverage-html var/coverage      # HTML coverage report
+just reload-tests             # Drop/recreate test DB + migrate + test fixtures
+```
+
+Tests use a separate database configured via `.env.test`. The DAMA
+Doctrine bundle wraps each test in a transaction that is rolled back after.
+`just reload-tests` loads the `--group=test` fixtures; `just fixtures`
+loads the dev group and is unrelated to the test database.
+
+## Code quality
+
+All checks run in CI and must pass before merging.
+
+```bash
+just fix-cs              # Auto-fix PHP-CS-Fixer + Twig-CS-Fixer
+just phpstan             # PHPStan static analysis (level 8)
+just rector              # Apply Rector modernizations
+just rector --dry-run    # Preview Rector changes without applying
+```
+
+## Database
+
+```bash
+just migrate                      # Run pending migrations
+just fixtures                     # Load dev fixtures
+bin/console make:migration        # Generate a new migration (inside container)
+```
+
+Migrations live in `migrations/` (namespace `DoctrineMigrations`). Test
+fixtures are in `src/DataFixtures/` loaded with `--group=test`.
+
+## Translations
+
+```bash
+just translations    # Extract/update nl translation strings into translations/
+```
+
+## Contributing
+
+1. Create a branch from `main` — use a prefix like `feat/`, `fix/`,
+   or `docs/`.
+2. Open a pull request; CI must pass before merging.
+3. Install the pre-commit hook (see below) to catch issues before pushing.
+
+### Pre-commit hook
+
+A pre-commit hook lives in `.githooks/pre-commit`. Install it once after cloning:
+
+```bash
+just install-hooks
+```
+
+On every commit it runs automatically, **only on staged files**:
+
+| Staged file type        | Tools run                                                                    |
+|-------------------------|------------------------------------------------------------------------------|
+| `.php`                  | Rector → PHP-CS-Fixer (auto-fix + re-stage), then PHPStan (blocks on errors) |
+| `.twig`                 | Twig-CS-Fixer (auto-fix + re-stage)                                          |
+| Other (docs, config, …) | Nothing — commit proceeds immediately                                        |
+
+If the PHP container is not running, the hook falls back to
+`docker compose run --rm` so checks still execute. PHPUnit is not
+run in the hook; CI covers that.
+
+## Deployment
+
+Docker images are published to `ghcr.io/marijndoeve/tijdvoordetest`
+for each tagged release.
+
+### First-time setup
+
+1. Copy `compose.yaml` and `compose.prod.yaml` to your server.
+2. Create a `.env.prod.local` file with the required variables (see below).
+3. Start the stack — migrations run automatically on container start:
+
+```bash
+IMAGE_TAG=latest docker compose -f compose.yaml -f compose.prod.yaml up -d
+```
+
+### Updating to a new version
+
+```bash
+IMAGE_TAG=<tag> docker compose -f compose.yaml -f compose.prod.yaml pull
+IMAGE_TAG=<tag> docker compose -f compose.yaml -f compose.prod.yaml up -d
+```
+
+### Required environment variables
+
+| Variable                   | Description                                 |
+|----------------------------|---------------------------------------------|
+| `IMAGE_TAG`                | Image tag to run (e.g. `1.2.3` or `latest`) |
+| `APP_SECRET`               | Random secret string for Symfony            |
+| `CADDY_MERCURE_JWT_SECRET` | JWT secret for the Mercure hub              |
+| `POSTGRES_PASSWORD`        | PostgreSQL password                         |
+| `MAILER_DSN`               | Mailer transport DSN                        |
+| `MAILER_SENDER`            | From address for emails                     |
+| `SENTRY_DSN`               | Sentry project DSN (optional)               |
+
+The `compose.prod.yaml` configures Traefik labels for TLS termination at
+`tijdvoordetest.nl`. Adjust the `traefik` labels in that file if you're
+hosting on a different domain or using a different reverse proxy.
+
+## License
+
+[MIT](LICENSE)
@@ -10,7 +10,7 @@ services:
      MAILER_DSN: ${MAILER_DSN}
      MAILER_SENDER: ${MAILER_SENDER}
      SENTRY_DSN: ${SENTRY_DSN}
-      SENTRY_RELEASE: ${IMAGE_TAG}
+      SENTRY_RELEASE: ${SENTRY_RELEASE}
      SENTRY_ENVIRONMENT: ${SENTRY_ENVIRONMENT}
    labels:
      - "traefik.enable=true"
@@ -1839,16 +1839,16 @@
        },
        {
            "name": "martin-georgiev/postgresql-for-doctrine",
-            "version": "v4.6.0",
+            "version": "v4.7.0",
            "source": {
                "type": "git",
                "url": "https://github.com/martin-georgiev/postgresql-for-doctrine.git",
-                "reference": "59841c7e53f8339b13bc0cb0ee9931b7b9bbb139"
+                "reference": "23b5c2694083355ab87eaa913b43a0cddd8c64bb"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/martin-georgiev/postgresql-for-doctrine/zipball/59841c7e53f8339b13bc0cb0ee9931b7b9bbb139",
-                "reference": "59841c7e53f8339b13bc0cb0ee9931b7b9bbb139",
+                "url": "https://api.github.com/repos/martin-georgiev/postgresql-for-doctrine/zipball/23b5c2694083355ab87eaa913b43a0cddd8c64bb",
+                "reference": "23b5c2694083355ab87eaa913b43a0cddd8c64bb",
                "shasum": ""
            },
            "require": {
@@ -1863,13 +1863,13 @@
                "deptrac/deptrac": "^4.0",
                "doctrine/orm": "~2.14||~3.0",
                "ekino/phpstan-banned-code": "^3.2.0",
-                "friendsofphp/php-cs-fixer": "^3.95.2",
-                "phpstan/phpstan": "^2.1.55",
+                "friendsofphp/php-cs-fixer": "^3.95.11",
+                "phpstan/phpstan": "^2.2.2",
                "phpstan/phpstan-deprecation-rules": "^2.0.4",
-                "phpstan/phpstan-doctrine": "^2.0.22",
+                "phpstan/phpstan-doctrine": "^2.0.27",
                "phpstan/phpstan-phpunit": "^2.0.16",
                "phpunit/phpunit": "^10.5.63||^11.5",
-                "rector/rector": "^2.4.4",
+                "rector/rector": "^2.5.2",
                "symfony/cache": "^6.4||^7.0",
                "symfony/var-exporter": "^6.4||^7.0"
            },
@@ -1952,7 +1952,7 @@
            ],
            "support": {
                "issues": "https://github.com/martin-georgiev/postgresql-for-doctrine/issues",
-                "source": "https://github.com/martin-georgiev/postgresql-for-doctrine/tree/v4.6.0"
+                "source": "https://github.com/martin-georgiev/postgresql-for-doctrine/tree/v4.7.0"
            },
            "funding": [
                {
@@ -1964,7 +1964,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-05-29T19:11:20+00:00"
+            "time": "2026-07-01T18:17:39+00:00"
        },
        {
            "name": "phpdocumentor/reflection-common",
@@ -9287,16 +9287,16 @@
        },
        {
            "name": "friendsofphp/php-cs-fixer",
-            "version": "v3.95.8",
+            "version": "v3.95.11",
            "source": {
                "type": "git",
                "url": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer.git",
-                "reference": "4140023f552ff02346df9b1329742532166f677f"
+                "reference": "35f98e1293283397824d7f349ce5afb8747c3cd5"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/PHP-CS-Fixer/PHP-CS-Fixer/zipball/4140023f552ff02346df9b1329742532166f677f",
-                "reference": "4140023f552ff02346df9b1329742532166f677f",
+                "url": "https://api.github.com/repos/PHP-CS-Fixer/PHP-CS-Fixer/zipball/35f98e1293283397824d7f349ce5afb8747c3cd5",
+                "reference": "35f98e1293283397824d7f349ce5afb8747c3cd5",
                "shasum": ""
            },
            "require": {
@@ -9330,7 +9330,7 @@
            "require-dev": {
                "facile-it/paraunit": "^1.3.1 || ^2.11.0",
                "infection/infection": "^0.32.7",
-                "justinrainbow/json-schema": "^6.9.0",
+                "justinrainbow/json-schema": "^6.10.0",
                "keradus/cli-executor": "^2.3",
                "mikey179/vfsstream": "^1.6.12",
                "php-coveralls/php-coveralls": "^2.9.1",
@@ -9380,7 +9380,7 @@
            ],
            "support": {
                "issues": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/issues",
-                "source": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/tree/v3.95.8"
+                "source": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/tree/v3.95.11"
            },
            "funding": [
                {
@@ -9388,7 +9388,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-06-16T09:52:26+00:00"
+            "time": "2026-06-25T14:17:04+00:00"
        },
        {
            "name": "myclabs/deep-copy",
@@ -9676,11 +9676,11 @@
        },
        {
            "name": "phpstan/phpstan",
-            "version": "2.2.2",
+            "version": "2.2.4",
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/e5cc34d491a90e79c216d824f60fe21fd4d93bd6",
-                "reference": "e5cc34d491a90e79c216d824f60fe21fd4d93bd6",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/f0fe3fb03bb53ce68cc2416785b260e62226ec27",
+                "reference": "f0fe3fb03bb53ce68cc2416785b260e62226ec27",
                "shasum": ""
            },
            "require": {
@@ -9736,7 +9736,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-06-05T09:00:01+00:00"
+            "time": "2026-07-03T07:00:23+00:00"
        },
        {
            "name": "phpstan/phpstan-doctrine",
@@ -9817,21 +9817,22 @@
        },
        {
            "name": "phpstan/phpstan-phpunit",
-            "version": "2.0.16",
+            "version": "2.0.17",
            "source": {
                "type": "git",
                "url": "https://github.com/phpstan/phpstan-phpunit.git",
-                "reference": "6ab598e1bc106e6827fd346ae4a12b4a5d634c32"
+                "reference": "c2f977551f0736d60467b3d754b2e0cf4e337b3f"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan-phpunit/zipball/6ab598e1bc106e6827fd346ae4a12b4a5d634c32",
-                "reference": "6ab598e1bc106e6827fd346ae4a12b4a5d634c32",
+                "url": "https://api.github.com/repos/phpstan/phpstan-phpunit/zipball/c2f977551f0736d60467b3d754b2e0cf4e337b3f",
+                "reference": "c2f977551f0736d60467b3d754b2e0cf4e337b3f",
                "shasum": ""
            },
            "require": {
+                "phar-io/version": "^3.2",
                "php": "^7.4 || ^8.0",
-                "phpstan/phpstan": "^2.1.32"
+                "phpstan/phpstan": "^2.2.3"
            },
            "conflict": {
                "phpunit/phpunit": "<7.0"
@@ -9841,7 +9842,8 @@
                "php-parallel-lint/php-parallel-lint": "^1.2",
                "phpstan/phpstan-deprecation-rules": "^2.0",
                "phpstan/phpstan-strict-rules": "^2.0",
-                "phpunit/phpunit": "^9.6"
+                "phpunit/phpunit": "^9.6",
+                "shipmonk/name-collision-detector": "^2.1"
            },
            "type": "phpstan-extension",
            "extra": {
@@ -9867,9 +9869,9 @@
            ],
            "support": {
                "issues": "https://github.com/phpstan/phpstan-phpunit/issues",
-                "source": "https://github.com/phpstan/phpstan-phpunit/tree/2.0.16"
+                "source": "https://github.com/phpstan/phpstan-phpunit/tree/2.0.17"
            },
-            "time": "2026-02-14T09:05:21+00:00"
+            "time": "2026-06-29T05:32:23+00:00"
        },
        {
            "name": "phpstan/phpstan-symfony",
@@ -10330,16 +10332,16 @@
        },
        {
            "name": "phpunit/phpunit",
-            "version": "13.2.1",
+            "version": "13.2.2",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/phpunit.git",
-                "reference": "60da0ff1e10a0f72ee18a24117ec3b613a346bba"
+                "reference": "492c067e618de7b3c76105082c90f9d2833401b7"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/60da0ff1e10a0f72ee18a24117ec3b613a346bba",
-                "reference": "60da0ff1e10a0f72ee18a24117ec3b613a346bba",
+                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/492c067e618de7b3c76105082c90f9d2833401b7",
+                "reference": "492c067e618de7b3c76105082c90f9d2833401b7",
                "shasum": ""
            },
            "require": {
@@ -10410,7 +10412,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/phpunit/issues",
                "security": "https://github.com/sebastianbergmann/phpunit/security/policy",
-                "source": "https://github.com/sebastianbergmann/phpunit/tree/13.2.1"
+                "source": "https://github.com/sebastianbergmann/phpunit/tree/13.2.2"
            },
            "funding": [
                {
@@ -10418,7 +10420,7 @@
                    "type": "other"
                }
            ],
-            "time": "2026-06-15T13:14:22+00:00"
+            "time": "2026-06-29T13:36:29+00:00"
        },
        {
            "name": "react/cache",
@@ -10948,16 +10950,16 @@
        },
        {
            "name": "rector/rector",
-            "version": "2.4.6",
+            "version": "2.5.2",
            "source": {
                "type": "git",
                "url": "https://github.com/rectorphp/rector.git",
-                "reference": "9b9e5c76618e4d359f65b54ca2eabcad3d1761ee"
+                "reference": "49ff6339174bdbdf50b0b35ecbcff14a05ac9e24"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/rectorphp/rector/zipball/9b9e5c76618e4d359f65b54ca2eabcad3d1761ee",
-                "reference": "9b9e5c76618e4d359f65b54ca2eabcad3d1761ee",
+                "url": "https://api.github.com/repos/rectorphp/rector/zipball/49ff6339174bdbdf50b0b35ecbcff14a05ac9e24",
+                "reference": "49ff6339174bdbdf50b0b35ecbcff14a05ac9e24",
                "shasum": ""
            },
            "require": {
@@ -10996,7 +10998,7 @@
            ],
            "support": {
                "issues": "https://github.com/rectorphp/rector/issues",
-                "source": "https://github.com/rectorphp/rector/tree/2.4.6"
+                "source": "https://github.com/rectorphp/rector/tree/2.5.2"
            },
            "funding": [
                {
@@ -11004,7 +11006,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-06-17T11:56:28+00:00"
+            "time": "2026-06-22T11:39:33+00:00"
        },
        {
            "name": "sebastian/cli-parser",
@@ -12167,16 +12169,16 @@
        },
        {
            "name": "symfony/browser-kit",
-            "version": "v8.1.0",
+            "version": "v8.1.1",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/browser-kit.git",
-                "reference": "74e18e582cdda0eca35f7c74e1e48e62f0ede853"
+                "reference": "f2ac86001ca9f487e8c6d0e11c8e33e6a9b8b2d5"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/browser-kit/zipball/74e18e582cdda0eca35f7c74e1e48e62f0ede853",
-                "reference": "74e18e582cdda0eca35f7c74e1e48e62f0ede853",
+                "url": "https://api.github.com/repos/symfony/browser-kit/zipball/f2ac86001ca9f487e8c6d0e11c8e33e6a9b8b2d5",
+                "reference": "f2ac86001ca9f487e8c6d0e11c8e33e6a9b8b2d5",
                "shasum": ""
            },
            "require": {
@@ -12215,7 +12217,7 @@
            "description": "Simulates the behavior of a web browser, allowing you to make requests, click on links and submit forms programmatically",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/browser-kit/tree/v8.1.0"
+                "source": "https://github.com/symfony/browser-kit/tree/v8.1.1"
            },
            "funding": [
                {
@@ -12235,7 +12237,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-29T05:06:50+00:00"
+            "time": "2026-06-09T10:54:51+00:00"
        },
        {
            "name": "symfony/css-selector",
@@ -12308,16 +12310,16 @@
        },
        {
            "name": "symfony/dom-crawler",
-            "version": "v8.1.0",
+            "version": "v8.1.1",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/dom-crawler.git",
-                "reference": "77ca351474ea018daba5f2e473cbf1b9b8e72ac6"
+                "reference": "1dfadd25537c8fcb6752cce5775f24647d976bdc"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/dom-crawler/zipball/77ca351474ea018daba5f2e473cbf1b9b8e72ac6",
-                "reference": "77ca351474ea018daba5f2e473cbf1b9b8e72ac6",
+                "url": "https://api.github.com/repos/symfony/dom-crawler/zipball/1dfadd25537c8fcb6752cce5775f24647d976bdc",
+                "reference": "1dfadd25537c8fcb6752cce5775f24647d976bdc",
                "shasum": ""
            },
            "require": {
@@ -12354,7 +12356,7 @@
            "description": "Eases DOM navigation for HTML and XML documents",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/dom-crawler/tree/v8.1.0"
+                "source": "https://github.com/symfony/dom-crawler/tree/v8.1.1"
            },
            "funding": [
                {
@@ -12374,7 +12376,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-29T05:06:50+00:00"
+            "time": "2026-06-05T06:23:12+00:00"
        },
        {
            "name": "symfony/maker-bundle",
@@ -12477,16 +12479,16 @@
        },
        {
            "name": "symfony/phpunit-bridge",
-            "version": "v8.1.0",
+            "version": "v8.1.1",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/phpunit-bridge.git",
-                "reference": "1fed488f8033f2dece371e60a1c66f2add274916"
+                "reference": "3e1c9a9167e07474ec115555b632f0ffadb0f94d"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/phpunit-bridge/zipball/1fed488f8033f2dece371e60a1c66f2add274916",
-                "reference": "1fed488f8033f2dece371e60a1c66f2add274916",
+                "url": "https://api.github.com/repos/symfony/phpunit-bridge/zipball/3e1c9a9167e07474ec115555b632f0ffadb0f94d",
+                "reference": "3e1c9a9167e07474ec115555b632f0ffadb0f94d",
                "shasum": ""
            },
            "require": {
@@ -12538,7 +12540,7 @@
                "testing"
            ],
            "support": {
-                "source": "https://github.com/symfony/phpunit-bridge/tree/v8.1.0"
+                "source": "https://github.com/symfony/phpunit-bridge/tree/v8.1.1"
            },
            "funding": [
                {
@@ -12558,20 +12560,20 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-29T05:06:50+00:00"
+            "time": "2026-06-09T10:54:51+00:00"
        },
        {
            "name": "symfony/web-profiler-bundle",
-            "version": "v8.1.0",
+            "version": "v8.1.1",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/web-profiler-bundle.git",
-                "reference": "f8ccea08797a511b85a698b0da40e1b9e6461086"
+                "reference": "eb4cf71d8fc496d790ec85b1b684a7ac30d57a96"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/web-profiler-bundle/zipball/f8ccea08797a511b85a698b0da40e1b9e6461086",
-                "reference": "f8ccea08797a511b85a698b0da40e1b9e6461086",
+                "url": "https://api.github.com/repos/symfony/web-profiler-bundle/zipball/eb4cf71d8fc496d790ec85b1b684a7ac30d57a96",
+                "reference": "eb4cf71d8fc496d790ec85b1b684a7ac30d57a96",
                "shasum": ""
            },
            "require": {
@@ -12623,7 +12625,7 @@
                "dev"
            ],
            "support": {
-                "source": "https://github.com/symfony/web-profiler-bundle/tree/v8.1.0"
+                "source": "https://github.com/symfony/web-profiler-bundle/tree/v8.1.1"
            },
            "funding": [
                {
@@ -12643,27 +12645,27 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-29T05:06:50+00:00"
+            "time": "2026-06-05T06:23:12+00:00"
        },
        {
            "name": "thecodingmachine/phpstan-safe-rule",
-            "version": "v1.4.3",
+            "version": "v1.4.7",
            "source": {
                "type": "git",
                "url": "https://github.com/thecodingmachine/phpstan-safe-rule.git",
-                "reference": "5c804889253ce9498ef185e108e9f94b6023208e"
+                "reference": "51fa2a35a270f683fc9ea53384a03e892b4d7b51"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/thecodingmachine/phpstan-safe-rule/zipball/5c804889253ce9498ef185e108e9f94b6023208e",
-                "reference": "5c804889253ce9498ef185e108e9f94b6023208e",
+                "url": "https://api.github.com/repos/thecodingmachine/phpstan-safe-rule/zipball/51fa2a35a270f683fc9ea53384a03e892b4d7b51",
+                "reference": "51fa2a35a270f683fc9ea53384a03e892b4d7b51",
                "shasum": ""
            },
            "require": {
                "nikic/php-parser": "^5",
                "php": "^8.1",
-                "phpstan/phpstan": "^2.1.11",
-                "thecodingmachine/safe": "^1.2 || ^2.0 || ^3.0"
+                "phpstan/phpstan": "^2.2.2",
+                "thecodingmachine/safe": "^3.1"
            },
            "require-dev": {
                "php-coveralls/php-coveralls": "^2.1",
@@ -12699,9 +12701,9 @@
            "description": "A PHPStan rule to detect safety issues. Must be used in conjunction with thecodingmachine/safe",
            "support": {
                "issues": "https://github.com/thecodingmachine/phpstan-safe-rule/issues",
-                "source": "https://github.com/thecodingmachine/phpstan-safe-rule/tree/v1.4.3"
+                "source": "https://github.com/thecodingmachine/phpstan-safe-rule/tree/v1.4.7"
            },
-            "time": "2025-11-21T09:41:49+00:00"
+            "time": "2026-06-21T07:55:55+00:00"
        },
        {
            "name": "theseer/tokenizer",
@@ -12755,16 +12757,16 @@
        },
        {
            "name": "vincentlanglet/twig-cs-fixer",
-            "version": "4.0.1",
+            "version": "4.0.2",
            "source": {
                "type": "git",
                "url": "https://github.com/VincentLanglet/Twig-CS-Fixer.git",
-                "reference": "366f7cca494a6f95c5f410ae542aef9c164d329e"
+                "reference": "1cb75618f7dd0f9bf51924aa6d3aa8c588f51d5a"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/VincentLanglet/Twig-CS-Fixer/zipball/366f7cca494a6f95c5f410ae542aef9c164d329e",
-                "reference": "366f7cca494a6f95c5f410ae542aef9c164d329e",
+                "url": "https://api.github.com/repos/VincentLanglet/Twig-CS-Fixer/zipball/1cb75618f7dd0f9bf51924aa6d3aa8c588f51d5a",
+                "reference": "1cb75618f7dd0f9bf51924aa6d3aa8c588f51d5a",
                "shasum": ""
            },
            "require": {
@@ -12820,7 +12822,7 @@
            "homepage": "https://github.com/VincentLanglet/Twig-CS-Fixer",
            "support": {
                "issues": "https://github.com/VincentLanglet/Twig-CS-Fixer/issues",
-                "source": "https://github.com/VincentLanglet/Twig-CS-Fixer/tree/4.0.1"
+                "source": "https://github.com/VincentLanglet/Twig-CS-Fixer/tree/4.0.2"
            },
            "funding": [
                {
@@ -12828,7 +12830,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-06-18T15:31:27+00:00"
+            "time": "2026-06-29T15:22:14+00:00"
        }
    ],
    "aliases": [],
@@ -3,6 +3,7 @@
 declare(strict_types=1);

 use Rector\Config\RectorConfig;
+use Rector\PHPUnit\CodeQuality\Rector\Class_\AddSeeTestAnnotationRector;
 use Rector\Symfony\Bridge\Symfony\Routing\SymfonyRoutesProvider;
 use Rector\Symfony\Contract\Bridge\Symfony\Routing\SymfonyRoutesProviderInterface;

@@ -13,7 +14,7 @@ return RectorConfig::configure()
        __DIR__.'/src',
        __DIR__.'/tests',
    ])
-    ->withSkip([__DIR__.'/config/reference.php'])
+    ->withSkipPath(__DIR__.'/config/reference.php')
    ->withSymfonyContainerXml(__DIR__.'/var/cache/dev/Tvdt_KernelDevDebugContainer.xml')
    ->withSymfonyContainerPhp(__DIR__.'/tests/symfony-container.php')
    ->registerService(SymfonyRoutesProvider::class, SymfonyRoutesProviderInterface::class)
@@ -34,4 +35,6 @@ return RectorConfig::configure()
    )
    ->withAttributesSets(all: true)
    ->withComposerBased(twig: true, doctrine: true, phpunit: true, symfony: true)
+    ->withSkip([AddSeeTestAnnotationRector::class])
+
 ;
@@ -0,0 +1,16 @@
+{% if is_granted('IS_AUTHENTICATED') or app.current_route() == 'tvdt_quiz_select_season' %}
+    <div class="quiz-topbar">
+        {% if is_granted('IS_AUTHENTICATED') %}
+            <a href="{{ path('tvdt_backoffice_index') }}" class="btn btn-outline-secondary btn-sm">
+                {{ 'Backoffice'|trans }}
+            </a>
+            <a href="{{ path('tvdt_login_logout') }}" class="btn btn-outline-secondary btn-sm">
+                {{ 'Logout'|trans }}
+            </a>
+        {% else %}
+            <a href="{{ path('tvdt_backoffice_index') }}" class="btn btn-outline-secondary btn-sm">
+                {{ 'Manage Quiz'|trans }}
+            </a>
+        {% endif %}
+    </div>
+{% endif %}
@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Twig;
+
+use PHPUnit\Framework\Assert;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+
+use function Safe\file_get_contents;
+use function Safe\preg_match_all;
+
+final class TemplateReferencesTest extends TestCase
+{
+    private static string $templatesDir;
+
+    public static function setUpBeforeClass(): void
+    {
+        self::$templatesDir = \dirname(__DIR__, 2).'/templates';
+    }
+
+    /** @return iterable<string, array{string, string}> */
+    public static function templateReferenceProvider(): iterable
+    {
+        $templatesDir = \dirname(__DIR__, 2).'/templates';
+        $iterator = new \RecursiveIteratorIterator(
+            new \RecursiveDirectoryIterator($templatesDir, \RecursiveDirectoryIterator::SKIP_DOTS),
+        );
+
+        foreach ($iterator as $file) {
+            Assert::assertInstanceOf(\SplFileInfo::class, $file);
+            if ('twig' !== $file->getExtension()) {
+                continue;
+            }
+
+            $content = file_get_contents($file->getPathname());
+            $sourceFile = str_replace($templatesDir.'/', '', $file->getPathname());
+
+            // Match extends, include(), and embed tags — capture the quoted template name
+            preg_match_all(
+                '/(?:extends|include|embed)\s*\(?[\'"]([^\'"]+)[\'"]\)?/',
+                $content,
+                $matches,
+            );
+
+            foreach ($matches[1] as $referencedTemplate) {
+                yield \sprintf('%s → %s', $sourceFile, $referencedTemplate) => [$sourceFile, $referencedTemplate];
+            }
+        }
+    }
+
+    #[DataProvider('templateReferenceProvider')]
+    public function testReferencedTemplateExists(string $sourceFile, string $referencedTemplate): void
+    {
+        $absolutePath = self::$templatesDir.'/'.$referencedTemplate;
+
+        $this->assertFileExists(
+            $absolutePath,
+            \sprintf("Template '%s' references '%s' which does not exist at '%s'.", $sourceFile, $referencedTemplate, $absolutePath),
+        );
+    }
+}
Author	SHA1	Message	Date
Marijn	d1d1eb3a24	docs: update README and add pre-commit hook (#173 ) * docs: replace requirements with developer and deployment guide * docs: add CI badge, disclaimer, contributing guide, and license * docs: fix and expand disclaimer based on legal review * docs: clarify test vs dev fixture commands in testing section * feat: add pre-commit hook for staged-file quality checks Adds a versioned .githooks/pre-commit script that runs Rector, PHP-CS-Fixer, and PHPStan on staged PHP files, and Twig-CS-Fixer on staged Twig files. Auto-fixes are re-staged before PHPStan runs. Falls back to docker compose run --rm when the PHP service is not up. Install with: just install-hooks * chore: switch pre-commit hook shebang from bash to zsh	2026-07-03 15:05:29 +00:00
Marijn	5ea7a636b8	ci: skip dev image build on tags, wait for in-progress CI runs, improve quality error output (#171 ) - Skip the dev image build job on tag pushes — it was wasted work since quality and tests are already skipped on tags - Remove the unnecessary `needs: build` from verify-prior-run; it ran independently of the dev image anyway - Make verify-prior-run poll (30s interval, 15 min max) so tagging immediately after a push to main waits for the CI run to finish rather than failing instantly - Replace the yes/no outcomes string in "Assert all checks passed" with per-step ::error:: annotations so GitHub highlights exactly which quality check failed	2026-07-03 12:28:01 +00:00
dependabot[bot]	d37136be93	Bump martin-georgiev/postgresql-for-doctrine from 4.6.0 to 4.7.0 (#163 ) Bumps [martin-georgiev/postgresql-for-doctrine](https://github.com/martin-georgiev/postgresql-for-doctrine) from 4.6.0 to 4.7.0. - [Release notes](https://github.com/martin-georgiev/postgresql-for-doctrine/releases) - [Changelog](https://github.com/martin-georgiev/postgresql-for-doctrine/blob/main/CHANGELOG.md) - [Commits](https://github.com/martin-georgiev/postgresql-for-doctrine/compare/v4.6.0...v4.7.0) --- updated-dependencies: - dependency-name: martin-georgiev/postgresql-for-doctrine dependency-version: 4.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-03 12:14:30 +00:00
dependabot[bot]	212401a97f	Bump the dev-dependencies group across 1 directory with 10 updates (#164 ) * Bump the dev-dependencies group across 1 directory with 10 updates Bumps the dev-dependencies group with 10 updates in the / directory: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [friendsofphp/php-cs-fixer](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer) \| `3.95.8` \| `3.95.11` \| \| [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source) \| `2.2.2` \| `2.2.4` \| \| [phpstan/phpstan-phpunit](https://github.com/phpstan/phpstan-phpunit) \| `2.0.16` \| `2.0.17` \| \| [phpunit/phpunit](https://github.com/sebastianbergmann/phpunit) \| `13.2.1` \| `13.2.2` \| \| [rector/rector](https://github.com/rectorphp/rector) \| `2.4.6` \| `2.5.2` \| \| [symfony/browser-kit](https://github.com/symfony/browser-kit) \| `8.1.0` \| `8.1.1` \| \| [symfony/phpunit-bridge](https://github.com/symfony/phpunit-bridge) \| `8.1.0` \| `8.1.1` \| \| [symfony/web-profiler-bundle](https://github.com/symfony/web-profiler-bundle) \| `8.1.0` \| `8.1.1` \| \| [thecodingmachine/phpstan-safe-rule](https://github.com/thecodingmachine/phpstan-safe-rule) \| `1.4.3` \| `1.4.7` \| \| [vincentlanglet/twig-cs-fixer](https://github.com/VincentLanglet/Twig-CS-Fixer) \| `4.0.1` \| `4.0.2` \| Updates `friendsofphp/php-cs-fixer` from 3.95.8 to 3.95.11 - [Release notes](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/releases) - [Changelog](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/blob/master/CHANGELOG.md) - [Commits](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/compare/v3.95.8...v3.95.11) Updates `phpstan/phpstan` from 2.2.2 to 2.2.4 - [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits) Updates `phpstan/phpstan-phpunit` from 2.0.16 to 2.0.17 - [Release notes](https://github.com/phpstan/phpstan-phpunit/releases) - [Commits](https://github.com/phpstan/phpstan-phpunit/compare/2.0.16...2.0.17) Updates `phpunit/phpunit` from 13.2.1 to 13.2.2 - [Release notes](https://github.com/sebastianbergmann/phpunit/releases) - [Changelog](https://github.com/sebastianbergmann/phpunit/blob/13.2.2/ChangeLog-13.2.md) - [Commits](https://github.com/sebastianbergmann/phpunit/compare/13.2.1...13.2.2) Updates `rector/rector` from 2.4.6 to 2.5.2 - [Release notes](https://github.com/rectorphp/rector/releases) - [Commits](https://github.com/rectorphp/rector/compare/2.4.6...2.5.2) Updates `symfony/browser-kit` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/symfony/browser-kit/releases) - [Changelog](https://github.com/symfony/browser-kit/blob/8.2/CHANGELOG.md) - [Commits](https://github.com/symfony/browser-kit/compare/v8.1.0...v8.1.1) Updates `symfony/phpunit-bridge` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/symfony/phpunit-bridge/releases) - [Changelog](https://github.com/symfony/phpunit-bridge/blob/8.2/CHANGELOG.md) - [Commits](https://github.com/symfony/phpunit-bridge/compare/v8.1.0...v8.1.1) Updates `symfony/web-profiler-bundle` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/symfony/web-profiler-bundle/releases) - [Changelog](https://github.com/symfony/web-profiler-bundle/blob/8.2/CHANGELOG.md) - [Commits](https://github.com/symfony/web-profiler-bundle/compare/v8.1.0...v8.1.1) Updates `thecodingmachine/phpstan-safe-rule` from 1.4.3 to 1.4.7 - [Release notes](https://github.com/thecodingmachine/phpstan-safe-rule/releases) - [Commits](https://github.com/thecodingmachine/phpstan-safe-rule/compare/v1.4.3...v1.4.7) Updates `vincentlanglet/twig-cs-fixer` from 4.0.1 to 4.0.2 - [Release notes](https://github.com/VincentLanglet/Twig-CS-Fixer/releases) - [Commits](https://github.com/VincentLanglet/Twig-CS-Fixer/compare/4.0.1...4.0.2) --- updated-dependencies: - dependency-name: friendsofphp/php-cs-fixer dependency-version: 3.95.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: phpstan/phpstan dependency-version: 2.2.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: phpstan/phpstan-phpunit dependency-version: 2.0.17 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: phpunit/phpunit dependency-version: 13.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: rector/rector dependency-version: 2.5.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: symfony/browser-kit dependency-version: 8.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: symfony/phpunit-bridge dependency-version: 8.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: symfony/web-profiler-bundle dependency-version: 8.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: thecodingmachine/phpstan-safe-rule dependency-version: 1.4.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: vincentlanglet/twig-cs-fixer dependency-version: 4.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * Ignore rector rule --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Marijn Doeve <marijn@doeve.me>	2026-07-03 12:08:58 +00:00
Marijn	7c74574d3c	fix(ci): prevent script injection in Portainer deployment step (#170 ) Move IMAGE_TAG and SENTRY_RELEASE step outputs into env: vars so they are passed as environment variables rather than interpolated directly into the shell command string, eliminating a potential script-injection vector via a crafted tag or Sentry version value.	2026-07-03 11:54:52 +00:00
Marijn	b1f84d441f	fix: align SENTRY_RELEASE env var with the release created by the Sentry action (#169 ) The Sentry action receives the v-stripped version (e.g. 0.1.1) but the app's SENTRY_RELEASE was set to IMAGE_TAG (e.g. v0.1.1). This caused Sentry to auto-create a second release from incoming events, labelling it (non-semver) instead of associating events with the properly created release. Pass SENTRY_RELEASE as a separate query param through the Portainer webhook (using the already-computed sentry_version output) and reference that in compose.prod.yaml instead of IMAGE_TAG.	2026-07-03 11:28:22 +00:00
dependabot[bot]	8c72b1b217	Bump dependabot/fetch-metadata from 2 to 3 (#168 ) Bumps [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) from 2 to 3. - [Release notes](https://github.com/dependabot/fetch-metadata/releases) - [Commits](https://github.com/dependabot/fetch-metadata/compare/v2...v3) --- updated-dependencies: - dependency-name: dependabot/fetch-metadata dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-03 10:23:14 +00:00
Marijn	806cff8c0f	ci: optimise build pipeline — shared dev image build and skip tests on tag push (#167 ) * ci: split dev image build into a shared job Extract the Docker build step into a dedicated `build` job so `quality` and `tests` no longer each build the image independently. Both jobs now load from the shared `devbuild` GHA cache scope and declare `needs: build`. * ci: skip quality+tests on tag push, verify prior CI run instead When tagging a commit that already passed CI on main, there is no need to run quality and tests again. Both jobs now skip for tag refs. A new `verify-prior-run` job runs instead: it queries the GitHub API for a prior successful CI run on the same SHA (excluding the current run) and fails fast if none is found, preventing deployment of untested tags. `build-deploy` now uses `always() && !cancelled() && !failure()` so it handles the mix of skipped (quality/tests) and successful (verify-prior-run) needed jobs correctly. * ci: bump GitHub Actions to Node.js 24 compatible versions * ci: add Dependabot config for GitHub Actions version updates * ci: pin all GitHub Actions to commit SHAs * ci: disable credential persistence on all checkout steps	2026-07-03 12:18:29 +02:00
Marijn	815e7b17be	Add missing quiz/nav.html.twig and test for template reference integrity (#166 ) Adds the previously uncommitted quiz nav partial that broke main, and introduces TemplateReferencesTest which scans all Twig templates for extends/include/embed references and asserts each target file exists — preventing this class of missing-template mistake from reaching CI undetected.	2026-07-02 21:08:21 +00:00
Marijn	764f59e6a7	Improve GitHub Actions CI: parallelise jobs, continue-on-error, timeouts, cache optimisation (#165 ) * Strip v-prefix from version tag before passing to Sentry GitHub tags follow the v1.2.3 convention, but Sentry requires bare semver (1.2.3) to recognise releases as valid semver. Extract a sentry_version output in the meta step that strips the leading v. * Parallelize CI: split quality and tests jobs, add continue-on-error - Split the single tests job into parallel quality and tests jobs, saving ~4 min wall-clock time per run - Quality checks (lint, CS, PHPStan, Rector) now all run with continue-on-error so every failure is visible in one pass; a final Assert step fails the job if any check failed - Add cache:warmup before PHPStan so the Symfony dev container XML exists and the Symfony extension has full type information - Use per-job GHA cache scopes to avoid parallel cache write races - Use cache mode=min on PRs, mode=max on main/tags - Add timeout-minutes (20/20/15) to all jobs - Remove dead if:false Mercure reachability step - Fix Portainer webhook URL quoting - build-deploy now needs: [quality, tests] * Simplify build-deploy job name and environment expressions * Use static name for build-deploy job (expressions not evaluated when skipped) * build-deploy only needs tests, not quality (quality is informational) * Revert: build-deploy needs both quality and tests	2026-07-02 23:06:23 +02:00