feat: support Sylius 2.3 and Symfony 8

.gitattributes

@@ -6,7 +6,7 @@
 /AGENTS.md                  export-ignore
 /CLAUDE.md                  export-ignore
 /Makefile                   export-ignore
-/behat.yml.dist             export-ignore
+/behat.dist.php             export-ignore
 /compose.override.dist.yml  export-ignore
 /compose.yml                export-ignore
 /ecs.php                    export-ignore

.github/workflows/build.yaml

@@ -28,9 +28,15 @@ concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
     cancel-in-progress: true
 
+permissions:
+    contents: read
+
 jobs:
     tests:
-        runs-on: ubuntu-latest
+        # Pinned rather than `ubuntu-latest`: the build action is only known to work on this image.
+        runs-on: ubuntu-24.04
+        # A stuck browser would otherwise hold the runner for the 6-hour default.
+        timeout-minutes: 30
 
         name: "Sylius ${{ matrix.sylius }}, PHP ${{ matrix.php }}, Symfony ${{ matrix.symfony }}, ${{ matrix.database }}"
 
@@ -42,27 +48,44 @@ jobs:
                 # dependency rather than on our code, move the line to `continue-on-error` with a
                 # comment - do not drop it from the matrix.
                 php: ["8.2", "8.3", "8.4", "8.5"]
-                symfony: ["^6.4", "^7.4"]
+                symfony: ["^6.4", "^7.4", "^8.0"]
                 # The floor is 2.1 rather than 2.0 for two reasons lying with Sylius itself. Its
                 # Behat cart context did not restore the security token before 2.1, so a scenario
                 # logging the customer in before filling their cart cannot pass on 2.0. And 2.0
                 # pins Behat versions predating PHP 8.5, which Composer therefore cannot install
                 # together.
-                sylius: ["~2.1.0", "~2.2.0"]
+                sylius: ["~2.1.0", "~2.2.0", "~2.3.0"]
                 # The plugin creates no table and writes no query: a single database is enough on
                 # the main matrix. The cycles saved cover 4 PHP versions.
                 database: ["mysql:8.4"]
                 node: ["22.x"]
+                # Sylius 2.3 needs PHP 8.3 and is the only one to support Symfony 8, which needs
+                # PHP 8.4. Symfony 6.4 is covered by Sylius 2.1 and 2.2: running it on 2.3 as well
+                # would cost three jobs for a combination no new project picks.
+                exclude:
+                    - sylius: "~2.1.0"
+                      symfony: "^8.0"
+                    - sylius: "~2.2.0"
+                      symfony: "^8.0"
+                    - sylius: "~2.3.0"
+                      symfony: "^6.4"
+                    - sylius: "~2.3.0"
+                      php: "8.2"
+                    - symfony: "^8.0"
+                      php: "8.3"
 
                 include:
+                    # The build action declares MariaDB with a bare version, which DBAL reads as
+                    # MySQL: that is what the Sylius 2.3 migrations need, they skip a database
+                    # declared as MariaDB.
                     - php: "8.4"
                       symfony: "^7.4"
-                      sylius: "~2.2.0"
+                      sylius: "~2.3.0"
                       database: "mariadb:11.4"
                       node: "22.x"
                     - php: "8.4"
                       symfony: "^7.4"
-                      sylius: "~2.2.0"
+                      sylius: "~2.3.0"
                       database: "postgres:17"
                       node: "22.x"
 
@@ -73,9 +96,22 @@ jobs:
             -
                 uses: actions/checkout@v7
 
+            # Sylius 2.1 / 2.2 declare their Behat steps in annotations, which Behat 4 no longer reads;
+            # Composer would still pick Behat 4 for them.
+            -
+                name: Keep Behat 3 before Sylius 2.3
+                if: matrix.sylius != '~2.3.0'
+                run: composer require --dev --no-update --no-interaction "behat/behat:^3.22" "friends-of-behat/mink-extension:^2.7"
+
+            # Sylius 2.1 mappings fail ORM 3.7 validation (ShipmentUnit#shipment vs Shipment#units).
+            -
+                name: Keep Doctrine ORM below 3.7 before Sylius 2.3
+                if: matrix.sylius != '~2.3.0'
+                run: composer require --no-update --no-interaction "doctrine/orm:^2.20 || >=3.6 <3.7"
+
             -
                 name: Build Sylius Test Application
-                uses: SyliusLabs/BuildTestAppAction@v4
+                uses: SyliusLabs/BuildTestAppAction@fbdfc158a99f540fc3bbe554b46120d14444f2f4 # v4.3.0
                 with:
                     # The Behat scenarios open no browser - `symfony` session, no `@javascript`
                     # tag - but the admin pages render the Webpack Encore entries: without a
@@ -86,6 +122,9 @@ jobs:
                     database: "${{ matrix.database }}"
                     node_version: "${{ matrix.node }}"
                     php_version: "${{ matrix.php }}"
+                    # The PHP-FPM worker behind `symfony server:start` segfaulted at random under OPcache
+                    # (Behat 502, "child exited on signal 11"): Behat does not need it.
+                    opcache_enable: "no"
                     sylius_version: "${{ matrix.sylius }}"
                     symfony_version: "${{ matrix.symfony }}"
 
@@ -103,20 +142,24 @@ jobs:
             # most frequent class of bug.
             -
                 name: Validate container
-                run: vendor/bin/console lint:container
+                run: vendor/bin/console lint:container --env=test
 
             # Sylius encrypts the gateway configuration: without this key, every test writing to
             # the database fails on "Cannot read keyfile", an error that does not say its name.
             -
                 name: Generate the payment encryption key
                 run: vendor/bin/console sylius:payment:generate-key
 
+            # Static analysis and the coding standard do not depend on the database nor on the PHP
+            # version line under test, so they only run once, on the primary job.
             -
                 name: Run PHPStan
+                if: matrix.php == '8.4' && matrix.symfony == '^7.4' && matrix.sylius == '~2.3.0' && matrix.database == 'mysql:8.4'
                 run: vendor/bin/phpstan analyse --ansi --no-progress
 
             -
                 name: Run ECS
+                if: matrix.php == '8.4' && matrix.symfony == '^7.4' && matrix.sylius == '~2.3.0' && matrix.database == 'mysql:8.4'
                 run: vendor/bin/ecs check --ansi --no-progress-bar
 
             -
@@ -148,7 +191,7 @@ jobs:
     # required check counts as satisfied - the rule would let through exactly what it guards
     # against.
     build:
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         name: "Build complete"
         needs: tests
         if: always()

.github/workflows/security.yaml

@@ -10,9 +10,13 @@ on:
             cron: "0 7 * * 1" # Every Monday at 7am
     workflow_dispatch: ~
 
+permissions:
+    contents: read
+
 jobs:
     audit:
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
+        timeout-minutes: 15
 
         name: "Composer audit"
 
@@ -22,7 +26,7 @@ jobs:
 
             -
                 name: Setup PHP
-                uses: shivammathur/setup-php@v2
+                uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
                 with:
                     php-version: "8.4"
                     coverage: none

.gitignore

@@ -7,7 +7,7 @@
 /etc/build/*
 !/etc/build/.gitignore
 
-/behat.yml
+/behat.php
 /phpunit.xml
 /compose.override.yml
 

CLAUDE.md

@@ -48,7 +48,7 @@ docker run --rm -v "$PWD":/app -w /app/vendor/sylius/test-application \
 
 ### A file added under `config/services/` is not seen by `cache:clear`
 
-`config/services.xml` imports `services/**`, and the `GlobResource` keeps the list frozen. You need
+`config/services.php` imports `services/*.php`, and the `GlobResource` keeps the list frozen. You need
 `rm -rf var/cache/*`. Symptom: the services of the new file do not exist, without the slightest
 error.
 
@@ -64,7 +64,9 @@ first payment in the database appears to work.
 Sylius encrypts the gateway configuration (`sylius_payment.encryption.enabled` defaults to true).
 **Without an encryption key, every write fails on `Cannot read keyfile`.** The key lives in
 `vendor/sylius/test-application/config/encryption/` and therefore disappears on every
-`composer install`.
+`composer install` or `update` that replaces the test application. The gateway configurations
+already in a database were encrypted with the lost key: the payment methods grid then answers 500
+on a decryption error. Recreate those payment methods, or reload the fixtures.
 
 ```bash
 APP_ENV=test vendor/bin/console doctrine:schema:update --force --complete -n
@@ -86,6 +88,12 @@ APP_ENV=test vendor/bin/console sylius:payment:generate-key
   the matching Sylius foundation.
 - **`PasswordType` fields require `always_empty: false`** - otherwise saving an existing
   `PaymentMethod` again overwrites the keys with empty strings.
+- **Configuration stays in PHP.** Symfony 8 no longer loads XML service definitions, and Behat 4
+  (the one Symfony 8 requires) neither YAML configuration nor step annotations: services in
+  `config/services/*.php`, Behat in `behat.dist.php`, steps as `#[Given]` attributes.
+- **Sylius 2.1 to 2.3 with one code base.** Where Sylius changed a signature, widen the parameter
+  rather than branch on the version - `AxeptaHttpResponseProvider` takes `object $request` because
+  2.1 / 2.2 pass a `RequestConfiguration` and 2.3 a `Request`.
 - **New configuration keys must tolerate their own absence**: a gateway configuration written by an
   earlier version does not carry them.
 - The public contract - protocol classes, substitutable interfaces, hookable names, service tags,

CONTRIBUTING.md

@@ -37,7 +37,7 @@ Two checks have to be green before a pull request can be merged:
 
 | Check | What it covers |
 |---|---|
-| **`Build complete`** | the 18 matrix jobs, aggregated: PHP 8.2 to 8.5, Symfony 6.4 and 7.4, Sylius 2.1 and 2.2 |
+| **`Build complete`** | the 23 matrix jobs, aggregated: PHP 8.2 to 8.5, Symfony 6.4, 7.4 and 8, Sylius 2.1, 2.2 and 2.3, within what each Sylius supports |
 | **`Composer audit`** | known vulnerabilities in the dependencies |
 
 If this is your first contribution, the workflows will not start until a maintainer approves the

README.md

@@ -17,9 +17,9 @@ Integration of the **Axepta BNP Paribas** payment gateway for **Sylius 2.1+**.
 
 | Component | Versions |
 |---|---|
-| PHP | `^8.2` |
-| Sylius | `^2.1` |
-| Symfony | `^6.4` or `^7.4` |
+| PHP | `^8.2` (Sylius 2.3: `^8.3`, Symfony 8: `^8.4`) |
+| Sylius | `2.1`, `2.2`, `2.3` |
+| Symfony | `^6.4`, `^7.4`, or `^8.0` with Sylius 2.3 |
 
 ## What this plugin does
 
@@ -124,8 +124,9 @@ notification, accented description in ISO-8859-1, and twelve-character merchant
 nominal cycles were replayed on the code as it stands; the remaining cases come from an earlier
 campaign, on a slightly older revision.
 
-**The continuous integration matrix is green** across the eighteen advertised combinations: PHP 8.2
-to 8.5, Symfony 6.4 and 7.4, Sylius 2.1 and 2.2, and MySQL 8.4, MariaDB 11.4 and PostgreSQL 17. The
+**The continuous integration matrix is green** across the twenty-three advertised combinations:
+PHP 8.2 to 8.5, Symfony 6.4, 7.4 and 8, Sylius 2.1, 2.2 and 2.3 - within what each Sylius version
+supports - and MySQL 8.4, MariaDB 11.4 and PostgreSQL 17. The
 run against the real platform was carried out on **PHP 8.4 / Sylius 2.2 / Symfony 7.4** - the only
 combination on which a payment was actually taken.
 

UPGRADE.md

@@ -6,4 +6,9 @@ plugin.
 A payment plugin is upgraded in production, on a site that takes money: every compatibility break
 must be written here before it is released, together with the exact manoeuvre to carry out.
 
-`v1.0.0` is the first release: there is nothing to upgrade from yet.
+## From 1.0 to 1.1
+
+Nothing to change in the project: 1.1 adds Sylius 2.3 and Symfony 8 support and breaks nothing.
+
+The plugin now defines its services in PHP, Symfony 8 no longer reading XML. Service ids, tags and
+arguments are unchanged: a project that decorates or overrides them by id keeps working.

behat.dist.php

@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+
+use Behat\Config\Config;
+use Behat\MinkExtension\ServiceContainer\MinkExtension;
+use DMore\ChromeExtension\Behat\ServiceContainer\ChromeExtension;
+use FriendsOfBehat\MinkDebugExtension\ServiceContainer\MinkDebugExtension;
+use FriendsOfBehat\SuiteSettingsExtension\ServiceContainer\SuiteSettingsExtension;
+use FriendsOfBehat\SymfonyExtension\ServiceContainer\SymfonyExtension;
+use FriendsOfBehat\VariadicExtension\ServiceContainer\VariadicExtension;
+use SyliusLabs\SuiteTagsExtension\ServiceContainer\SuiteTagsExtension;
+
+// Sylius suites are not imported: Sylius 2.1 / 2.2 ship them in YAML, Sylius 2.3 in PHP, and the
+// plugin suites only need the Sylius contexts, which are services of the test kernel.
+return (new Config([
+    'default' => [
+        'formatters' => [
+            'pretty' => [
+                'verbose' => true,
+                'paths' => false,
+                'snippets' => false,
+            ],
+        ],
+        'extensions' => [
+            ChromeExtension::class => null,
+            MinkDebugExtension::class => [
+                'directory' => 'etc/build',
+                'clean_start' => false,
+                'screenshot' => true,
+            ],
+            MinkExtension::class => [
+                'files_path' => '%paths.base%/vendor/sylius/sylius/src/Sylius/Behat/Resources/fixtures/',
+                'base_url' => '%env(BEHAT_BASE_URL)%',
+                'default_session' => 'symfony',
+                'javascript_session' => 'chrome',
+                'sessions' => [
+                    'symfony' => [
+                        'symfony' => null,
+                    ],
+                    'chrome' => [
+                        'chrome' => [
+                            'api_url' => 'http://127.0.0.1:9222',
+                            'validate_certificate' => false,
+                        ],
+                    ],
+                ],
+                'show_auto' => false,
+            ],
+            SymfonyExtension::class => [
+                'bootstrap' => 'vendor/sylius/test-application/config/bootstrap.php',
+                'kernel' => [
+                    'class' => 'Sylius\TestApplication\Kernel',
+                    'environment' => 'test',
+                ],
+            ],
+            VariadicExtension::class => null,
+            SuiteSettingsExtension::class => [
+                'paths' => ['features'],
+            ],
+            SuiteTagsExtension::class => null,
+        ],
+    ],
+]))->import('tests/Behat/Resources/suites.php');

compose.override.dist.yml

@@ -1,6 +1,6 @@
 services:
     php:
-        image: ghcr.io/sylius/sylius-php:8.3-fixuid-xdebug-alpine
+        image: ghcr.io/sylius/sylius-php:8.4-fixuid-xdebug-alpine
         user: ${DOCKER_USER:-1000:1000}
         depends_on:
             mysql:
@@ -51,7 +51,7 @@ services:
         ports:
             - "80:80"
     nodejs:
-        image: node:${NODE_VERSION:-20}-alpine
+        image: node:${NODE_VERSION:-22}-alpine
         user: ${DOCKER_USER:-1000:1000}
         working_dir: /srv/sylius
         entrypoint: [ "/bin/sh","-c" ]

compose.yml

@@ -1,6 +1,6 @@
 services:
     php:
-        image: ghcr.io/sylius/sylius-php:8.3-alpine
+        image: ghcr.io/sylius/sylius-php:8.4-alpine
     mysql:
         image: mysql:8.4
         platform: linux/amd64