Filament Canary Laravel Package

Added — safe to run against real databases

• The sweep runs in a transaction and rolls it back, so the users/records it creates via factories are never persisted (default connection). Opt out with use_transaction => false.
• It refuses to run in the production environment — a rollback can't undo the other side effects of requesting every page as an admin (queued jobs, mail, audit logs, writes on secondary connections), so Canary won't run there.

Full changelog: https://github.com/Baspa/filament-canary/compare/v1.1.0...v1.2.0

Added

• Clearer failures — when the acting user, a record, or a tenant can't be created, the real exception is now shown in the skip reason (e.g. could not create an authorized user for panel [admin]: Could not verify the hashed value's configuration.) instead of a generic "no authorized user" / "no factory" skip. (#4)

Changed (CI / security)

• All workflow actions are pinned to full-length commit SHAs, workflows declare least-privilege permissions, and a SECURITY.md disclosure policy was added. (#5)

Docs

• Why a runtime sweep beats AI-generated tests, and why it's not "AI vs. Canary".
• How to support non-standard auth (custom API/session guards) by binding your own Requester. (#3)
• Banner and a code-coverage badge.

Full changelog: https://github.com/Baspa/filament-canary/compare/v1.0.0...v1.1.0

First release. 🐤

Filament Canary is a runtime smoke-sweep for your Filament panels. It introspects every panel, resource and page at runtime and asserts the one thing you almost never write tests for: every page mounts for an authorized user, and is denied to guests — enforced in CI on every PR.

No generated test files, no drift: new resources are covered automatically.

What's in it

• Runtime sweep over Filament::getPanels() → resources → pages, driven by the live route table.
• canary:check command — per-page report + non-zero exit for CI (with --strict).
• InteractsWithCanary test helper — one $this->canarySweep() assertion in your suite.
• canary:install — reads each panel's access gate (canAccessPanel, roles, email allowlists, tenancy) and proposes an acting_as config for you.
• Honest results: ✅ passed · ❌ failed (5xx / authorization leak) · 🔒 needs-auth · ⏭️ skipped (with a reason). Nothing is silently left untested.

Requirements

• PHP 8.2+
• Filament v4 or v5

Scope (on purpose)

Mount + authorization only. No form submissions / CRUD assertions (that's the app-specific part to write by hand). Filament v3 is out of scope.